@redeemid/emdash 0.0.12 → 0.0.15

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.12, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
+**Status: 0.0.15, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -241,7 +241,7 @@ With `agents: { actions: true }` in the config, three actions are offered too:
 | MCP tool | Command | What it does |
 | --- | --- | --- |
 | `resync_member` | `resync <customer id>` | Reads one member from Shopify and updates the site. Changes nothing in Shopify. |
-| `resync_batch` | `resync-batch` | Reads the 50 members synced longest ago. |
+| `resync_batch` | `resync-batch` | Reads the 25 members synced longest ago. |
 | `edit_member_tags` | `tags <customer id> --add a,b --remove c` | Adds or removes tags on the Shopify customer, then reads back what Shopify holds. It's marked destructive for agents. |
 
 **Agents.** EmDash's MCP server is at `/_emdash/api/mcp`, on EmDash versions with plugin MCP tools. RedeemID's tools stay off until an administrator turns them on for RedeemID under **Plugins**. Turning them on approves the list as it stands, and a release that changes the list needs approving again. The agent uses an EmDash API token with the `mcp:tools` or `mcp:tools:redeemid` scope, made by an administrator. Tool names carry the plugin's prefix, for example `redeemid__explain_access`.
@@ -295,8 +295,8 @@ No event carries an email address or a name: match people by the Shopify `custom
 With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set (it also runs member preferences), RedeemID gets an Admin API token for the webhook app with the client credentials grant (the app must belong to the same Shopify organization as the store, as Dev Dashboard apps do) and needs the `read_customers` and `write_customers` scopes. Then, in the admin:
 
 - **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
-- **Bulk resync.** Reads the 50 members synced longest ago from Shopify in one request. Run it again for the next 50. It never runs on its own.
-- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Bulk resync.** Reads the 25 members synced longest ago from Shopify in one request, few enough for the Workers Free limit of 50 database queries a request. Run it again for the next 25. It never runs on its own.
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings). A topic Shopify refuses, such as `customers/merge` without the `read_customer_merge` scope, is named with the reason and doesn't stop the others.
 - **Recent deliveries.** The last webhooks the site took, with their topics and times.
 - **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
 
@@ -310,13 +310,15 @@ EmDash has no content filter hook, so templates decide what to render. Render th
 ---
 import Content from "@redeemid/emdash/components/Content.astro";
 ---
-<Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id}>
+<Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id} title={post.data.title}>
 	<a slot="locked" href="/join/">Become a member</a>
 </Content>
 ```
 
 Everything before the first Paywall break block is shown to everyone. What follows reaches the page only for readers the break allows: the levels picked on it ("Signed in" for any member), or when none are picked the entry's rule. With none picked and no rule covering the entry, the break changes nothing. A body with no break follows the entry's rule as a whole; readers it keeps out see the collection's `teaser` (the paragraphs within that many words, never half a paragraph), if one is set. Plain `<PortableText>` ignores the break and shows everything, so use `<Content>` for any body that may hold one.
 
+On the entry's own page (with `id`), a locked entry also gets Google's paywalled-content markup: JSON-LD saying `isAccessibleForFree: false`, with the wall (`.redeemid-locked`) as the part that isn't free. Search engines can then tell a paywall from cloaking. Pass `title` for its headline. Set `schema: false` in the config if an SEO plugin already adds this markup.
+
 A "Members only" block starts a part for the levels picked on it (none picked: the entry's rule, or any signed-in member) that runs to the next "Members only: end" block. Readers who can't read it see the wall there, and the body goes on after the end block.
 
 The wall is `<LockedPanel>`: it says why the reader is kept out and offers sign-in or the join link, with the wall text of the first level they are missing. `<Content>` and `<Gate>` show it; its default slot (and `<Content>`'s "locked" slot) goes on top.
@@ -360,6 +362,12 @@ import Plan from "@redeemid/emdash/components/Plan.astro";
 </Plan>
 ```
 
+### Caching
+
+`redeemidGuard()` keeps every site page private for a signed-in visitor or a visitor with a cart: `Cache-Control: private, no-store`, and out of Astro's route cache (it calls `cache.set(false)` after the page has set its own cache hint). Visitors with neither get the same page, so their pages stay cacheable.
+
+A route cache keys pages by URL alone and serves a stored page without running any code. So if the site turns on Astro's route cache, don't cache the pages that render `<Content>` or `<Gate>` for locked entries: a member would get the visitor's stored copy, wall included. Call `Astro.cache.set(hint)` only on pages whose entries no rule covers.
+
 ### Shop
 
