@redeemid/emdash 0.0.0-stage → 0.0.3

package/LICENSE

@@ -0,0 +1,20 @@
+The MIT License
+
+Copyright 2026 Vinny S. Green, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,152 @@
-# Temporary Holding Version
+# RedeemID for EmDash
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
+
+**Status: 0.0.3, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
+
+## What it does
+
+- **Sign in with the store's customer account.** Members click "Sign in" on your site, sign in on the store's account page and come back signed in. They become EmDash Subscribers. That role only means "signed in"; it never grants content.
+- **Mirrors the customer.** Email, name, tags and enabled/disabled status, kept current by signed Shopify webhooks.
+- **Levels from tags.** You map Shopify customer tags to levels. Set tags in Shopify Flow or any app; RedeemID only reads them.
+- **Rules per collection or term.** Lock a collection, or only entries in a category or tag.
+- **Plans, cart and checkout.** `<Plan>` shows a Shopify product's price and adds it to the visitor's Shopify cart; `<Cart>` shows the count and opens Shopify checkout.
+- **Account.** Members get an Account link to their Shopify customer account (orders, profile, addresses) and Sign out, which also ends the Shopify session.
+- **Paywall break block.** Editors write one body and drop a "Paywall break" block where members-only content starts, picking which levels may read on. `<Content>` renders the body and leaves the rest off the page for everyone else.
+- **Plan block.** Editors add a Shopify product to any page with the "Plan" block: title, price and a buy button.
+- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels), a Status page (secrets, store discovery, the URLs to give Shopify, levels and rules) and a dashboard widget.
+- **Keeps members out of EmDash's own APIs**, so the gate is the only way to read locked content.
+
+## Install
+
+The package is a native EmDash plugin (an npm dependency, not a registry plugin), because sign-in and page gating run in the site process.
+
+```sh
+pnpm add @redeemid/emdash
+```
+
+```js title="astro.config.mjs"
+import { redeemid, redeemidGuard, redeemidPlugin } from "@redeemid/emdash";
+import emdash from "emdash/astro";
+
+const config = {
+	shop: "my-store.myshopify.com",
+	levels: [
+		{ slug: "member", name: "Member", tags: ["member"] },
+		{ slug: "pro", name: "Pro", tags: ["pro"] },
+		// match: "all" needs every tag, e.g. both memberships:
+		{ slug: "both", name: "Member + Pro", tags: ["member", "pro"], match: "all" },
+	],
+	rules: [
+		{ collection: "posts", taxonomy: "category", term: "members", levels: ["member", "pro"] },
+		{ collection: "posts", taxonomy: "category", term: "pro", levels: ["pro"] },
+	],
+};
+
+export default defineConfig({
+	integrations: [
+		emdash({
+			// database, storage, …
+			authProviders: [redeemid(config)], // sign-in, webhooks, cart and checkout routes
+			plugins: [redeemidPlugin(config)], // admin pages and the editor blocks
+		}),
+		redeemidGuard(),
+	],
+});
+```
+
+Set these secrets in the environment (`.env` locally, `wrangler secret put` on Workers). [docs/shopify-setup.md](docs/shopify-setup.md) walks through the Shopify side:
+
+| Variable | Shopify API | What it is |
+| --- | --- | --- |
+| `REDEEMID_SHOPIFY_STORE_DOMAIN` | Customer Account API discovery | The store's `*.myshopify.com` domain. Only needed when `shop` isn't set in the config. |
+| `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID` | Customer Account API | Client ID of the Headless storefront's Customer Account API client |
+| `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET` | Customer Account API | Its client secret. Confidential clients only; leave unset for a public client. |
+| `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET` | Webhooks (Admin API app) | Client secret of the Shopify app that sends the webhooks. Shopify signs each webhook with it. |
+| `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
