@redeemid/emdash 0.0.0-stage → 0.0.2

package/LICENSE

@@ -0,0 +1,20 @@
+The MIT License
+
+Copyright 2026 Vinny S. Green, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,143 @@
-# Temporary Holding Version
+# RedeemID for EmDash
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
+
+**Status: 0.0.2, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the page gate and plan checkout are covered by an end-to-end test against a fake store.
+
+## What it does
+
+- **Sign in with the store's customer account.** Members click "Sign in" on your site, sign in on the store's account page and come back signed in. They become EmDash Subscribers. That role only means "signed in"; it never grants content.
+- **Mirrors the customer.** Email, name, tags and enabled/disabled status, kept current by signed Shopify webhooks.
+- **Levels from tags.** You map Shopify customer tags to levels. Set tags in Shopify Flow or any app; RedeemID only reads them.
+- **Rules per collection or term.** Lock a collection, or only entries in a category or tag.
+- **Plans and checkout.** `<Plan>` shows a Shopify product's price and starts checkout through the Storefront API.
+- **A page gate.** `<Gate>` shows the entry to readers who may read it and a teaser plus "Sign in" to everyone else.
+- **Keeps members out of EmDash's own APIs**, so the gate is the only way to read locked content.
+
+## Install
+
+The package is a native EmDash plugin (an npm dependency, not a registry plugin), because sign-in and page gating run in the site process.
+
+```sh
+pnpm add @redeemid/emdash
+```
+
+```js title="astro.config.mjs"
+import { redeemid, redeemidGuard } from "@redeemid/emdash";
+import emdash from "emdash/astro";
+
+export default defineConfig({
+	integrations: [
+		emdash({
+			// database, storage, …
+			authProviders: [
+				redeemid({
+					shop: "my-store.myshopify.com",
+					levels: [
+						{ slug: "member", name: "Member", tags: ["member"] },
+						{ slug: "pro", name: "Pro", tags: ["pro"] },
+						// match: "all" needs every tag, e.g. both memberships:
+						{ slug: "both", name: "Member + Pro", tags: ["member", "pro"], match: "all" },
+					],
+					rules: [
+						{ collection: "posts", taxonomy: "category", term: "members", levels: ["member", "pro"] },
+						{ collection: "posts", taxonomy: "category", term: "pro", levels: ["pro"] },
+					],
+				}),
+			],
+		}),
+		redeemidGuard(),
+	],
+});
+```
+
+Set these secrets in the environment (`.env` locally, `wrangler secret put` on Workers). [docs/shopify-setup.md](docs/shopify-setup.md) walks through the Shopify side:
+
+| Variable | Shopify API | What it is |
+| --- | --- | --- |
+| `REDEEMID_SHOPIFY_STORE_DOMAIN` | Customer Account API discovery | The store's `*.myshopify.com` domain. Only needed when `shop` isn't set in the config. |
+| `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID` | Customer Account API | Client ID of the Headless storefront's Customer Account API client |
+| `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET` | Customer Account API | Its client secret. Confidential clients only; leave unset for a public client. |
+| `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET` | Webhooks (Admin API app) | Client secret of the Shopify app that sends the webhooks. Shopify signs each webhook with it. |
+| `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
+| `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
+
+RedeemID finds the authorization, token and logout endpoints itself from the store's discovery documents, so they need no setting.
+
+In Shopify, give the Customer Account API client these settings:
+
+- Callback URI: `https://your-site.example/_emdash/api/auth/redeemid/callback`
+- JavaScript origin (public clients): `https://your-site.example`
+- Logout URI: `https://your-site.example/`
+
+Point webhooks (`customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`, `customers/redact`) at `https://your-site.example/_emdash/api/auth/redeemid/webhook`.
+
+## Use it in templates
+
+EmDash has no content filter hook, so templates decide what to render. Wrap the entry body:
+
+```astro
+---
+import Gate from "@redeemid/emdash/components/Gate.astro";
+---
+<Gate collection="posts" terms={post.data.terms}>
+	<PortableText value={post.data.content} />
+	<p slot="locked">{post.data.excerpt}</p>
+</Gate>
+```
+
+Add the account box to your header:
+
+```astro
+---
+import Account from "@redeemid/emdash/components/Account.astro";
+---
+<Account />
+```
+
+Sell a plan. `<Plan>` shows a Shopify product's title and price with a button that starts checkout (signed-in members check out with their email). Shopify Flow or an app tags the customer after the order, and access follows that tag:
+
+```astro
+---
+import Plan from "@redeemid/emdash/components/Plan.astro";
+---
+<Plan handle="gold-membership" label="Join Gold">
+	<p>Shown if the product can't be loaded.</p>
+</Plan>
+```
+
+Or ask directly:
+
+```ts
+import { canRead } from "@redeemid/emdash/access";
+
+const verdict = await canRead(Astro, { collection: "posts", terms: post.data.terms });
+// verdict.allowed, verdict.reason: open | allowed | sign_in | upgrade | disabled
+```
+
+Pages rendered for a signed-in member are sent with `Cache-Control: private, no-store`; pages for visitors stay cacheable.
+
+## Rules
+
+- Shopify is the only source of entitlements. Nothing on the EmDash side grants access.
+- Levels read the mirrored tags as they are, however old; they change only when Shopify sends new ones.
+- Status (enabled or disabled) comes only from the `customers/enable` and `customers/disable` webhooks.
+- Staff accounts (any EmDash role above Subscriber) can't sign in through the store, even with a matching email.
+- Customers can't create the first (admin) account on a new site.
+
+## Develop
+
+```sh
+pnpm install
+pnpm test        # unit tests
+pnpm typecheck
+pnpm e2e         # boots the playground site against a fake Shopify store
+```
+
+Releases: bump `version` in package.json and merge to main. The Release workflow runs the tests, then stages that version on npm with a stage-only token. A maintainer approves it on npmjs.com or with `npm stage approve <id>` (2FA), and only then is it public. The same run cuts a matching GitHub release, `v<version>`, with the exact tarball it staged and a `.sha256`.
+
+`playground/` is the EmDash starter template with RedeemID wired in and two locked posts in its seed.
+
+## License
+
+MIT, the same as EmDash.