 Products, collections and the cart come from the Storefront API; Shopify works out prices, discounts, taxes and stock.

package/bin/redeemid-emdash.mjs

@@ -28,7 +28,7 @@ Commands:
   health                  What's set up (never the values)
   changes --since <date>  Who joined or left a level [--level <slug>]
   resync <customer id>    Read one member from Shopify again *
-  resync-batch            Read the 50 members synced longest ago *
+  resync-batch            Read the 25 members synced longest ago *
   tags <customer id>      Edit tags in Shopify: --add a,b --remove c *
 
   * only when the site sets agents: { actions: true }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.12",
+	"version": "0.0.15",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/admin-api.ts

@@ -124,9 +124,12 @@ export async function customers(config: RedeemIDConfig, ids: string[], fetcher:
  */
 export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], source = "resync", fetcher: typeof fetch = fetch): Promise<{ updated: MemberRecord[]; missing: string[] }> {
 	const found = await customers(config, ids, fetcher);
+	// One read for the whole batch: on Workers Free one request may make only
+	// 50 database queries, and each write below is one.
+	const known = await s.members.getMany(found.map((c) => c.customerId));
 	const updated: MemberRecord[] = [];
 	for (const c of found) {
-		const m = (await s.members.get(c.customerId)) ?? emptyMember(c.customerId);
+		const m = known.get(c.customerId) ?? emptyMember(c.customerId);
 		m.email = c.email ?? m.email;
 		m.firstName = c.firstName ?? m.firstName;
 		m.lastName = c.lastName ?? m.lastName;
@@ -173,10 +176,22 @@ export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: type
 	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
 }
 
-/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
-export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+/** Scopes a topic needs beyond read_customers, to explain a refusal. */
+const TOPIC_SCOPES: Partial<Record<(typeof WEBHOOK_TOPICS)[number], string>> = { CUSTOMERS_MERGE: "read_customer_merge" };
+
+/**
+ * Register the topics RedeemID needs that no subscription sends to `uri` yet.
+ * A topic Shopify refuses doesn't stop the others: it comes back in `failed`.
+ */
+export async function registerWebhooks(
+	config: RedeemIDConfig,
+	uri: string,
+	fetcher: typeof fetch = fetch,
+): Promise<{ added: string[]; failed: Array<{ topic: string; message: string }> }> {
 	const have = await webhookSubscriptions(config, fetcher);
 	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	const added: string[] = [];
+	const failed: Array<{ topic: string; message: string }> = [];
 	for (const topic of missing) {
 		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
 			config,
@@ -185,7 +200,8 @@ export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetc
 			fetcher,
 		);
 		const err = data.webhookSubscriptionCreate.userErrors[0];
-		if (err) throw new AdminError(`${topic}: ${err.message}`);
+		if (!err) added.push(topic);
+		else failed.push({ topic, message: TOPIC_SCOPES[topic] ? `${err.message} (the app needs the ${TOPIC_SCOPES[topic]} scope)` : err.message });
 	}
-	return [...missing];
+	return { added, failed };
 }

package/src/components/Content.astro

@@ -24,6 +24,11 @@
  * `drip` keeps it shut until the member has held their level that many days,
  * and config `meter` lets signed-in readers open a few locked entries each
  * period (each entry counts once). Leave `id` off in lists.
+ *
+ * With `id`, a locked entry's page also gets Google's paywalled-content
+ * markup (isAccessibleForFree false, pointing at the wall), the same for
+ * every reader. Pass `title` for its headline. Config `schema: false` turns
+ * it off.
  */
 import { PortableText } from "emdash/ui";
 
@@ -37,11 +42,13 @@ interface Props {
 	value?: unknown[] | null;
 	collection?: string;
 	terms?: Terms;
-	/** The entry's id, on its own page: turns on drip and the meter. */
+	/** The entry's id, on its own page: turns on drip, the meter and the paywall markup. */
 	id?: string;
+	/** The entry's title, for the paywall markup's headline. */
+	title?: string;
 }
 