+| `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
+
+RedeemID finds the authorization, token and logout endpoints itself from the store's discovery documents, so they need no setting.
+
+In Shopify, give the Customer Account API client these settings:
+
+- Callback URI: `https://your-site.example/_emdash/api/auth/redeemid/callback`
+- JavaScript origin (public clients): `https://your-site.example`
+- Logout URI: `https://your-site.example/`
+
+Point webhooks (`customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`, `customers/redact`) at `https://your-site.example/_emdash/api/auth/redeemid/webhook`.
+
+## Use it in templates
+
+EmDash has no content filter hook, so templates decide what to render. Render the entry body with `<Content>` instead of `<PortableText>`:
+
+```astro
+---
+import Content from "@redeemid/emdash/components/Content.astro";
+---
+<Content value={post.data.content} collection="posts" terms={post.data.terms}>
+	<a slot="locked" href="/join/">Become a member</a>
+</Content>
+```
+
+Everything before the first Paywall break block is shown to everyone. What follows reaches the page only for readers the break allows: the levels picked on it, or when none are picked the entry's rule, or else any signed-in member. A body with no break follows the entry's rule as a whole. Plain `<PortableText>` ignores the break and shows everything, so use `<Content>` for any body that may hold one.
+
+To lock a part of a template that isn't the body, wrap it in `<Gate>` (`<Gate levels={["pro"]}>…</Gate>`).
+
+Add the account box and cart to your header. Visitors see Sign in; members see their name, levels, Account and Sign out. The cart shows how many items are in the visitor's Shopify cart and goes to its checkout:
+
+```astro
+---
+import Account from "@redeemid/emdash/components/Account.astro";
+import Cart from "@redeemid/emdash/components/Cart.astro";
+---
+<Account />
+<Cart />
+```
+
+Sell a plan. `<Plan>` shows a Shopify product's title and price with a button that adds it to the visitor's Shopify cart and opens checkout (signed-in members check out with their email). Shopify Flow or an app tags the customer after the order, and access follows that tag:
+
+```astro
+---
+import Plan from "@redeemid/emdash/components/Plan.astro";
+---
+<Plan handle="gold-membership" label="Join Gold">
+	<p>Shown if the product can't be loaded.</p>
+</Plan>
+```
+
+Or ask directly:
+
+```ts
+import { canRead } from "@redeemid/emdash/access";
+
+const verdict = await canRead(Astro, { collection: "posts", terms: post.data.terms });
+// verdict.allowed, verdict.reason: open | allowed | sign_in | upgrade | disabled
+```
+
+Pages rendered for a signed-in member are sent with `Cache-Control: private, no-store`; pages for visitors stay cacheable.
+
+## Rules
+
+- Shopify is the only source of entitlements. Nothing on the EmDash side grants access.
+- Levels read the mirrored tags as they are, however old; they change only when Shopify sends new ones.
+- Status (enabled or disabled) comes only from the `customers/enable` and `customers/disable` webhooks.
+- Staff accounts (any EmDash role above Subscriber) can't sign in through the store, even with a matching email.
+- Customers can't create the first (admin) account on a new site.
+
+## Develop
+
+```sh
+pnpm install
+pnpm test        # unit tests
+pnpm typecheck
+pnpm e2e         # boots the playground site against a fake Shopify store
+```
+
+Releases: bump `version` in package.json and merge to main. The Release workflow runs the tests, then stages that version on npm with a stage-only token. A maintainer approves it on npmjs.com or with `npm stage approve <id>` (2FA), and only then is it public. The same run cuts a matching GitHub release, `v<version>`, with the exact tarball it staged and a `.sha256`.
+
+`playground/` is the EmDash starter template with RedeemID wired in and two locked posts in its seed.
+
+## License
+
+MIT, the same as EmDash.

