@redeemid/emdash 0.0.15 → 0.0.17

package/src/access.ts

@@ -11,6 +11,7 @@
  */
 
 import type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+import type { EntryRule } from "./settings.js";
 import { siteConfig } from "./site-config.js";
 import { memberForUser, stores, type MemberRecord } from "./storage.js";
 
@@ -108,9 +109,14 @@ function combined(rules: RuleConfig[], mode: "all" | "any"): string[][] {
 	return reduce(rules.map((r) => r.levels));
 }
 
+/** Rules that can cover `collection`: its own, and term rules for every collection ("*"). */
+function rulesFor(rules: RuleConfig[], collection: string): RuleConfig[] {
+	return rules.filter((r) => r.collection === collection || (r.collection === "*" && r.taxonomy && r.term));
+}
+
 /** The rules that decide an entry: matching term rules, else the collection's, else the site default. */
 function deciding(rules: RuleConfig[], collection: string, terms: Terms, tree?: TermTree): RuleConfig[] | "open" {
-	const forCollection = rules.filter((r) => r.collection === collection);
+	const forCollection = rulesFor(rules, collection);
 	const matched: RuleConfig[] = [];
 	for (const [taxonomy, list] of Object.entries(terms)) {
 		const taxRules = forCollection.filter((r) => r.taxonomy === taxonomy && r.term);
@@ -123,7 +129,9 @@ function deciding(rules: RuleConfig[], collection: string, terms: Terms, tree?:
 				seen.add(slug);
 				const own = taxRules.filter((r) => r.term === slug);
 				if (own.length > 0) {
-					matched.push(...own);
+					// A rule for this collection beats one for every collection.
+					const specific = own.filter((r) => r.collection === collection);
+					matched.push(...(specific.length ? specific : own));
 					break;
 				}
 				slug = parents[slug] ?? null;
@@ -132,9 +140,54 @@ function deciding(rules: RuleConfig[], collection: string, terms: Terms, tree?:
 	}
 	if (matched.some((r) => r.open)) return "open";
 	if (matched.length > 0) return matched;
-	const whole = forCollection.filter((r) => !r.taxonomy && !r.term && !r.open);
+	const whole = forCollection.filter((r) => r.collection === collection && !r.taxonomy && !r.term);
+	if (whole.some((r) => r.open)) return "open";
 	if (whole.length > 0) return whole;
-	return rules.filter((r) => r.collection === "*" && !r.taxonomy && !r.term && !r.open);
+	const site = rules.filter((r) => r.collection === "*" && !r.taxonomy && !r.term);
+	if (site.some((r) => r.open)) return "open";
+	return site;
+}
+
+/** Where the site's rules for an entry come from, in words, for the editor. */
+export function ruleSource(rules: RuleConfig[] = [], collection: string, terms: Terms = {}, tree?: TermTree): string {
+	const found = deciding(rules, collection, terms, tree);
+	const termRules = (list: RuleConfig[]) => [...new Set(list.map((r) => `${r.taxonomy}: ${r.term}`))].join(", ");
+	if (found === "open") {
+		const opener = rulesFor(rules, collection).filter((r) => r.open && r.taxonomy);
+		const hit = opener.filter((r) => (terms[r.taxonomy!] ?? []).some((t) => slugOf(t) === r.term));
+		if (hit.length) return `A term that makes it free (${termRules(hit)})`;
+		return rules.some((r) => r.collection === collection && r.open && !r.taxonomy) ? `The rule for ${collection} (free)` : "The site default (free)";
+	}
+	if (found.length === 0) return "No rule covers it";
+	if (found[0]!.taxonomy) return `Terms: ${termRules(found)}`;
+	if (found[0]!.collection === collection) return `The rule for ${collection}`;
+	return "The site default";
+}
+
+/** The entry's own rule (set in the editor), by id or slug. */
+export function entryRuleFor(config: RedeemIDConfig | null, collection: string, id?: string | null): EntryRule | null {
+	if (!config?.entries || !id) return null;
+	return config.entries[`${collection}:${id}`] ?? null;
+}
+
+/**
+ * The site's requirement with the entry's own rule applied (see EntryRule).
+ * `now` decides the date windows.
+ */
+export function applyEntryRule(site: Requirement, own: EntryRule | null, now = Date.now()): Requirement {
+	if (!own) return site;
+	if (own.openUntil && now < Date.parse(own.openUntil)) return null;
+	if (own.lockedUntil && now >= Date.parse(own.lockedUntil)) return null;
+	switch (own.mode) {
+		case "open":
+			return null;
+		case "levels":
+			return [own.levels];
+		case "add":
+			return reduce([...(site ?? []), own.levels]);
+		default:
+			return site;
+	}
 }
 
