@redeemid/emdash 0.0.10 → 0.0.11

package/src/components/LockedPanel.astro

@@ -9,6 +9,8 @@
  * Anything in the default slot is shown above the built-in text.
  */
 import { passes, signInUrl, type Reason } from "../access.js";
+import type { SoldItem } from "../blocks-names.js";
+import { plan as loadPlan } from "../storefront.js";
 import { siteConfig } from "../site-config.js";
 import { text, textParts } from "../text.js";
 
@@ -23,9 +25,11 @@ interface Props {
 	/** Free reads left when a meter ran (Verdict.meterLeft); 0 shows the meter-used text. */
 	meterLeft?: number;
 	meterPeriod?: "month" | "week";
+	/** The entry's "Sold on its own" block: offers "Buy just this". */
+	item?: SoldItem | null;
 }
 
-const { reason, required = [], held = [], opensAt, meterLeft, meterPeriod } = Astro.props;
+const { reason, required = [], held = [], opensAt, meterLeft, meterPeriod, item } = Astro.props;
 const opens = opensAt
 	? new Intl.DateTimeFormat("en-US", { dateStyle: "long", timeZone: "UTC" }).format(opensAt)
 	: null;
@@ -35,6 +39,18 @@ const level = missing ? config?.levels?.find((l) => l.slug === missing[0]) : und
 const joinHref = level?.joinUrl ?? config?.join?.href;
 const joinLabel = config?.join?.label ?? text(config, "Become a member");
 const week = meterPeriod === "week";
+// "Buy just this": the item's product and price, read from Shopify.
+let single: { handle: string; price: string } | null = null;
+if (item?.product && config && (reason === "sign_in" || reason === "upgrade" || reason === "drip")) {
+	try {
+		const p = await loadPlan(config, item.product);
+		if (p?.availableForSale && p.price) {
+			single = { handle: p.handle, price: new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount)) };
+		}
+	} catch {
+		single = null;
+	}
+}
 const here = Astro.url.pathname + Astro.url.search;
 ---
 
@@ -61,6 +77,14 @@ const here = Astro.url.pathname + Astro.url.search;
 			{joinHref && <> <a href={joinHref}>{joinLabel}</a></>}
 		</p>
 	)}
+	{single && (
+		<form class="redeemid-locked__single" method="post" action="/_emdash/api/auth/redeemid/buy" data-redeemid-item={item?.tag}>
+			<input type="hidden" name="plan" value={single.handle} />
+			<input type="hidden" name="return" value={here} />
+			<p>{text(config, "Or buy just this for {price}.", { price: single.price })}</p>
+			<button type="submit">{text(config, "Buy just this")}</button>
+		</form>
+	)}
 	{reason === "disabled" && <p>{text(config, "Your account is turned off. Contact the store for help.")}</p>}
 	{reason === "unconfigured" && <p>{text(config, "This is for members.")}</p>}
 </div>

package/src/components/Notices.astro

@@ -32,6 +32,8 @@ const DEFAULTS: Record<string, string> = {
 	preferences_saved: "Your preferences are saved.",
 	preferences_refused: "Some answers weren't saved. Check them and try again.",
 	preferences_unavailable: "Your preferences can't be saved right now. Try again in a few minutes.",
+	data_erased: "Your data on this site is deleted, and you're signed out.",
+	erase_unconfirmed: "Tick the box to confirm, then try again.",
 	account_unavailable: "Your account page isn't available right now. Try again in a few minutes.",
 };
 