package/docs/shopify-setup.md

@@ -0,0 +1,56 @@
+# Connect a store
+
+What to set up in Shopify, and on the site, to run RedeemID on an EmDash site. One store can serve several sites: each site gets its own Headless storefront for sign-in, and each receives webhooks.
+
+## 1. Sign-in: a Headless storefront
+
+1. In Shopify admin, open **Sales channels → Headless** (add the channel if it isn't there) and **Create storefront**. Name it after the site.
+2. Open the storefront's **Customer Account API** settings.
+3. Pick a **Client type**. Both work, because sign-in runs on the server with PKCE either way:
+   - **Confidential** gives a client secret, which the site sends with the token request.
+   - **Public** has no secret. Shopify checks the request's origin instead, so register the site as a JavaScript origin.
+4. Under **Application setup**, add:
+   - **Callback URI:** `https://<site>/_emdash/api/auth/redeemid/callback`
+   - **JavaScript origin:** `https://<site>` (public clients)
+   - **Logout URI:** `https://<site>/` (members land here after signing out)
+5. Copy the **Client ID**, and the **Client secret** if the client is confidential.
+
+The Authorization, Token and Logout endpoints Shopify lists need no setting: RedeemID reads them from the store's discovery documents, and they already follow a custom customer-account domain.
+
+Shopify only accepts `https` callback URIs, so a local `astro dev` site needs a tunnel (for example `cloudflared tunnel`) to sign in for real. The end-to-end test uses a fake store instead.
+
+The store must use the new customer accounts (Settings → Customer accounts). Classic accounts have no Customer Account API.
+
+## 2. Webhooks
+
+RedeemID keeps tags and status current from webhooks. Point these topics at `https://<site>/_emdash/api/auth/redeemid/webhook`:
+
+`customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`, `customers/redact`
+
+Subscribe them from a Shopify app on the store (for example a Dev Dashboard app). If the app already sends webhooks to another site, add this URL as extra subscriptions. `customers/merge` needs the `read_customer_merge` scope. Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
+
+## 3. The site
+
+Add the package and config as in the [README](../README.md#install), with `shop` set to the store's domain. A custom customer-account domain works as well as `*.myshopify.com`.
+
+Set the secrets. On Cloudflare Workers:
+
+```sh
+npx wrangler secret put REDEEMID_SHOPIFY_STORE_DOMAIN                   # e.g. my-store.myshopify.com, unless `shop` is in the config
+npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID     # Customer Account API client ID
+npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET # confidential clients only
+npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET        # the webhook app's client secret
+npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN       # Headless storefront's Storefront API private token (plans, checkout)
+npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN        # optional; used only without the private token
+```
+
+The Workers free plan is enough: RedeemID is a native plugin and doesn't need sandboxing. Worker secrets reach the code through `nodejs_compat`, which EmDash's Cloudflare templates turn on.
+
+## 4. Try it
+
+1. Finish EmDash setup as staff first. Store customers can't create the first account.
+2. Tag a test customer in Shopify (for example `member`) and visit a locked post.
+3. Click **Sign in**, sign in with that customer's email, and you come back to the post, unlocked.
+4. Add or remove the tag in Shopify; the post opens or locks again once the webhook arrives.
+
+If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails.

package/package.json

@@ -1,6 +1,64 @@
 {
-  "name": "@redeemid/emdash",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@redeemid/emdash",
+	"version": "0.0.3",
+	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
+	"type": "module",
+	"license": "MIT",
+	"author": "Vinny S. Green, LLC",
+	"homepage": "https://www.redeemid.com/",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/webmultipliers/redeemid-emdash.git"
+	},
+	"exports": {
+		".": "./src/index.ts",
+		"./access": "./src/access.ts",
+		"./guard.ts": "./src/guard.ts",
+		"./storefront": "./src/storefront.ts",
+		"./plugin": "./src/plugin.ts",
+		"./blocks": "./src/blocks/index.ts",
+		"./components/*": "./src/components/*",
+		"./routes/*": "./src/routes/*"
+	},
+	"files": [
+		"src",
+		"README.md",
+		"LICENSE",
+		"docs"
+	],
+	"keywords": [
+		"emdash",
+		"shopify",
+		"paywall",
+		"membership",
+		"customer-accounts"
+	],
+	"scripts": {
+		"test": "vitest run",
+		"typecheck": "tsc --noEmit",
+		"e2e": "node tests/e2e/run.mjs"
+	},
+	"peerDependencies": {
+		"@emdash-cms/auth": ">=1.1.0",
+		"astro": ">=6",
+		"emdash": ">=1.1.0"
+	},
+	"dependencies": {
+		"jose": "^6.1.3"
+	},
+	"devDependencies": {
+		"@emdash-cms/auth": "^1.4.0",
+		"astro": "^7.3.2",
+		"emdash": "^1.4.0",
+		"kysely": "^0.29.0",
+		"typescript": "^6.0.3",
+		"vitest": "4.1.10"
+	},
+	"packageManager": "pnpm@10.28.0",
+	"publishConfig": {
+		"access": "public"
+	},
+	"bugs": {
+		"url": "https://github.com/webmultipliers/redeemid-emdash/issues"
+	}
+}