 /**
@@ -156,14 +209,18 @@ export function requirement(
 }
 
 /** Days of membership the entry's deciding rules ask for (the largest drip), or 0. */
-export function dripDays(rules: RuleConfig[] = [], collection: string, terms: Terms = {}, tree?: TermTree): number {
+export function dripDays(rules: RuleConfig[] = [], collection: string, terms: Terms = {}, tree?: TermTree, own?: EntryRule | null): number {
+	if (own && typeof own.drip === "number" && own.drip > 0) return own.drip;
+	if (own?.mode === "open" || own?.mode === "levels") return 0;
 	const found = deciding(rules, collection, terms, tree);
 	if (found === "open") return 0;
 	return Math.max(0, ...found.map((r) => (typeof r.drip === "number" && r.drip > 0 ? r.drip : 0)));
 }
 
 /** May the meter open the entry? Not when a deciding rule says `meter: false`. */
-export function meterable(rules: RuleConfig[] = [], collection: string, terms: Terms = {}, tree?: TermTree): boolean {
+export function meterable(rules: RuleConfig[] = [], collection: string, terms: Terms = {}, tree?: TermTree, own?: EntryRule | null): boolean {
+	if (own?.meter === false) return false;
+	if (own?.mode === "levels") return true;
 	const found = deciding(rules, collection, terms, tree);
 	return found === "open" || !found.some((r) => r.meter === false);
 }
@@ -229,7 +286,7 @@ export function membership(member: MemberRecord, levels: LevelConfig[] = []): {
 /** How much of this period's meter the signed-in reader has used, or null when no meter runs. */
 export async function meterUsage(astro: AstroLike): Promise<{ used: number; limit: number; period: "month" | "week" } | null> {
 	const locals = astro.locals as Locals;
-	const meter = siteConfig(locals.emdash?.config)?.meter;
+	const meter = (await siteConfig(locals))?.meter;
 	const user = locals.user;
 	const db = locals.emdash?.db;
 	if (!meter || !(meter.limit > 0) || !user?.id || !db) return null;
@@ -291,7 +348,7 @@ export function describe(required: Requirement, levels: LevelConfig[] = [], open
  */
 export async function termTree(rules: RuleConfig[] = [], collection: string, terms: Terms = {}): Promise<TermTree> {
 	const tree: TermTree = {};
-	const forCollection = rules.filter((r) => r.collection === collection && r.taxonomy && r.term);
+	const forCollection = rulesFor(rules, collection).filter((r) => r.taxonomy && r.term);
 	const wanted = Object.entries(terms).filter(([taxonomy, list]) => {
 		const own = new Set(forCollection.filter((r) => r.taxonomy === taxonomy).map((r) => r.term));
 		return own.size > 0 && (list ?? []).some((t) => !own.has(slugOf(t)));
@@ -316,15 +373,21 @@ export async function termTree(rules: RuleConfig[] = [], collection: string, ter
 	return tree;
 }
 
-/** The entry's requirement with the site's config, walking term parents. */
+/**
+ * The entry's requirement with the site's config, walking term parents. With
+ * `id` (EmDash's id or the slug), the entry's own rule from the editor applies.
+ */
 export async function entryRequirement(
 	config: RedeemIDConfig | null,
 	collection: string,
 	terms: Terms = {},
+	id?: string | null,
 ): Promise<Requirement> {
 	if (!config) return null;
+	const own = entryRuleFor(config, collection, id);
+	if (own && (own.mode === "open" || own.mode === "levels") && !own.openUntil && !own.lockedUntil) return applyEntryRule(null, own);
 	const tree = await termTree(config.rules, collection, terms);
-	return requirement(config.rules, collection, terms, { combine: config.combine, tree });
+	return applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own);
 }
 
 const viewers = new WeakMap<object, Promise<Viewer>>();
@@ -354,7 +417,7 @@ async function readViewer(astro: AstroLike): Promise<Viewer> {
 	// Member-specific output must never be shared by a cache.
 	astro.response?.headers.set("Cache-Control", "private, no-store");
 