package/src/components/YourData.astro

@@ -0,0 +1,42 @@
+---
+/**
+ * The member's own data, for an account page: "Download my data" (everything
+ * this site keeps about them, as JSON) and "Delete my data", which erases it
+ * after they tick a box and signs them out. Their store account and orders
+ * stay; the text says so. Visitors get nothing.
+ *
+ *   <YourData />
+ */
+import { viewer } from "../access.js";
+import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
+
+interface Props {
+	title?: string;
+	heading?: "h2" | "h3" | "h4";
+}
+
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { title = text(config, "Your data"), heading = "h2" } = Astro.props;
+const v = await viewer(Astro);
+const route = "/_emdash/api/auth/redeemid/privacy";
+const here = Astro.url.pathname;
+const H = heading;
+---
+
+{v.signedIn && v.member && (
+	<section class="redeemid-data">
+		<H class="redeemid-data__title">{title}</H>
+		<p>
+			<a href={`${route}?return=${encodeURIComponent(here)}`} download>{text(config, "Download my data")}</a>
+		</p>
+		<form method="post" action={route} class="redeemid-data__erase">
+			<input type="hidden" name="return" value={here} />
+			<p>{text(config, "Deleting removes what this site keeps about you and signs you out. Your store account and orders stay; ask the store to delete those.")}</p>
+			<label>
+				<input type="checkbox" name="confirm" value="yes" required /> {text(config, "I understand")}
+			</label>
+			<button type="submit">{text(config, "Delete my data")}</button>
+		</form>
+	</section>
+)}

package/src/config.ts

@@ -94,7 +94,7 @@ export interface PreferenceConfig {
 export interface EventsConfig {
 	url: string;
 	/** Send only these events. All of them when left out. */
-	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved">;
+	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased">;
 }
 
 export interface MeterConfig {
@@ -125,6 +125,11 @@ export interface RedeemIDConfig {
 	 * Customers). Needs the Admin API app (staff tools) for reading and saving.
 	 */
 	preferences?: PreferenceConfig[];
+	/**
+	 * AI agents (EmDash's MCP server) and the command line. Read-only tools are
+	 * always declared; `actions: true` also offers resync and tag edits.
+	 */
+	agents?: { actions?: boolean };
 	/** Protected files, by media folder. See FileRule. */
 	files?: FileRule[];
 	/**

package/src/descriptor.ts

@@ -12,6 +12,7 @@ export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
 	{ path: "/status", label: "Status", icon: "pulse" },
 	{ path: "/test", label: "Access test", icon: "search" },
+	{ path: "/privacy", label: "Privacy", icon: "lock" },
 ];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 

package/src/events.ts

@@ -15,7 +15,7 @@
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
 
-export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved";
+export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased";
 
 const TIMEOUT_MS = 3000;
 

package/src/files.ts

@@ -17,7 +17,7 @@
  */
 
 import { readEntry, viewer, type AstroLike, type Terms } from "./access.js";
-import { PAYWALL_BLOCK, sections, splitAtPaywall } from "./blocks-names.js";
+import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem, splitAtPaywall } from "./blocks-names.js";
 import type { FileRule, RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
 import { text } from "./text.js";
@@ -79,7 +79,7 @@ async function entriesUsing(db: unknown, mediaId: string): Promise<Array<{ colle
 }
 
 /** The levels picked on an entry body's breaks and members-only parts: readers must hold one from each. */
-function bodyClauses(body: unknown): string[][] {
+export function bodyClauses(body: unknown): string[][] {
 	const blocks = Array.isArray(body) ? body : [];
 	const out: string[][] = [];
 	const split = splitAtPaywall(blocks);
@@ -95,9 +95,14 @@ async function readsWhole(astro: AstroLike, entry: { collection: string; id: str
 	const data = result?.entry?.data;
 	if (!data) return false;
 	const terms = data.terms as Terms | undefined;
+	const body = Object.values(data).find((v) => Array.isArray(v) && v.some((b) => [PAYWALL_BLOCK, "redeemid-members", ITEM_BLOCK].includes((b as { _type?: string })?._type ?? "")));
+	const item = soldItem(body);
+	if (item) {
+		const m = (await viewer(astro)).member;
+		if (m && m.status !== "disabled" && holdsItem(item, m.tags)) return true;
+	}
 	const verdict = await readEntry(astro, { collection: entry.collection, terms });
 	if (!verdict.allowed) return false;
-	const body = Object.values(data).find((v) => Array.isArray(v) && v.some((b) => (b as { _type?: string })?._type === PAYWALL_BLOCK || (b as { _type?: string })?._type === "redeemid-members"));
 	const clauses = bodyClauses(body);
 	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === "signed-in" && verdict.viewer.signedIn)));
 }