package/src/access.ts

@@ -0,0 +1,134 @@
+/**
+ * Who may read what, for page code.
+ *
+ * EmDash has no content filter hook, so templates ask before they render:
+ *
+ *   const access = await canRead(Astro, { collection: "posts", terms: post.data.terms });
+ *
+ * or wrap the body in <Gate>. The answer comes from the member's mirrored
+ * Shopify tags only. The EmDash "Subscriber" role means "signed in", never
+ * "entitled".
+ */
+
+import type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+import { siteConfig } from "./site-config.js";
+import { memberForUser, stores, type MemberRecord } from "./storage.js";
+
+/** The parts of Astro's global that access checks read. */
+export interface AstroLike {
+	locals: unknown;
+	response?: { headers: Headers };
+}
+
+interface Locals {
+	user?: { id: string; disabled?: boolean | number } | null;
+	emdash?: { db?: unknown; config?: unknown } | null;
+}
+
+export interface Viewer {
+	signedIn: boolean;
+	member: MemberRecord | null;
+	/** Level slugs held right now. Empty when the Shopify account is disabled. */
+	levels: string[];
+}
+
+export type Reason = "open" | "allowed" | "sign_in" | "upgrade" | "disabled" | "unconfigured";
+
+export interface Verdict {
+	allowed: boolean;
+	reason: Reason;
+	/** Levels any of which would unlock the entry. Empty = any signed-in member. */
+	required: string[];
+	viewer: Viewer;
+}
+
+export type Terms = Record<string, Array<{ slug: string } | string> | undefined>;
+
+export function levelsFor(tags: string[], levels: LevelConfig[] = []): string[] {
+	const held = new Set(tags.map((t) => t.toLowerCase()));
+	return levels
+		.filter((l) => {
+			if (l.tags.length === 0) return false;
+			const has = (t: string) => held.has(t.toLowerCase());
+			return l.match === "all" ? l.tags.every(has) : l.tags.some(has);
+		})
+		.map((l) => l.slug);
+}
+
+/**
+ * Required levels for an entry, or null when no rule covers it.
+ * Term rules beat collection rules; several matching term rules combine.
+ */
+export function requiredLevels(rules: RuleConfig[] = [], collection: string, terms: Terms = {}): string[] | null {
+	const forCollection = rules.filter((r) => r.collection === collection);
+	const termRules = forCollection.filter((r) => {
+		if (!r.taxonomy || !r.term) return false;
+		const list = terms[r.taxonomy] ?? [];
+		return list.some((t) => (typeof t === "string" ? t : t.slug) === r.term);
+	});
+	const chosen = termRules.length > 0 ? termRules : forCollection.filter((r) => !r.taxonomy && !r.term);
+	if (chosen.length === 0) return null;
+	// Any rule that admits every member wins.
+	if (chosen.some((r) => r.levels.length === 0)) return [];
+	return [...new Set(chosen.flatMap((r) => r.levels))];
+}
+
+export async function viewer(astro: AstroLike): Promise<Viewer> {
+	const locals = astro.locals as Locals;
+	const user = locals.user;
+	if (!user?.id || user.disabled) return { signedIn: false, member: null, levels: [] };
+
+	// Member-specific output must never be shared by a cache.
+	astro.response?.headers.set("Cache-Control", "private, no-store");
+
+	const config = siteConfig(locals.emdash?.config);
+	const db = locals.emdash?.db;
+	if (!config || !db) return { signedIn: true, member: null, levels: [] };
+
+	const member = await memberForUser(stores(db), user.id);
+	const levels = member && member.status !== "disabled" ? levelsFor(member.tags, config.levels) : [];
+	return { signedIn: true, member, levels };
+}
+
+export async function canRead(
+	astro: AstroLike,
+	entry: { collection: string; terms?: Terms },
+	override?: { levels: string[] },
+): Promise<Verdict> {
+	const locals = astro.locals as Locals;
+	const config: RedeemIDConfig | null = siteConfig(locals.emdash?.config);
+	const required = override ? override.levels : requiredLevels(config?.rules, entry.collection, entry.terms);
+	const v = await viewer(astro);
+
+	if (required === null) return { allowed: true, reason: "open", required: [], viewer: v };
+	if (!config) return { allowed: false, reason: "unconfigured", required, viewer: v };
+	if (!v.signedIn) return { allowed: false, reason: "sign_in", required, viewer: v };
+	if (v.member?.status === "disabled") return { allowed: false, reason: "disabled", required, viewer: v };
+	if (!v.member) return { allowed: false, reason: "upgrade", required, viewer: v };
+	const ok = required.length === 0 || required.some((l) => v.levels.includes(l));
+	return { allowed: ok, reason: ok ? "allowed" : "upgrade", required, viewer: v };
+}
+
+/** Same-site path to return to after sign-in, or "/". */
+export function safeReturn(raw: string | null | undefined): string {
+	if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+	return raw;
+}
+
+export function signInUrl(returnTo: string): string {
+	return `/_emdash/api/auth/redeemid/login?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}
+
+/** Where the Cart link goes: the visitor's Shopify checkout. */
+export function cartUrl(returnTo = "/"): string {
+	return `/_emdash/api/auth/redeemid/cart?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}
+
+/** Where the Account link goes: the member's Shopify customer account. */
+export function accountUrl(returnTo = "/"): string {
+	return `/_emdash/api/auth/redeemid/account?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}
+
+export function signOutUrl(returnTo = "/"): string {
+	return `/_emdash/api/auth/redeemid/logout?return=${encodeURIComponent(safeReturn(returnTo))}`;
+}