-	const config = siteConfig(locals.emdash?.config);
+	const config = await siteConfig(locals);
 	const db = locals.emdash?.db;
 	if (!config || !db) return { signedIn: true, member: null, levels: [] };
 
@@ -369,16 +432,16 @@ async function readViewer(astro: AstroLike): Promise<Viewer> {
  */
 export async function canRead(
 	astro: AstroLike,
-	entry: { collection: string; terms?: Terms },
+	entry: { collection: string; terms?: Terms; id?: string; ruleId?: string },
 	override?: { levels: string[] } | { required: string[][] },
 ): Promise<Verdict> {
 	const locals = astro.locals as Locals;
-	const config: RedeemIDConfig | null = siteConfig(locals.emdash?.config);
+	const config: RedeemIDConfig | null = await siteConfig(locals);
 	const required: Requirement = override
 		? "required" in override
 			? override.required
 			: [override.levels]
-		: await entryRequirement(config, entry.collection, entry.terms);
+		: await entryRequirement(config, entry.collection, entry.terms, entry.ruleId ?? entry.id);
 	const v = await viewer(astro);
 
 	if (required === null) return { allowed: true, reason: "open", required: [], viewer: v };
@@ -426,17 +489,18 @@ export function signOutUrl(returnTo = "/"): string {
  */
 export async function readEntry(
 	astro: AstroLike,
-	entry: { collection: string; terms?: Terms; id?: string },
+	entry: { collection: string; terms?: Terms; id?: string; ruleId?: string },
 	override?: { required: string[][] },
 ): Promise<Verdict> {
 	const verdict = await canRead(astro, entry, override);
 	const locals = astro.locals as Locals;
-	const config = siteConfig(locals.emdash?.config);
+	const config = await siteConfig(locals);
 	if (!config) return verdict;
 
 	if (verdict.allowed && verdict.reason === "allowed" && verdict.viewer.member) {
+		const own = entryRuleFor(config, entry.collection, entry.ruleId ?? entry.id);
 		const tree = await termTree(config.rules, entry.collection, entry.terms);
-		const days = dripDays(config.rules, entry.collection, entry.terms, tree);
+		const days = dripDays(config.rules, entry.collection, entry.terms, tree, own);
 		const opensAt = dripOpensAt(memberSince(verdict.viewer.member, config.levels), days);
 		if (days > 0 && (!opensAt || opensAt.getTime() > Date.now())) {
 			return { ...verdict, allowed: false, reason: "drip", opensAt: opensAt ?? undefined };
@@ -458,7 +522,7 @@ export async function readEntry(
 	) {
 		return verdict;
 	}
-	if (!meterable(config.rules, entry.collection, entry.terms, await termTree(config.rules, entry.collection, entry.terms))) {
+	if (!meterable(config.rules, entry.collection, entry.terms, await termTree(config.rules, entry.collection, entry.terms), entryRuleFor(config, entry.collection, entry.ruleId ?? entry.id))) {
 		return verdict;
 	}
 	const period = meter.period ?? "month";
@@ -473,6 +537,8 @@ export async function readEntry(
 			await s.meter.put(key, { ...record, items: used.items });
 			const { emit } = await import("./events.js");
 			const data = { userId: user.id, entry: `${entry.collection}:${entry.id}`, used: used.items.length, limit: meter.limit, period: record.period };
+			const { record: log } = await import("./log.js");
+			await log({ event: used.left === 0 ? "meter.exhausted" : "meter.used", label: entry.collection, status: used.left === 0 ? "used up" : `${used.left} left`, origin: "member" });
 			await emit(config, "meter.used", data);
 			if (used.left === 0) await emit(config, "meter.exhausted", data);
 		}

package/src/admin-api.ts

@@ -12,6 +12,7 @@
 import { env, ENV, shopOrigin, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
 import { cleanTags, emptyMember, stampTags, type MemberRecord, type Stores } from "./storage.js";
+import { timed } from "./log.js";
 
 export const ADMIN_API_VERSION = "2026-10";
 
@@ -68,7 +69,13 @@ export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch
 	return (await token(config, fetcher)).scope;
 }
 