package/src/index.ts

@@ -59,6 +59,7 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
 			{ pattern: `${BASE}/cart-edit`, entrypoint: "@redeemid/emdash/routes/cart-edit.ts" },
 			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
 			{ pattern: `${BASE}/preferences`, entrypoint: "@redeemid/emdash/routes/preferences.ts" },
+			{ pattern: `${BASE}/privacy`, entrypoint: "@redeemid/emdash/routes/privacy.ts" },
 		],
 		publicRoutes: [`${BASE}/`],
 		storage: STORAGE_CONFIG,

package/src/plugin.ts

@@ -30,16 +30,20 @@ import { definePlugin } from "emdash";
 import { describe, levelsFor, SIGNED_IN } from "./access.js";
 import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
-import { stores, type MemberRecord } from "./storage.js";
+import { stores, type MemberRecord, type Stores } from "./storage.js";
 import { PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
-import { adminConfigured } from "./admin-api.js";
-import { accessTest, bulkResync, BULK_BATCH, deliveriesSection, memberDetail, registerWebhooks, resyncOne, tagEdit, webhooksSection } from "./staff.js";
+import { AdminError, adminConfigured } from "./admin-api.js";
+import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
+import { accessTest, bulkResync, BULK_BATCH, deliveriesSection, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit, webhooksSection } from "./staff.js";
 import { textProblems } from "./text.js";
+import { z } from "astro/zod";
+import { AgentError, explainAccess, getMember, getRules, levelChanges, listLevels, siteHealth, type ExplainInput } from "./agents.js";
 
 import {
 	COLLECTION_BLOCK,
 	CONTRIBUTION_BLOCK,
+	ITEM_BLOCK,
 	MEMBERS_BLOCK,
 	MEMBERS_END_BLOCK,
 	PAYWALL_BLOCK,
@@ -48,7 +52,7 @@ import {
 	PRODUCT_BLOCK,
 } from "./blocks-names.js";
 
-export { COLLECTION_BLOCK, CONTRIBUTION_BLOCK, MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK, PREFERENCES_BLOCK, PRODUCT_BLOCK };
+export { COLLECTION_BLOCK, CONTRIBUTION_BLOCK, ITEM_BLOCK, MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK, PREFERENCES_BLOCK, PRODUCT_BLOCK };
 
 function blocks(config: RedeemIDConfig) {
 	const levelOptions = [
@@ -91,6 +95,16 @@ function blocks(config: RedeemIDConfig) {
 			description: "Ends the members-only part; everyone reads on from here",
 			fields: [],
 		},
+		{
+			type: ITEM_BLOCK,
+			label: "Sold on its own",
+			icon: "tag",
+			description: "Buyers of this entry read all of it, whatever its levels say",
+			fields: [
+				{ type: "text_input" as const, action_id: "tag", label: "Shopify customer tag buyers get", placeholder: "item-big-story" },
+				{ type: "text_input" as const, action_id: "product", label: "Shopify product that sells it (handle or link)", placeholder: "the-big-story" },
+			],
+		},
 		{
 			type: PLAN_BLOCK,
 			label: "Plan",
@@ -166,7 +180,9 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 			widgets: WIDGETS,
 			portableTextBlocks: blocks(config),
 		},
+		mcp: agentTools(config),
 		routes: {
+			...agentRoutes(config),
 			admin: {
 				handler: async (ctx: RouteContext) => {
 					const i = (ctx.input ?? {}) as { type?: string; page?: string; action_id?: string; value?: unknown; values?: Record<string, unknown>; block_id?: string };
@@ -176,6 +192,7 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 						if (i.page === "/") return await membersPage(config);
 						if (i.page === "/status") return await statusPage(config, ctx.request);
 						if (i.page === "/test") return await accessTest(config);
+						if (i.page === "/privacy") return await privacyPage(await memberStores());
 						if (i.page === "widget:status") return await statusWidget(config);
 					} catch (e) {
 						return { blocks: [{ type: "banner", variant: "error", title: "RedeemID couldn't load this page", description: (e as Error).message }] };
@@ -189,6 +206,85 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 
 export default createPlugin;
 