package/docs/shopify-setup.md

@@ -0,0 +1,56 @@
+# Connect a store
+
+What to set up in Shopify, and on the site, to run RedeemID on an EmDash site. One store can serve several sites: each site gets its own Headless storefront for sign-in, and each receives webhooks.
+
+## 1. Sign-in: a Headless storefront
+
+1. In Shopify admin, open **Sales channels → Headless** (add the channel if it isn't there) and **Create storefront**. Name it after the site.
+2. Open the storefront's **Customer Account API** settings.
+3. Pick a **Client type**. Both work, because sign-in runs on the server with PKCE either way:
+   - **Confidential** gives a client secret, which the site sends with the token request.
+   - **Public** has no secret. Shopify checks the request's origin instead, so register the site as a JavaScript origin.
+4. Under **Application setup**, add:
+   - **Callback URI:** `https://<site>/_emdash/api/auth/redeemid/callback`
+   - **JavaScript origin:** `https://<site>` (public clients)
+   - **Logout URI:** `https://<site>/` (members land here after signing out)
+5. Copy the **Client ID**, and the **Client secret** if the client is confidential.
+
+The Authorization, Token and Logout endpoints Shopify lists need no setting: RedeemID reads them from the store's discovery documents, and they already follow a custom customer-account domain.
+
+Shopify only accepts `https` callback URIs, so a local `astro dev` site needs a tunnel (for example `cloudflared tunnel`) to sign in for real. The end-to-end test uses a fake store instead.
+
+The store must use the new customer accounts (Settings → Customer accounts). Classic accounts have no Customer Account API.
+
+## 2. Webhooks
+
+RedeemID keeps tags and status current from webhooks. Point these topics at `https://<site>/_emdash/api/auth/redeemid/webhook`:
+
+`customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`, `customers/redact`
+
+Subscribe them from a Shopify app on the store (for example a Dev Dashboard app). If the app already sends webhooks to another site, add this URL as extra subscriptions. `customers/merge` needs the `read_customer_merge` scope. Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
+
+## 3. The site
+
+Add the package and config as in the [README](../README.md#install), with `shop` set to the store's domain. A custom customer-account domain works as well as `*.myshopify.com`.
+
+Set the secrets. On Cloudflare Workers:
+
+```sh
+npx wrangler secret put REDEEMID_SHOPIFY_STORE_DOMAIN                   # e.g. my-store.myshopify.com, unless `shop` is in the config
+npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID     # Customer Account API client ID
+npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET # confidential clients only
+npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET        # the webhook app's client secret
+npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN       # Headless storefront's Storefront API private token (plans, checkout)
+npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN        # optional; used only without the private token
+```
+
+The Workers free plan is enough: RedeemID is a native plugin and doesn't need sandboxing. Worker secrets reach the code through `nodejs_compat`, which EmDash's Cloudflare templates turn on.
+
+## 4. Try it
+
+1. Finish EmDash setup as staff first. Store customers can't create the first account.
+2. Tag a test customer in Shopify (for example `member`) and visit a locked post.
+3. Click **Sign in**, sign in with that customer's email, and you come back to the post, unlocked.
+4. Add or remove the tag in Shopify; the post opens or locks again once the webhook arrives.
+
+If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`.