-export async function admin<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown> = {}, fetcher: typeof fetch = fetch, retry = true): Promise<T> {
+/** One Admin API call, recorded under App events by its operation name (never its variables or answer). */
+export async function admin<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown> = {}, fetcher: typeof fetch = fetch): Promise<T> {
+	const op = (/(?:query|mutation)\s+(\w+)/.exec(query)?.[1] ?? "query").replace(/^RedeemID/, "") || "query";
+	return timed("shopify.admin", op, () => call<T>(config, query, variables, fetcher, true));
+}
+
+async function call<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown>, fetcher: typeof fetch, retry: boolean): Promise<T> {
 	const t = await token(config, fetcher);
 	const res = await fetcher(`${shopOrigin(config)}/admin/api/${ADMIN_API_VERSION}/graphql.json`, {
 		method: "POST",
@@ -77,7 +84,7 @@ export async function admin<T>(config: RedeemIDConfig, query: string, variables:
 	});
 	if (res.status === 401 && retry) {
 		tokens.delete(shopOrigin(config));
-		return admin(config, query, variables, fetcher, false);
+		return call(config, query, variables, fetcher, false);
 	}
 	const body = (await res.json().catch(() => ({}))) as { data?: T; errors?: Array<{ message?: string }> };
 	if (!res.ok || !body.data) throw new AdminError(body.errors?.[0]?.message ?? `Admin API request failed (${res.status}).`);

package/src/agents.ts

@@ -10,7 +10,7 @@
  */
 
 import { adminConfigured } from "./admin-api.js";
-import { describe as describeRequirement, dripDays, levelsFor, membership, passes, requirement, termTree, type Requirement, type Terms } from "./access.js";
+import { applyEntryRule, entryRuleFor, describe as describeRequirement, dripDays, levelsFor, membership, passes, requirement, termTree, type Requirement, type Terms } from "./access.js";
 import { ENV, env, storeDomain, unknownEnvNames, type RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
 import { bodyClauses } from "./files.js";
@@ -42,6 +42,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 	let terms: Terms = input.terms ?? {};
 	let parts: string[][] = [];
 	let entry: { id: string; title: string | null } | null = null;
+	let own: ReturnType<typeof entryRuleFor> = null;
 	let item: SoldItem | null = null;
 	if (input.id) {
 		const { getEmDashEntry } = await import("emdash");
@@ -53,6 +54,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 		parts = bodyClauses(body);
 		item = soldItem(body);
 		entry = { id: String(result?.entry?.id ?? input.id), title: typeof data.title === "string" ? data.title : null };
+		own = entryRuleFor(config, collection, typeof data.id === "string" ? data.id : null) ?? entryRuleFor(config, collection, input.id);
 	}
 
 	let tags = cleanTags(input.tags ?? []);
@@ -67,7 +69,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 	const disabled = member?.status === "disabled";
 	const held = disabled ? [] : levelsFor(tags, levels);
 	const tree = await termTree(config.rules, collection, terms);
-	const required: Requirement = requirement(config.rules, collection, terms, { combine: config.combine, tree });
+	const required: Requirement = applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own);
 	const owned = !disabled && holdsItem(item, tags);
 	const canReadRule = owned || required === null || (signedIn && !disabled && passes(held, required));
 	const name = (slug: string) => levels.find((l) => l.slug === slug)?.name ?? slug;
@@ -90,7 +92,8 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 		canRead: canReadRule,
 		reason: canReadRule ? "allowed" : !signedIn ? "sign_in" : disabled ? "disabled" : "upgrade",
 		offered: !canReadRule && missing ? name(missing[0] as string) : null,
-		dripDays: owned ? 0 : dripDays(config.rules, collection, terms, tree),
+		dripDays: owned ? 0 : dripDays(config.rules, collection, terms, tree, own),
+		entryRule: own ? { mode: own.mode, levels: own.levels.map(name), drip: own.drip ?? 0, neverMetered: own.meter === false, lockedUntil: own.lockedUntil ?? null, openUntil: own.openUntil ?? null } : null,
 		soldOnItsOwn: item ? { tag: item.tag, product: item.product, held: owned } : null,
 		parts: partResults,
 		note: "Drip and the meter depend on the member's dates and use, so they can still change what the page shows.",
@@ -109,6 +112,7 @@ export function getRules(config: RedeemIDConfig): Record<string, unknown> {
 		teaser: config.teaser ?? {},
 		features: config.features ?? [],
 		files: config.files ?? [],
+		entries: Object.values(config.entries ?? {}).filter((e, i, all) => all.findIndex((x) => x.entryId === e.entryId) === i),
 	};
 }
 