package/src/astro-modules.d.ts

@@ -0,0 +1,4 @@
+declare module "*.astro" {
+	const Component: (props: Record<string, unknown>) => unknown;
+	export default Component;
+}

package/src/blocks/PaywallBreak.astro

@@ -0,0 +1,6 @@
+---
+/**
+ * The paywall break itself renders nothing. <Content> splits the body here
+ * and leaves out what follows for readers who can't read it.
+ */
+---

package/src/blocks/PlanBlock.astro

@@ -0,0 +1,13 @@
+---
+/** The "Plan" block: a Shopify product with its price and a buy button. */
+import Plan from "../components/Plan.astro";
+
+interface Props {
+	node: { handle?: string; title?: string; label?: string };
+}
+
+const { node } = Astro.props;
+const handle = (node.handle ?? "").trim();
+---
+
+{handle && <Plan handle={handle} title={node.title?.trim() || undefined} label={node.label?.trim() || "Join"} />}

package/src/blocks/index.ts

@@ -0,0 +1,11 @@
+/**
+ * Site-side renderers for RedeemID's Portable Text blocks, picked up by
+ * EmDash from the plugin's `componentsEntry`.
+ */
+import PaywallBreak from "./PaywallBreak.astro";
+import PlanBlock from "./PlanBlock.astro";
+
+export const blockComponents = {
+	"redeemid-paywall": PaywallBreak,
+	"redeemid-plan": PlanBlock,
+};

package/src/blocks-names.ts

@@ -0,0 +1,24 @@
+/** Portable Text block types RedeemID adds to the editor. */
+export const PAYWALL_BLOCK = "redeemid-paywall";
+export const PLAN_BLOCK = "redeemid-plan";
+
+type Node = { _type?: unknown; levels?: unknown };
+
+/**
+ * Split a Portable Text body at its first paywall break: the open part, the
+ * members part, and the levels picked on the break (empty = none picked).
+ * With no break, everything is in `open` and `paywall` is false.
+ */
+export function splitAtPaywall<T>(value: T[] | null | undefined): {
+	open: T[];
+	locked: T[];
+	levels: string[];
+	paywall: boolean;
+} {
+	const blocks = Array.isArray(value) ? value : [];
+	const at = blocks.findIndex((b) => (b as Node)?._type === PAYWALL_BLOCK);
+	if (at === -1) return { open: blocks, locked: [], levels: [], paywall: false };
+	const raw = (blocks[at] as Node).levels;
+	const levels = Array.isArray(raw) ? raw.filter((l): l is string => typeof l === "string" && l !== "") : [];
+	return { open: blocks.slice(0, at), locked: blocks.slice(at + 1), levels, paywall: true };
+}