package/package.json

@@ -1,6 +1,62 @@
 {
-  "name": "@redeemid/emdash",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@redeemid/emdash",
+	"version": "0.0.2",
+	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
+	"type": "module",
+	"license": "MIT",
+	"author": "Vinny S. Green, LLC",
+	"homepage": "https://www.redeemid.com/",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/webmultipliers/redeemid-emdash.git"
+	},
+	"exports": {
+		".": "./src/index.ts",
+		"./access": "./src/access.ts",
+		"./guard.ts": "./src/guard.ts",
+		"./storefront": "./src/storefront.ts",
+		"./components/*": "./src/components/*",
+		"./routes/*": "./src/routes/*"
+	},
+	"files": [
+		"src",
+		"README.md",
+		"LICENSE",
+		"docs"
+	],
+	"keywords": [
+		"emdash",
+		"shopify",
+		"paywall",
+		"membership",
+		"customer-accounts"
+	],
+	"scripts": {
+		"test": "vitest run",
+		"typecheck": "tsc --noEmit",
+		"e2e": "node tests/e2e/run.mjs"
+	},
+	"peerDependencies": {
+		"@emdash-cms/auth": ">=1.1.0",
+		"astro": ">=6",
+		"emdash": ">=1.1.0"
+	},
+	"dependencies": {
+		"jose": "^6.1.3"
+	},
+	"devDependencies": {
+		"@emdash-cms/auth": "^1.4.0",
+		"astro": "^7.3.2",
+		"emdash": "^1.4.0",
+		"kysely": "^0.29.0",
+		"typescript": "^6.0.3",
+		"vitest": "4.1.10"
+	},
+	"packageManager": "pnpm@10.28.0",
+	"publishConfig": {
+		"access": "public"
+	},
+	"bugs": {
+		"url": "https://github.com/webmultipliers/redeemid-emdash/issues"
+	}
+}