-const { value, collection = "", terms, id } = Astro.props;
+const { value, collection = "", terms, id, title } = Astro.props;
 const split = splitAtPaywall(value);
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
 const entryRule = await entryRequirement(config, collection, terms);
@@ -77,6 +84,19 @@ async function parts(blocks: unknown[]) {
 }
 const before = await parts(shown);
 const after = await parts(rest);
+// Google's paywalled-content markup, on the entry's own page when any of it is locked.
+const lockedEntry = Boolean(split.paywall ? required : entryRule) || sections(value ?? []).some((s) => s.members);
+const schema =
+	id && lockedEntry && config?.schema !== false
+		? JSON.stringify({
+				"@context": "https://schema.org",
+				"@type": "Article",
+				...(title ? { headline: title } : {}),
+				url: Astro.url.origin + Astro.url.pathname,
+				isAccessibleForFree: false,
+				hasPart: { "@type": "WebPageElement", isAccessibleForFree: false, cssSelector: ".redeemid-locked" },
+			}).replace(/</g, "\\u003c")
+		: null;
 const metered = verdict.reason === "metered" ? (verdict as Verdict) : null;
 const week = metered?.meter?.period === "week";
 const left = metered?.meterLeft ?? 0;
@@ -88,6 +108,7 @@ const meterText =
 			: text(config, week ? "You have {count} free reads left this week." : "You have {count} free reads left this month.", { count: left });
 ---
 
+{schema && <script type="application/ld+json" set:html={schema} />}
 {metered && (
 	<p class="redeemid-meter" role="status" data-redeemid-left={metered.meterLeft}>
 		{meterText}

package/src/components/Notices.astro

@@ -16,6 +16,7 @@ const DEFAULTS: Record<string, string> = {
 	sign_in_unavailable: "Sign-in isn't available right now. Try again in a few minutes.",
 	sign_in_expired: "That sign-in took too long. Try again.",
 	staff_account: "This account can't sign in here. Use a different email.",
+	account_disabled: "Your account is turned off. Contact the store for help.",
 	site_not_ready: "This site isn't ready for sign-in yet.",
 	email_required: "Your account needs an email address to sign in.",
 	token_failed: "Sign-in didn't finish. Try again.",

package/src/config.ts

@@ -150,6 +150,12 @@ export interface RedeemIDConfig {
 	 * one they see none of it.
 	 */
 	teaser?: Record<string, number>;
+	/**
+	 * Google's paywalled-content markup (isAccessibleForFree false, pointing at
+	 * the wall) on the page of each locked entry, printed by <Content> when it
+	 * gets `id`. Set false when an SEO plugin already adds it.
+	 */
+	schema?: false;
 	/**
 	 * Extra /_emdash path prefixes signed-in members may use. Everything else
 	 * under /_emdash is refused to Subscribers (see guard.ts).

package/src/guard.ts

@@ -1,17 +1,30 @@
 /**
- * Keeps members out of EmDash's own APIs and admin.
+ * Keeps members out of EmDash's own APIs and admin, and keeps their pages out
+ * of shared caches.
  *
  * EmDash's Subscriber role may read every published entry through
  * /_emdash/api/content. With RedeemID, access comes from Shopify tags only, so
  * a member with one level could otherwise read another level's posts there.
  * This middleware runs after EmDash's auth and refuses Subscribers on every
  * /_emdash path except the few public pages need.
+ *
+ * Site pages for a signed-in visitor, or a visitor with a cart, are private:
+ * `Cache-Control: private, no-store` and out of Astro's route cache. The route
+ * cache ignores Cache-Control and takes its options from `cache.set()`, which
+ * EmDash templates call on every page with the content's cache hint, and it
+ * serves a stored page to the next visitor without running any code. EmDash
+ * opts editors out, not Subscribers, so without this a member's page (locked
+ * text included) could be stored and served to anyone. A later
+ * `Astro.cache.set(hint)` turns caching back on, and the route cache reads its
+ * options only after the page has rendered, so the opt-out runs after `next()`.
  */
 
 import { defineMiddleware } from "astro:middleware";
 
 import { signInUrl } from "./access.js";
+import { readCart } from "./cart.js";
 import { keysFromPath, pathAccess, refusal } from "./files.js";
+import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { siteConfig } from "./site-config.js";
 
 const SUBSCRIBER = 10;
@@ -45,6 +58,20 @@ async function withUser(context: { locals: unknown; session?: { get(k: string):
 	return { ...context, locals: { ...locals, user: { id: user.id, role: user.role, disabled: user.disabled } } };
 }
 