+// ---------------------------------------------------------------- agents and CLI
+
+const STAFF = "users:read" as const;
+
+/** Staff-only JSON routes, also offered as MCP tools. */
+function agentRoutes(config: RedeemIDConfig) {
+	const run = (fn: (s: Stores, input: Record<string, unknown>) => Promise<unknown> | unknown) => async (ctx: RouteContext) => {
+		try {
+			return { ok: true, result: await fn(await memberStores(), (ctx.input ?? {}) as Record<string, unknown>) };
+		} catch (e) {
+			if (e instanceof AgentError || e instanceof AdminError) return { ok: false, error: e.message };
+			throw e;
+		}
+	};
+	const route = (input: z.ZodType, fn: Parameters<typeof run>[0]) => ({ permission: STAFF, input, request: { body: "json" as const }, handler: run(fn) });
+	const read = {
+		"explain-access": route(EXPLAIN, (s, i) => explainAccess(config, s, i as unknown as ExplainInput)),
+		"list-levels": route(EMPTY, () => listLevels(config)),
+		"get-rules": route(EMPTY, () => getRules(config)),
+		"get-member": route(MEMBER, (s, i) => getMember(config, s, i as { customerId?: string; email?: string })),
+		"site-health": route(EMPTY, (s) => siteHealth(config, s)),
+		"level-changes": route(CHANGES, (s, i) => levelChanges(config, s, i as { since: string; level?: string })),
+	};
+	if (!config.agents?.actions) return read;
+	return {
+		...read,
+		"resync-member": route(CUSTOMER, async (s, i) => {
+			const m = await resyncOne(config, s, String(i.customerId), "agent resync");
+			if (!m) throw new AgentError("Shopify no longer has this customer");
+			return getMember(config, s, { customerId: m.customerId });
+		}),
+		"resync-batch": route(EMPTY, (s) => bulkResync(config, s)),
+		"edit-member-tags": route(TAGS, async (s, i) => {
+			const id = String(i.customerId);
+			const add = (i.add as string[] | undefined) ?? [];
+			const remove = (i.remove as string[] | undefined) ?? [];
+			if (add.length) await tagEdit(config, s, id, "add", add);
+			if (remove.length) await tagEdit(config, s, id, "remove", remove);
+			return getMember(config, s, { customerId: id });
+		}),
+	};
+}
+
+const EMPTY = z.object({});
+const EXPLAIN = z.object({
+	collection: z.string().min(1).describe("Collection slug, e.g. posts"),
+	id: z.string().optional().describe("An entry's id or slug; its terms and body are read from the site"),
+	terms: z.record(z.string(), z.array(z.string())).optional().describe('Terms by taxonomy when no id is given, e.g. {"category":["investigations"]}'),
+	tags: z.array(z.string()).optional().describe("The reader's Shopify customer tags"),
+	customerId: z.string().optional().describe("A real member's Shopify customer id, in place of tags"),
+	signedIn: z.boolean().optional().describe("false for a signed-out visitor (default true)"),
+});
+const MEMBER = z.object({ customerId: z.string().optional(), email: z.string().optional() });
+const CUSTOMER = z.object({ customerId: z.string().min(1).describe("Shopify customer id") });
+const CHANGES = z.object({ since: z.string().describe("A date, e.g. 2026-11-01"), level: z.string().optional().describe("Only this level slug") });
+const TAGS = z.object({
+	customerId: z.string().min(1).describe("Shopify customer id"),
+	add: z.array(z.string()).optional().describe("Tags to add in Shopify"),
+	remove: z.array(z.string()).optional().describe("Tags to remove in Shopify"),
+});
+
+/** MCP tools for the routes above. Staff turn them on for RedeemID under Plugins. */
+function agentTools(config: RedeemIDConfig) {
+	const tools: Record<string, { description: string; route: string; input: z.ZodType; destructive?: boolean }> = {
+		explain_access: { route: "explain-access", input: EXPLAIN, description: "Can this reader read this entry, and why? Give the entry by collection and id (or terms), and the reader by Shopify tags, a member's customer id, or signedIn:false. Answers what the entry needs, the reader's levels, the result, the level a locked reader is offered, and each members-only part." },
+		list_levels: { route: "list-levels", input: EMPTY, description: "Every membership level: slug, name, the Shopify tags that grant it (any or all), wall text and join link." },
+		get_rules: { route: "get-rules", input: EMPTY, description: "The paywall rules: how they combine, each rule (collection, term, levels, drip, open), the meter, teasers, features and protected-file rules." },
+		get_member: { route: "get-member", input: MEMBER, description: "One synced member by Shopify customer id or email: status, tags, current levels with start dates, past levels, features and last sync." },
+		site_health: { route: "site-health", input: EMPTY, description: "Whether each setting is in place (never the values), the last webhook, open privacy requests and ignored text replacements." },
+		level_changes: { route: "level-changes", input: CHANGES, description: "Who joined or left a level since a date, from each member's tag dates." },
+	};
+	if (config.agents?.actions) {
+		tools.resync_member = { route: "resync-member", input: CUSTOMER, description: "Read one member from Shopify now and update the site. Changes nothing in Shopify." };
+		tools.resync_batch = { route: "resync-batch", input: EMPTY, description: "Read the 50 members synced longest ago from Shopify. Run again for the next 50." };
+		tools.edit_member_tags = { route: "edit-member-tags", input: TAGS, destructive: true, description: "Add or remove tags on a member's Shopify customer, then read back what Shopify holds. Access follows from Shopify." };
+	}
+	return { tools };
+}
+
 // ---------------------------------------------------------------- actions
 