package/src/access.ts

@@ -0,0 +1,124 @@
+/**
+ * Who may read what, for page code.
+ *
+ * EmDash has no content filter hook, so templates ask before they render:
+ *
+ *   const access = await canRead(Astro, { collection: "posts", terms: post.data.terms });
+ *
+ * or wrap the body in <Gate>. The answer comes from the member's mirrored
+ * Shopify tags only. The EmDash "Subscriber" role means "signed in", never
+ * "entitled".
+ */
+
+import type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+import { siteConfig } from "./site-config.js";
+import { memberForUser, stores, type MemberRecord } from "./storage.js";
+
+/** The parts of Astro's global that access checks read. */
+export interface AstroLike {
+	locals: unknown;
+	response?: { headers: Headers };
+}
+
+interface Locals {
+	user?: { id: string; disabled?: boolean | number } | null;
+	emdash?: { db?: unknown; config?: unknown } | null;
+}
+
+export interface Viewer {
+	signedIn: boolean;
+	member: MemberRecord | null;
+	/** Level slugs held right now. Empty when the Shopify account is disabled. */
+	levels: string[];
+}
+
+export type Reason = "open" | "allowed" | "sign_in" | "upgrade" | "disabled" | "unconfigured";
+
+export interface Verdict {
+	allowed: boolean;
+	reason: Reason;
+	/** Levels any of which would unlock the entry. Empty = any signed-in member. */
+	required: string[];
+	viewer: Viewer;
+}
+
+export type Terms = Record<string, Array<{ slug: string } | string> | undefined>;
+
+export function levelsFor(tags: string[], levels: LevelConfig[] = []): string[] {
+	const held = new Set(tags.map((t) => t.toLowerCase()));
+	return levels
+		.filter((l) => {
+			if (l.tags.length === 0) return false;
+			const has = (t: string) => held.has(t.toLowerCase());
+			return l.match === "all" ? l.tags.every(has) : l.tags.some(has);
+		})
+		.map((l) => l.slug);
+}
+
+/**
+ * Required levels for an entry, or null when no rule covers it.
+ * Term rules beat collection rules; several matching term rules combine.
+ */
+export function requiredLevels(rules: RuleConfig[] = [], collection: string, terms: Terms = {}): string[] | null {
+	const forCollection = rules.filter((r) => r.collection === collection);
+	const termRules = forCollection.filter((r) => {
+		if (!r.taxonomy || !r.term) return false;
+		const list = terms[r.taxonomy] ?? [];
+		return list.some((t) => (typeof t === "string" ? t : t.slug) === r.term);
+	});
+	const chosen = termRules.length > 0 ? termRules : forCollection.filter((r) => !r.taxonomy && !r.term);
+	if (chosen.length === 0) return null;
+	// Any rule that admits every member wins.
+	if (chosen.some((r) => r.levels.length === 0)) return [];
+	return [...new Set(chosen.flatMap((r) => r.levels))];
+}
+
+export async function viewer(astro: AstroLike): Promise<Viewer> {
+	const locals = astro.locals as Locals;
+	const user = locals.user;
+	if (!user?.id || user.disabled) return { signedIn: false, member: null, levels: [] };
+
+	// Member-specific output must never be shared by a cache.
+	astro.response?.headers.set("Cache-Control", "private, no-store");
+
+	const config = siteConfig(locals.emdash?.config);
+	const db = locals.emdash?.db;
+	if (!config || !db) return { signedIn: true, member: null, levels: [] };
+
+	const member = await memberForUser(stores(db), user.id);
+	const levels = member && member.status !== "disabled" ? levelsFor(member.tags, config.levels) : [];
+	return { signedIn: true, member, levels };
+}
+
+export async function canRead(
+	astro: AstroLike,
+	entry: { collection: string; terms?: Terms },
+	override?: { levels: string[] },
+): Promise<Verdict> {
+	const locals = astro.locals as Locals;
+	const config: RedeemIDConfig | null = siteConfig(locals.emdash?.config);
+	const required = override ? override.levels : requiredLevels(config?.rules, entry.collection, entry.terms);
+	const v = await viewer(astro);
+
+	if (required === null) return { allowed: true, reason: "open", required: [], viewer: v };
+	if (!config) return { allowed: false, reason: "unconfigured", required, viewer: v };
+	if (!v.signedIn) return { allowed: false, reason: "sign_in", required, viewer: v };
+	if (v.member?.status === "disabled") return { allowed: false, reason: "disabled", required, viewer: v };
+	if (!v.member) return { allowed: false, reason: "upgrade", required, viewer: v };
+	const ok = required.length === 0 || required.some((l) => v.levels.includes(l));
+	return { allowed: ok, reason: ok ? "allowed" : "upgrade", required, viewer: v };
+}
+
+/** Same-site path to return to after sign-in, or "/". */
+export function safeReturn(raw: string | null | undefined): string {
+	if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+	return raw;
+}
+
+export function signInUrl(returnTo: string): string {
+	return `/_emdash/api/auth/redeemid/login?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}
+
+export function signOutUrl(returnTo = "/"): string {
+	return `/_emdash/api/auth/redeemid/logout?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}