package/src/cart.ts

@@ -0,0 +1,25 @@
+/**
+ * The visitor's Shopify cart, kept in the Astro session. Only the cart id
+ * and its item count live here; Shopify holds the lines and the checkout.
+ */
+
+export const SESSION_CART = "redeemid:cart";
+
+export interface CartRef {
+	id: string;
+	count: number;
+}
+
+type Session = { get(key: string): unknown; set(key: string, value: unknown): void; delete?(key: string): void } | undefined;
+
+export async function readCart(session: Session): Promise<CartRef | null> {
+	const v = (await session?.get(SESSION_CART)) as CartRef | undefined;
+	return v && typeof v.id === "string" ? v : null;
+}
+
+export function saveCart(session: Session, cart: CartRef | null): void {
+	if (!session) return;
+	if (cart) session.set(SESSION_CART, cart);
+	else if (session.delete) session.delete(SESSION_CART);
+	else session.set(SESSION_CART, undefined);
+}

package/src/components/Account.astro

@@ -0,0 +1,27 @@
+---
+/**
+ * Sign in link for visitors; name, levels, Account and Sign out for members.
+ */
+import { siteConfig } from "../site-config.js";
+import { accountUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+
+const v = await viewer(Astro);
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const here = Astro.url.pathname + Astro.url.search;
+const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).map((l) => l.name);
+---
+
+<div class="redeemid-account" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
+	{v.signedIn ? (
+		<>
+			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? "Signed in"}</span>
+			{names.length > 0 && <span class="redeemid-account__levels">{names.join(", ")}</span>}
+			<a class="redeemid-account__link" href={accountUrl(here)}>Account</a>
+			<form method="post" action={signOutUrl(here)}>
+				<button type="submit">Sign out</button>
+			</form>
+		</>
+	) : (
+		<a href={signInUrl(here)}>{config?.label ?? "Sign in"}</a>
+	)}
+</div>

package/src/components/Cart.astro

@@ -0,0 +1,21 @@
+---
+/**
+ * Cart link with the item count from the visitor's Shopify cart. It goes
+ * to that cart's Shopify checkout.
+ */
+import { cartUrl } from "../access.js";
+import { readCart } from "../cart.js";
+
+interface Props {
+	label?: string;
+}
+
+const { label = "Cart" } = Astro.props;
+const ref = await readCart(Astro.session);
+const count = ref?.count ?? 0;
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+<a class="redeemid-cart" href={cartUrl(here)} data-redeemid-cart-count={count}>
+	{label}{count > 0 && <span class="redeemid-cart__count"> ({count})</span>}
+</a>

package/src/components/Content.astro

@@ -0,0 +1,53 @@
+---
+/**
+ * An entry's body, with RedeemID's paywall break applied.
+ *
+ *   <Content value={post.data.content} collection="posts" terms={post.data.terms} />
+ *
+ * Everything before the first "Paywall break" block is shown to everyone.
+ * What follows reaches the page only for readers who may read it: the levels
+ * picked on the break, or when none are picked the entry's rule, or else any
+ * signed-in member. Others get the "locked" slot (or a built-in notice).
+ * A body with no break follows the entry's rule as a whole.
+ */
+import { PortableText } from "emdash/ui";
+
+import { canRead, requiredLevels, signInUrl, type Terms } from "../access.js";
+import { splitAtPaywall } from "../blocks-names.js";
+import { siteConfig } from "../site-config.js";
+
+interface Props {
+	value?: unknown[] | null;
+	collection?: string;
+	terms?: Terms;
+}
+
+const { value, collection = "", terms } = Astro.props;
+const split = splitAtPaywall(value);
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const levels = split.paywall
+	? split.levels.length
+		? split.levels
+		: (requiredLevels(config?.rules, collection, terms) ?? [])
+	: undefined;
+const verdict = await canRead(Astro, { collection, terms }, levels ? { levels } : undefined);
+const shown = split.paywall ? split.open : verdict.allowed ? split.open : [];
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{shown.length > 0 && <PortableText value={shown} />}
+{verdict.allowed ? (
+	split.locked.length > 0 && <PortableText value={split.locked} />
+) : (
+	<div class="redeemid-locked" data-redeemid-reason={verdict.reason}>
+		<slot name="locked" />
+		{verdict.reason === "sign_in" && (
+			<p>
+				This is for members. <a href={signInUrl(here)}>Sign in</a> to read on.
+			</p>
+		)}
+		{verdict.reason === "upgrade" && <p>Your membership doesn't include the rest of this yet.</p>}
+		{verdict.reason === "disabled" && <p>Your account is turned off. Contact the store for help.</p>}
+		{verdict.reason === "unconfigured" && <p>This is for members.</p>}
+	</div>
+)}