 const webhookUri = (request: Request) => `${new URL(request.url).origin}/_emdash/api/auth/redeemid/webhook`;
@@ -254,6 +350,41 @@ async function action(
 		}
 		case "access_test":
 			return accessTest(config, i.values);
+		case "member_export": {
+			const id = String(i.value ?? "");
+			const m = await s.members.get(id);
+			if (!m) return membersPage(config);
+			return exportBlocks(memberDetail(config, m, { type: "success", message: "Export below." }), await exportRequest(s, id, "staff"));
+		}
+		case "member_erase": {
+			const id = String(i.value ?? "");
+			await eraseMember(config, s, id, "staff");
+			return { ...(await membersPage(config)), toast: { type: "success", message: "Erased from the site." } };
+		}
+		case "member_shopify_erase":
+		case "member_shopify_cancel": {
+			const id = String(i.value ?? "");
+			const m = await s.members.get(id);
+			try {
+				if (i.action_id === "member_shopify_erase") await requestShopifyErasure(config, s, id);
+				else await cancelShopifyErasure(config, s, id);
+				const message = i.action_id === "member_shopify_erase" ? "Shopify will erase the customer after its waiting period." : "The Shopify erasure is cancelled.";
+				return m ? memberDetail(config, m, { type: "success", message }) : privacyPage(s, { type: "success", message });
+			} catch (e) {
+				return m ? memberDetail(config, m, fail(e)) : privacyPage(s, fail(e));
+			}
+		}
+		case "privacy_done": {
+			const r = await closeRequest(s, String(i.value ?? ""));
+			if (r?.kind === "export" && r.customerId) {
+				const data = await exportMember(s, r.customerId);
+				return privacyPage(s, { type: "success", message: "Marked done. Send the export below to the store owner." }, [
+					{ type: "header", text: `Export for customer ${r.customerId}` },
+					{ type: "code", language: "jsonc", code: JSON.stringify(data, null, 2) },
+				]);
+			}
+			return privacyPage(s, { type: "success", message: "Marked done." });
+		}
 	}
 	return { blocks: [] };
 }