+/** Keep one visitor's response out of every shared cache, the route cache included. */
+export function keepPrivate(context: { cache?: { set(options: false): void } }, res: Response): Response {
+	context.cache?.set(false);
+	try {
+		res.headers.set("cache-control", "private, no-store");
+		return res;
+	} catch {
+		// Immutable headers (a redirect made with Response.redirect).
+		const out = new Response(res.body, res);
+		out.headers.set("cache-control", "private, no-store");
+		return out;
+	}
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { locals, url } = context;
 	const user = (locals as { user?: { role?: number } | null }).user;
@@ -72,6 +99,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
+	// Back from ending the store session after a refused sign-in.
+	if (url.pathname === "/" && !url.searchParams.has("redeemid_notice")) {
+		const after = readAfterLogout(context.cookies.get(AFTER_LOGOUT_COOKIE)?.value);
+		if (after) {
+			const sep = after.returnTo.includes("?") ? "&" : "?";
+			const location = `${after.returnTo}${sep}redeemid_notice=${encodeURIComponent(after.code)}`;
+			return new Response(null, { status: 302, headers: { location, "cache-control": "private, no-store", "set-cookie": `${AFTER_LOGOUT_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` } });
+		}
+	}
+
+	if (!url.pathname.startsWith("/_emdash")) {
+		const own = Boolean(user) || Boolean(await readCart(context.session as never).catch(() => null));
+		return own ? keepPrivate(context, await next()) : next();
+	}
+
 	if (!user || user.role !== SUBSCRIBER) return next();
 
 	if (memberMayUse(url.pathname, config?.memberPaths)) return next();

package/src/plugin.ts

@@ -279,7 +279,7 @@ function agentTools(config: RedeemIDConfig) {
 	};
 	if (config.agents?.actions) {
 		tools.resync_member = { route: "resync-member", input: CUSTOMER, description: "Read one member from Shopify now and update the site. Changes nothing in Shopify." };
-		tools.resync_batch = { route: "resync-batch", input: EMPTY, description: "Read the 50 members synced longest ago from Shopify. Run again for the next 50." };
+		tools.resync_batch = { route: "resync-batch", input: EMPTY, description: `Read the ${BULK_BATCH} members synced longest ago from Shopify. Run again for the next ${BULK_BATCH}.` };
 		tools.edit_member_tags = { route: "edit-member-tags", input: TAGS, destructive: true, description: "Add or remove tags on a member's Shopify customer, then read back what Shopify holds. Access follows from Shopify." };
 	}
 	return { tools };
@@ -342,8 +342,10 @@ async function action(
 		}
 		case "webhooks_register": {
 			try {
-				const added = await registerWebhooks(config, webhookUri(request));
-				return { ...(await statusPage(config, request)), toast: { type: "success", message: added.length ? `Registered ${added.length} webhooks.` : "Nothing was missing." } };
+				const { added, failed } = await registerWebhooks(config, webhookUri(request));
+				const done = added.length ? `Registered ${added.length} webhooks.` : failed.length ? "" : "Nothing was missing.";
+				const refused = failed.map((f) => `Shopify refused ${f.topic}: ${f.message}`).join(" ");
+				return { ...(await statusPage(config, request)), toast: { type: failed.length ? "error" : "success", message: [done, refused].filter(Boolean).join(" ") } };
 			} catch (e) {
 				return { ...(await statusPage(config, request)), toast: fail(e) };
 			}

package/src/routes/callback.ts

@@ -12,15 +12,16 @@
 import { findOrCreateOAuthUser, OAuthError, Role } from "@emdash-cms/auth";
 import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
 import type { APIRoute } from "astro";
-import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
 import { emit, levelChange } from "../events.js";
 import { levelsFor } from "../access.js";
-import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
+import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
-import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
+import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
+
+import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
 
 export const prerender = false;
 
@@ -63,10 +64,13 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			verifier: flow.verifier,
 		});
 		const claims = await verifyIdToken(d, tokens.idToken, { clientId, nonce: flow.nonce });
+		// Refusals from here on also end the store session, so the next Sign in
+		// asks for an email again instead of reusing this account.
+		const refuse = (code: string) => signedOut(d, tokens.idToken, url, emdash.config, returnTo, code) ?? fail(redirect, returnTo, code);
 		const who = await identity(d, tokens.accessToken);
 
 		const email = (typeof claims.email === "string" ? claims.email : who.email)?.toLowerCase() ?? null;
-		if (!email) return fail(redirect, returnTo, "email_required");
+		if (!email) return refuse("email_required");
 		const emailVerified = claims.email_verified === true;
 