package/src/components/Account.astro

@@ -0,0 +1,26 @@
+---
+/**
+ * Sign in link for visitors; name, levels and Sign out for members.
+ */
+import { siteConfig } from "../site-config.js";
+import { signInUrl, signOutUrl, viewer } from "../access.js";
+
+const v = await viewer(Astro);
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const here = Astro.url.pathname + Astro.url.search;
+const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).map((l) => l.name);
+---
+
+<div class="redeemid-account" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
+	{v.signedIn ? (
+		<>
+			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? "Signed in"}</span>
+			{names.length > 0 && <span class="redeemid-account__levels">{names.join(", ")}</span>}
+			<form method="post" action={signOutUrl(here)}>
+				<button type="submit">Sign out</button>
+			</form>
+		</>
+	) : (
+		<a href={signInUrl(here)}>{config?.label ?? "Sign in"}</a>
+	)}
+</div>

package/src/components/Gate.astro

@@ -0,0 +1,40 @@
+---
+/**
+ * Show the default slot to readers who may read the entry, the "locked" slot
+ * (or a built-in notice) to everyone else.
+ *
+ *   <Gate collection="posts" terms={post.data.terms}>
+ *     <PortableText value={post.data.content} />
+ *     <p slot="locked">…teaser…</p>
+ *   </Gate>
+ *
+ * Pass `levels` to lock a part of a page to specific levels instead.
+ */
+import { canRead, signInUrl, type Terms } from "../access.js";
+
+interface Props {
+	collection?: string;
+	terms?: Terms;
+	levels?: string[];
+}
+
+const { collection = "", terms, levels } = Astro.props;
+const verdict = await canRead(Astro, { collection, terms }, levels ? { levels } : undefined);
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{verdict.allowed ? (
+	<slot />
+) : (
+	<div class="redeemid-locked" data-redeemid-reason={verdict.reason}>
+		<slot name="locked" />
+		{verdict.reason === "sign_in" && (
+			<p>
+				This is for members. <a href={signInUrl(here)}>Sign in</a> to read it.
+			</p>
+		)}
+		{verdict.reason === "upgrade" && <p>Your membership doesn't include this yet.</p>}
+		{verdict.reason === "disabled" && <p>Your account is turned off. Contact the store for help.</p>}
+		{verdict.reason === "unconfigured" && <p>This is for members.</p>}
+	</div>
+)}

package/src/components/Plan.astro

@@ -0,0 +1,53 @@
+---
+/**
+ * A membership plan from Shopify: name, price and a Buy button that starts
+ * checkout. Prices come from the Storefront API; the default slot shows if
+ * the product can't be loaded.
+ *
+ *   <Plan handle="gold-membership" />
+ */
+import { siteConfig } from "../site-config.js";
+import { plan as loadPlan, type Plan } from "../storefront.js";
+
+interface Props {
+	handle: string;
+	/** Button text. */
+	label?: string;
+	/** Heading override; defaults to the Shopify product title. */
+	title?: string;
+}
+
+const { handle, label = "Join", title } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+let p: Plan | null = null;
+if (config) {
+	try {
+		p = await loadPlan(config, handle);
+	} catch {
+		p = null;
+	}
+}
+const price = p?.price
+	? new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount))
+	: null;
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{p ? (
+	<div class="redeemid-plan" data-redeemid-plan={p.handle}>
+		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
+		{price && <p class="redeemid-plan__price">{price}</p>}
+		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
+		{p.availableForSale ? (
+			<form method="post" action="/_emdash/api/auth/redeemid/buy">
+				<input type="hidden" name="plan" value={p.handle} />
+				<input type="hidden" name="return" value={here} />
+				<button type="submit">{label}</button>
+			</form>
+		) : (
+			<p class="redeemid-plan__unavailable">Not available right now.</p>
+		)}
+	</div>
+) : (
+	<slot />
+)}