package/src/privacy.ts

@@ -0,0 +1,148 @@
+/**
+ * Privacy requests: every export and erase of the member data RedeemID keeps,
+ * whether the member asked on the site, staff started it, or Shopify sent it.
+ *
+ * What RedeemID keeps about a member: the mirror record (customer id, email,
+ * name, tags and their dates, status, when they first signed in and last
+ * synced, preference save times) and their meter records. Preference answers
+ * live on the Shopify customer, and webhook deliveries keep only a topic and
+ * a time. Shopify stays the record of the customer: erasing here never
+ * erases Shopify data, though staff can ask Shopify to (requestShopifyErasure).
+ */
+
+import { admin, AdminError } from "./admin-api.js";
+import type { RedeemIDConfig } from "./config.js";
+import { emit } from "./events.js";
+import type { MemberRecord, MeterRecord, PrivacyRequest, Stores } from "./storage.js";
+
+export const EXPORT_VERSION = 1;
+
+export interface MemberExport {
+	format: "redeemid-member-export";
+	version: number;
+	exportedAt: string;
+	member: MemberRecord | null;
+	meter: MeterRecord[];
+	elsewhere: string[];
+}
+
+async function meterFor(s: Stores, userId: string | null): Promise<Array<{ id: string; data: MeterRecord }>> {
+	if (!userId) return [];
+	const out: Array<{ id: string; data: MeterRecord }> = [];
+	let cursor: string | undefined;
+	do {
+		const page = await s.meter.query({ where: { userId }, limit: 100, cursor });
+		out.push(...page.items);
+		cursor = page.cursor;
+	} while (cursor);
+	return out;
+}
+
+async function log(s: Stores, r: Omit<PrivacyRequest, "at"> & { at?: string }): Promise<string> {
+	const id = crypto.randomUUID();
+	await s.requests.put(id, { ...r, at: r.at ?? new Date().toISOString() });
+	return id;
+}
+
+/** Everything RedeemID keeps about one member. */
+export async function exportMember(s: Stores, customerId: string): Promise<MemberExport> {
+	const member = await s.members.get(customerId);
+	const meter = await meterFor(s, member?.userId ?? null);
+	return {
+		format: "redeemid-member-export",
+		version: EXPORT_VERSION,
+		exportedAt: new Date().toISOString(),
+		member,
+		meter: meter.map((m) => m.data),
+		elsewhere: [
+			"Orders, addresses, preference answers and the full customer record are kept by the store.",
+			"The site's own user account (email and name) is kept by the site's content system.",
+		],
+	};
+}
+
+/** Export and log it. */
+export async function exportRequest(s: Stores, customerId: string, source: PrivacyRequest["source"]): Promise<MemberExport> {
+	const data = await exportMember(s, customerId);
+	await log(s, { kind: "export", source, customerId, status: "done" });
+	return data;
+}
+
+/**
+ * Erase what RedeemID keeps about one member: the mirror record and their
+ * meter. The site user stays; if they sign in again they're linked again.
+ */
+export async function eraseMember(config: RedeemIDConfig | null, s: Stores, customerId: string, source: PrivacyRequest["source"], shopifyRequestId: string | null = null): Promise<boolean> {
+	const member = await s.members.get(customerId);
+	for (const m of await meterFor(s, member?.userId ?? null)) await s.meter.delete(m.id);
+	if (member) await s.members.delete(customerId);
+	await log(s, { kind: "erase", source, customerId, status: "done", shopifyRequestId });
+	// Receivers of earlier events hold their own copies: tell them, by id only.
+	await emit(config, "member.erased", { customerId, source });
+	return Boolean(member);
+}
+
+/** shop/redact: erase every member and meter record. */
+export async function eraseAll(config: RedeemIDConfig | null, s: Stores): Promise<number> {
+	let n = 0;
+	for (;;) {
+		const page = await s.members.query({ limit: 100 });
+		if (page.items.length === 0) break;
+		for (const r of page.items) {
+			for (const m of await meterFor(s, r.data.userId)) await s.meter.delete(m.id);
+			await s.members.delete(r.id);
+			n++;
+		}
+	}
+	for (;;) {
+		const page = await s.meter.query({ limit: 100 });
+		if (page.items.length === 0) break;
+		for (const r of page.items) await s.meter.delete(r.id);
+	}
+	await log(s, { kind: "erase", source: "shopify", customerId: null, status: "done", note: `Shop redacted: ${n} members` });
+	return n;
+}
+
+/** customers/data_request: an open export request for staff to send to the store owner. */
+export async function shopifyDataRequest(s: Stores, customerId: string, shopifyRequestId: string | null): Promise<void> {
+	await log(s, { kind: "export", source: "shopify", customerId, status: "open", shopifyRequestId });
+}
+
+export async function closeRequest(s: Stores, id: string): Promise<PrivacyRequest | null> {
+	const r = await s.requests.get(id);
+	if (!r) return null;
+	const done = { ...r, status: "done" as const };
+	await s.requests.put(id, done);
+	return done;
+}
+
+export async function recentRequests(s: Stores, limit = 50): Promise<Array<{ id: string; data: PrivacyRequest }>> {
+	const { items } = await s.requests.query({ orderBy: { at: "desc" }, limit });
+	return items;
+}
+
+/**
+ * Ask Shopify to erase the customer's personal data across the store, orders
+ * included. Shopify waits before it does; cancelShopifyErasure withdraws it.
+ * Needs the write_customer_data_erasure scope.
+ */
+export async function requestShopifyErasure(config: RedeemIDConfig, s: Stores, customerId: string, fetcher: typeof fetch = fetch): Promise<void> {
+	await erasureMutation(config, "customerRequestDataErasure", customerId, fetcher);
+	await log(s, { kind: "erase", source: "staff", customerId, status: "open", note: "Asked Shopify to erase" });
+}
+
+export async function cancelShopifyErasure(config: RedeemIDConfig, s: Stores, customerId: string, fetcher: typeof fetch = fetch): Promise<void> {
+	await erasureMutation(config, "customerCancelDataErasure", customerId, fetcher);
+	await log(s, { kind: "erase", source: "staff", customerId, status: "done", note: "Cancelled the Shopify erasure" });
+}
+
+async function erasureMutation(config: RedeemIDConfig, name: "customerRequestDataErasure" | "customerCancelDataErasure", customerId: string, fetcher: typeof fetch): Promise<void> {
+	const data = await admin<Record<string, { userErrors: Array<{ message: string }> } | null>>(
+		config,
+		`mutation RedeemIDErasure($id: ID!) { ${name}(customerId: $id) { customerId userErrors { field message code } } }`,
+		{ id: `gid://shopify/Customer/${customerId}` },
+		fetcher,
+	);
+	const err = data[name]?.userErrors[0];
+	if (err) throw new AdminError(err.message);
+}