 		const adapter = createKyselyAdapter(emdash.db as Kysely<AuthTables>);
@@ -74,7 +78,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		// Staff accounts never sign in through the store, even with the same email.
 		const linked = await adapter.getOAuthAccount(PROVIDER_ID, who.customerId);
 		const existing = linked ? await adapter.getUserById(linked.userId) : await adapter.getUserByEmail(email);
-		if (existing && existing.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (existing && existing.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const name = [who.firstName, who.lastName].filter(Boolean).join(" ") || null;
 		const user = await findOrCreateOAuthUser(
@@ -84,8 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			async () => ({ allowed: true, role: Role.SUBSCRIBER }),
 			{ requireVerifiedEmail: true },
 		);
-		if (user.disabled) return fail(redirect, returnTo, "account_disabled");
-		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (user.disabled) return refuse("account_disabled");
+		if (user.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const s = stores(emdash.db);
 		const found = await s.members.get(who.customerId);
@@ -123,3 +127,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		return fail(redirect, returnTo, code);
 	}
 };
+
+/** Ends the store session, then shows `code` on `returnTo` (see AFTER_LOGOUT_COOKIE). */
+function signedOut(d: Discovery, idToken: string, url: URL, emdashConfig: unknown, returnTo: string, code: string): Response | null {
+	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);
+	const to = logoutUrl(d, idToken, `${origin}/`);
+	if (!to) return null;
+	return new Response(null, { status: 302, headers: { location: to, "set-cookie": afterLogoutCookie(code, returnTo), "cache-control": "private, no-store" } });
+}

package/src/routes/shared.ts

@@ -26,3 +26,29 @@ export function fail(redirect: (to: string) => Response, returnTo: string, code:
 	const sep = returnTo.includes("?") ? "&" : "?";
 	return redirect(`${returnTo}${sep}redeemid_notice=${encodeURIComponent(code)}`);
 }
+
+/**
+ * A refused sign-in also ends the store session, or the next Sign in would
+ * pass straight through with the same account. Shopify only returns to the
+ * site root after that, so this short cookie carries the notice and the page
+ * back; the guard middleware turns it into the usual `?redeemid_notice=`.
+ */
+export const AFTER_LOGOUT_COOKIE = "redeemid_after_logout";
+export const SIGNED_OUT_NOTICES = ["staff_account", "account_disabled", "email_required"] as const;
+
+export function afterLogoutCookie(code: string, returnTo: string): string {
+	return `${AFTER_LOGOUT_COOKIE}=${encodeURIComponent(JSON.stringify([code, returnTo]))}; Path=/; Max-Age=600; HttpOnly; Secure; SameSite=Lax`;
+}
+
+/** The notice and page a refused sign-in left, or null. */
+export function readAfterLogout(raw: string | undefined): { code: string; returnTo: string } | null {
+	if (!raw) return null;
+	try {
+		const [code, returnTo] = JSON.parse(decodeURIComponent(raw)) as [unknown, unknown];
+		if (typeof code !== "string" || !(SIGNED_OUT_NOTICES as readonly string[]).includes(code)) return null;
+		const to = typeof returnTo === "string" && returnTo.startsWith("/") && !returnTo.startsWith("//") && !returnTo.startsWith("/\\") ? returnTo : "/";
+		return { code, returnTo: to };
+	} catch {
+		return null;
+	}
+}

package/src/staff.ts

@@ -13,7 +13,12 @@ import { recentRequests } from "./privacy.js";
 import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
-export const BULK_BATCH = 50;
+/**
+ * Members per bulk resync click. Each one costs a database write, and on the
+ * Workers Free plan one request may make only 50 database queries (EmDash's
+ * own session and settings reads included), so a batch has to leave room.
+ */
+export const BULK_BATCH = 25;
 
 type Blocks = { blocks: unknown[]; toast?: { message: string; type: "success" | "error" | "info" } };
 

package/src/text.ts

@@ -84,6 +84,7 @@ export const STRINGS = {
 		"Sign-in isn't available right now. Try again in a few minutes.",
 		"That sign-in took too long. Try again.",
 		"This account can't sign in here. Use a different email.",
+		"Your account is turned off. Contact the store for help.",
 		"This site isn't ready for sign-in yet.",
 		"Your account needs an email address to sign in.",
 		"Sign-in didn't finish. Try again.",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.12";
+export const VERSION = "0.0.15";