package/src/astro-modules.d.ts

@@ -2,3 +2,7 @@ declare module "*.astro" {
 	const Component: (props: Record<string, unknown>) => unknown;
 	export default Component;
 }
+
+declare module "cloudflare:workers" {
+	export const env: unknown;
+}

package/src/components/AccessBadge.astro

@@ -3,7 +3,7 @@
  * The level an entry needs, read from its rules (and from a paywall break
  * with levels):
  *
- *   <AccessBadge collection="posts" terms={post.data.terms} content={post.data.content} />
+ *   <AccessBadge collection="posts" terms={post.data.terms} content={post.data.content} id={post.id} />
  *
  * Open entries show `free` ("Free"; pass free="" to show nothing). The badge
  * carries `data-redeemid-level` (the level slugs) for styling, and
@@ -19,21 +19,23 @@ interface Props {
 	terms?: Terms;
 	/** The entry's body, so a paywall break's levels count. */
 	content?: unknown[] | null;
+	/** The entry's id or slug, so its own rule from the editor counts. */
+	id?: string;
 	free?: string;
 	class?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
-const { collection, terms, content, free = text(config, "Free"), class: className } = Astro.props;
+const config = await siteConfig(Astro.locals);
+const { collection, terms, content, id, free = text(config, "Free"), class: className } = Astro.props;
 const split = splitAtPaywall(content);
 const required = split.paywall && split.levels.length
 	? [split.levels]
-	: await entryRequirement(config, collection, terms);
+	: await entryRequirement(config, collection, terms, id);
 const label = describe(required, config?.levels, free, text(config, "Signed in"));
 const item = soldItem(content);
 const owner = item ? (await viewer(Astro)).member : null;
 const owned = Boolean(owner && owner.status !== "disabled" && holdsItem(item, owner.tags));
-const locked = required !== null && !owned && !(await canRead(Astro, { collection, terms }, { required })).allowed;
+const locked = required !== null && !owned && !(await canRead(Astro, { collection, terms, id }, { required })).allowed;
 const slugs = required?.flat().join(" ") || (required ? "signed-in" : "free");
 ---
 

package/src/components/Account.astro

@@ -7,7 +7,7 @@ import { accountUrl, signInUrl, signOutUrl, viewer } from "../access.js";
 import { text } from "../text.js";
 
 const v = await viewer(Astro);
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const here = Astro.url.pathname + Astro.url.search;
 const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).map((l) => l.name);
 ---

package/src/components/Cart.astro

@@ -12,7 +12,7 @@ interface Props {
 	label?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { label = text(config, "Cart") } = Astro.props;
 const ref = await readCart(Astro.session);
 const count = ref?.count ?? 0;

package/src/components/CartView.astro

@@ -20,7 +20,7 @@ interface Props {
 	empty?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { productHref, empty = text(config, "Your cart is empty.") } = Astro.props;
 const ref = await readCart(Astro.session);
 let cart: CartDetails | null = null;

package/src/components/Collection.astro

@@ -21,7 +21,7 @@ interface Props {
 }
 
 const { handle, limit = 12, productHref, showTitle = false } = Astro.props;
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 let c: Collection | null = null;
 if (config) {
 	try {

package/src/components/Content.astro

@@ -20,6 +20,10 @@
  *
  * Readers kept out get the wall (LockedPanel), with the "locked" slot on top.
  *
+ * `id` (the entry's id or slug) also applies the entry's own rule from the
+ * editor's Access panel; pass it in lists too when entries have their own
+ * rules.
+ *
  * Pass `id` on the entry's own page so drip and the meter apply: a rule's
  * `drip` keeps it shut until the member has held their level that many days,
  * and config `meter` lets signed-in readers open a few locked entries each
@@ -50,8 +54,8 @@ interface Props {
 
 const { value, collection = "", terms, id, title } = Astro.props;
 const split = splitAtPaywall(value);
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
-const entryRule = await entryRequirement(config, collection, terms);
+const config = await siteConfig(Astro.locals);
+const entryRule = await entryRequirement(config, collection, terms, id);
 // Bought on its own: the whole entry, no meter, no drip.
 const item = soldItem(value);
 const reader = item ? (await viewer(Astro)).member : null;
@@ -78,7 +82,7 @@ async function parts(blocks: unknown[]) {
 			continue;
 		}
 		const needs = section.levels.length ? [section.levels] : (entryRule ?? [[]]);
-		out.push({ blocks: section.blocks, verdict: await canRead(Astro, { collection, terms }, { required: needs }) });
+		out.push({ blocks: section.blocks, verdict: await canRead(Astro, { collection, terms, id }, { required: needs }) });
 	}
 	return out;
 }