package/src/routes/privacy.ts

@@ -0,0 +1,59 @@
+/**
+ * /_emdash/api/auth/redeemid/privacy: the signed-in member's own data.
+ *
+ * GET downloads everything RedeemID keeps about them as JSON.
+ * POST with `confirm=yes` (from <YourData>) erases it, signs them out and
+ * goes back to `return` with the notice data_erased. The member always comes
+ * from the session, never from the request, and a POST from another origin
+ * is refused.
+ */
+
+import type { APIRoute } from "astro";
+import { getPublicOrigin } from "emdash/api/route-utils";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig } from "../config.js";
+import { eraseMember, exportRequest } from "../privacy.js";
+import { memberForUser, stores } from "../storage.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
+	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
+	if (!emdash?.db) return null;
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return null;
+	const s = stores(emdash.db);
+	const member = await memberForUser(s, user.id);
+	return member ? { s, member, config: readConfig(emdash.config), emdash } : null;
+}
+
+export const GET: APIRoute = async ({ locals, session, redirect, url }) => {
+	const c = await context(locals, session);
+	if (!c) return redirect(signInUrl(safeReturn(url.searchParams.get("return"))));
+	const data = await exportRequest(c.s, c.member.customerId, "member");
+	return new Response(JSON.stringify(data, null, 2), {
+		status: 200,
+		headers: {
+			"Content-Type": "application/json; charset=utf-8",
+			"Content-Disposition": 'attachment; filename="my-data.json"',
+			"Cache-Control": "private, no-store",
+		},
+	});
+};
+
+export const POST: APIRoute = async ({ request, locals, session, redirect, url }) => {
+	const form = await request.formData().catch(() => null);
+	const returnTo = safeReturn(String(form?.get("return") ?? "/"));
+	const emdashConfig = (locals as { emdash?: { config?: unknown } }).emdash?.config;
+	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);
+	const from = request.headers.get("origin");
+	if (from && from !== origin && from !== url.origin) return new Response("Forbidden", { status: 403 });
+	const c = await context(locals, session);
+	if (!c) return redirect(signInUrl(returnTo));
+	if (form?.get("confirm") !== "yes") return fail(redirect, returnTo, "erase_unconfirmed");
+	await eraseMember(c.config, c.s, c.member.customerId, "member");
+	session?.destroy();
+	return fail(redirect, returnTo, "data_erased");
+};

package/src/routes/webhook.ts

@@ -50,7 +50,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 	try {
 		const config = readConfig(emdash.config);
-		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic));
+		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config);
 		return new Response(outcome, { status: 200 });
 	} catch (e) {
 		console.error("[redeemid] webhook failed:", topic, (e as Error).message);