package/src/config.ts

@@ -0,0 +1,112 @@
+/**
+ * RedeemID configuration.
+ *
+ * Levels and rules live in code (astro.config.mjs), so they are versioned with
+ * the site. Secrets come from the environment and never from config.
+ */
+
+/** A member level, held by Shopify customers with its tags. */
+export interface LevelConfig {
+	/** Stable slug, used in rules (e.g. "member"). */
+	slug: string;
+	/** Name shown to members. */
+	name: string;
+	/** Shopify customer tags that grant this level. Matched case-insensitively. */
+	tags: string[];
+	/** "any" (default): one of the tags is enough. "all": every tag is needed. */
+	match?: "any" | "all";
+}
+
+/**
+ * Who may read entries. A rule with `term` applies to entries that carry that
+ * term; a rule without one applies to the whole collection. Term rules win
+ * over collection rules for the same entry.
+ */
+export interface RuleConfig {
+	collection: string;
+	/** Taxonomy slug, e.g. "category". Requires `term`. */
+	taxonomy?: string;
+	/** Term slug, e.g. "premium". */
+	term?: string;
+	/** Level slugs that may read. An empty list means signed-in members of any level. */
+	levels: string[];
+}
+
+export interface RedeemIDConfig {
+	/**
+	 * The store's myshopify.com domain (a custom storefront or customer-account
+	 * domain works too). Discovery is read from https://<shop>/.well-known/.
+	 * Leave it out to read REDEEMID_SHOPIFY_STORE_DOMAIN at request time.
+	 */
+	shop?: string;
+	/** Sign-in button label. Members never see "Shopify". */
+	label?: string;
+	levels?: LevelConfig[];
+	rules?: RuleConfig[];
+	/**
+	 * Extra /_emdash path prefixes signed-in members may use. Everything else
+	 * under /_emdash is refused to Subscribers (see guard.ts).
+	 */
+	memberPaths?: string[];
+	/**
+	 * Only for local tests: lets `shop` be a full http:// origin of a fake store.
+	 * Never set this on a live site.
+	 */
+	allowInsecureShop?: boolean;
+}
+
+export const PROVIDER_ID = "redeemid";
+
+/**
+ * Environment variable names. Values are read at request time, so on Workers
+ * they can be secrets.
+ */
+export const ENV = {
+	/** The store's myshopify.com domain, when `shop` isn't set in config. */
+	storeDomain: "REDEEMID_SHOPIFY_STORE_DOMAIN",
+	/** Customer Account API client ID (Headless storefront). */
+	clientId: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID",
+	/** Customer Account API client secret. Confidential clients only; public clients leave it unset. */
+	clientSecret: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET",
+	/** Client secret of the Shopify (Admin API) app whose webhooks the site receives. Shopify signs webhooks with it. */
+	webhookSecret: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET",
+	/** Storefront API private token, for server-side plan and checkout calls. */
+	storefrontPrivateToken: "REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN",
+	/** Storefront API public token, used only when the private token isn't set. */
+	storefrontPublicToken: "REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN",
+} as const;
+
+export function env(name: string): string {
+	const value = typeof process !== "undefined" ? process.env[name] : undefined;
+	return typeof value === "string" ? value.trim() : "";
+}
+
+/** The store origin, e.g. https://shop.example.com. */
+export function shopOrigin(config: RedeemIDConfig): string {
+	const raw = storeDomain(config).replace(/\/+$/, "");
+	if (raw === "") throw new Error("RedeemID: no store domain.");
+	if (/^https?:\/\//i.test(raw)) {
+		const url = new URL(raw);
+		if (url.protocol === "http:" && !config.allowInsecureShop) {
+			throw new Error("RedeemID: the shop must use https.");
+		}
+		return url.origin;
+	}
+	const host = raw.replace(/^admin\.shopify\.com\/store\//i, "").toLowerCase();
+	// A bare store handle ("my-store") means its myshopify.com domain.
+	return `https://${host.includes(".") ? host : `${host}.myshopify.com`}`;
+}
+
+/** The configured store domain, from config or the environment. */
+export function storeDomain(config: RedeemIDConfig): string {
+	return (config.shop ?? "").trim() || env(ENV.storeDomain);
+}
+
+/** Find this provider's config among EmDash's configured auth providers. */
+export function readConfig(emdashConfig: unknown): RedeemIDConfig | null {
+	const providers = (emdashConfig as { authProviders?: Array<{ id: string; config?: unknown }> } | null)
+		?.authProviders;
+	const found = providers?.find((p) => p.id === PROVIDER_ID);
+	const config = found?.config as RedeemIDConfig | undefined;
+	return config && typeof config === "object" ? config : null;
+}