package/src/components/Contribution.astro

@@ -21,7 +21,7 @@ interface Props {
 	title?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { handle, amounts = [5, 10, 25], initial = 10, label = text(config, "Give"), title } = Astro.props;
 let p: Product | null = null;
 if (config) {

package/src/components/Gate.astro

@@ -17,10 +17,12 @@ interface Props {
 	collection?: string;
 	terms?: Terms;
 	levels?: string[];
+	/** The entry's id or slug, so its own rule from the editor counts. */
+	id?: string;
 }
 
-const { collection = "", terms, levels } = Astro.props;
-const verdict = await canRead(Astro, { collection, terms }, levels ? { levels } : undefined);
+const { collection = "", terms, levels, id } = Astro.props;
+const verdict = await canRead(Astro, { collection, terms, id }, levels ? { levels } : undefined);
 ---
 
 {verdict.allowed ? (

package/src/components/LockedPanel.astro

@@ -33,7 +33,7 @@ const { reason, required = [], held = [], opensAt, meterLeft, meterPeriod, item
 const opens = opensAt
 	? new Intl.DateTimeFormat("en-US", { dateStyle: "long", timeZone: "UTC" }).format(opensAt)
 	: null;
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const missing = required.find((clause) => clause.length > 0 && !passes(held, [clause]));
 const level = missing ? config?.levels?.find((l) => l.slug === missing[0]) : undefined;
 const joinHref = level?.joinUrl ?? config?.join?.href;

package/src/components/MemberCard.astro

@@ -19,7 +19,7 @@ interface Props {
 	title?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { title = text(config, "Your membership") } = Astro.props;
 const v = await viewer(Astro);
 const here = Astro.url.pathname + Astro.url.search;

package/src/components/Notices.astro

@@ -17,6 +17,7 @@ const DEFAULTS: Record<string, string> = {
 	sign_in_expired: "That sign-in took too long. Try again.",
 	staff_account: "This account can't sign in here. Use a different email.",
 	account_disabled: "Your account is turned off. Contact the store for help.",
+	too_many_requests: "Too many tries. Wait a minute, then try again.",
 	site_not_ready: "This site isn't ready for sign-in yet.",
 	email_required: "Your account needs an email address to sign in.",
 	token_failed: "Sign-in didn't finish. Try again.",
@@ -40,7 +41,7 @@ const DEFAULTS: Record<string, string> = {
 
 const { messages = {} } = Astro.props;
 const code = Astro.url.searchParams.get("redeemid_notice") ?? "";
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const fallback = DEFAULTS[code];
 const text = code ? (messages[code] ?? (fallback ? replace(config, fallback) : undefined)) : undefined;
 ---

package/src/components/Plan.astro

@@ -25,7 +25,7 @@ interface Props {
 	heldLabel?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { handle, label = text(config, "Join"), title, levels = [], heldLabel = text(config, "You're on this plan.") } = Astro.props;
 let p: Plan | null = null;
 if (config) {

package/src/components/Preferences.astro

@@ -20,7 +20,7 @@ interface Props {
 	label?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { title = text(config, "Your preferences"), heading = "h2", label = text(config, "Save preferences") } = Astro.props;
 const v = await viewer(Astro);
 const m = v.member;

package/src/components/Product.astro

@@ -21,7 +21,7 @@ interface Props {
 	buyLabel?: string;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { handle, heading = "h2", compact = false, addLabel = text(config, "Add to cart"), buyLabel = text(config, "Buy now") } = Astro.props;
 let p: Product | null = null;
 if (config) {

package/src/components/YourData.astro

@@ -16,7 +16,7 @@ interface Props {
 	heading?: "h2" | "h3" | "h4";
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { title = text(config, "Your data"), heading = "h2" } = Astro.props;
 const v = await viewer(Astro);
 const route = "/_emdash/api/auth/redeemid/privacy";

package/src/config.ts

@@ -1,10 +1,14 @@
 /**
  * RedeemID configuration.
  *
- * Levels and rules live in code (astro.config.mjs), so they are versioned with
- * the site. Secrets come from the environment and never from config.
+ * Levels and rules can be set in code (astro.config.mjs) as the site's
+ * defaults, and changed in the admin (Plugins → RedeemID → Access), which
+ * wins for each setting it saves (see settings.ts). Secrets come from the
+ * environment and never from config.
  */
 
+import type { EntryRule } from "./settings.js";
+
 /** A member level, held by Shopify customers with its tags. */
 export interface LevelConfig {
 	/** Stable slug, used in rules (e.g. "member"). */
@@ -26,9 +30,11 @@ export interface LevelConfig {
  *
  * - A rule with `taxonomy` and `term` covers entries that carry that term, or
  *   a child of it in a hierarchical taxonomy (a child's own rule wins over its
- *   parent's).
+ *   parent's). With `collection: "*"` it covers that term in every
+ *   collection; a rule for the same term and a named collection wins there.
  * - A rule with neither covers the whole collection.
- * - `collection: "*"` is the site default, for collections with no rule.
+ * - `collection: "*"` with neither is the site default, for collections with
+ *   no rule.
  *
  * Term rules beat the collection rule, which beats the site default. When
  * several term rules cover one entry, a reader must pass every one of them
@@ -44,7 +50,8 @@ export interface RuleConfig {
 	/** Level slugs, any of which may read. An empty list means any signed-in member. */
 	levels: string[];
 	/**
-	 * A term rule that opens its entries to everyone, whatever else covers them
+	 * Opens the entries to everyone: a term rule whatever else covers them, a
+	 * collection rule or the site default unless a term rule locks them.
 	 * `levels` is ignored.
 	 */
 	open?: boolean;
@@ -161,6 +168,11 @@ export interface RedeemIDConfig {
 	 * under /_emdash is refused to Subscribers (see guard.ts).
 	 */
 	memberPaths?: string[];
+	/**
+	 * Entries' own rules by "collection:id" (or "collection:slug"). Usually set
+	 * in the editor's Access panel rather than here.
+	 */
+	entries?: Record<string, EntryRule>;
 	/**
 	 * Only for local tests: lets `shop` be a full http:// origin of a fake store.
 	 * Never set this on a live site.

package/src/descriptor.ts

@@ -10,10 +10,16 @@ import { VERSION } from "./version.js";
 
 export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
+	{ path: "/access", label: "Access", icon: "lock" },
+	{ path: "/webhooks", label: "Webhooks", icon: "pulse" },
+	{ path: "/events", label: "App events", icon: "list" },
+	{ path: "/reports", label: "Reports", icon: "chart" },
 	{ path: "/status", label: "Status", icon: "pulse" },
 	{ path: "/test", label: "Access test", icon: "search" },
 	{ path: "/privacy", label: "Privacy", icon: "lock" },
 ];
+/** The Access panel on every saved entry, in every collection (new ones too). */
+export const EDITOR_PANELS = [{ id: "access", title: "Access", route: "access-panel", order: 10 }];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 
 /** The descriptor for `emdash({ plugins: [...] })`. Pass the same config as `redeemid()`. */
@@ -26,6 +32,7 @@ export function redeemidPlugin(config: RedeemIDConfig): PluginDescriptor<RedeemI
 		options: config,
 		adminPages: PAGES,
 		adminWidgets: WIDGETS,
+		editorPanels: EDITOR_PANELS,
 	};
 }
 

package/src/events.ts

@@ -14,6 +14,7 @@
 
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
+import { record } from "./log.js";
 
 export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased";
 
@@ -46,9 +47,11 @@ export async function emit(config: RedeemIDConfig | null, name: EventName, data:
 			body,
 			signal: AbortSignal.timeout(TIMEOUT_MS),
 		});
+		if (!res.ok) await record({ event: "events.failed", label: name, status: `HTTP ${res.status}`, level: "warn", origin: "site" });
 		return res.ok;
 	} catch (e) {
 		console.error("[redeemid] event not sent:", name, (e as Error).message);
+		await record({ event: "events.failed", label: name, status: "error", level: "error", origin: "site", note: String((e as Error).message).slice(0, 200) });
 		return false;
 	}
 }

package/src/features.ts

@@ -32,7 +32,7 @@ export async function hasFeature(astro: AstroLike, slug: string): Promise<boolea
 
 /** The visitor's features. */
 export async function viewerFeatures(astro: AstroLike): Promise<string[]> {
-	const config = siteConfig((astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+	const config = await siteConfig(astro.locals);
 	if (!config?.features?.length) return [];
 	const v = await viewer(astro);
 	return featuresFor(v.member, config.features, config.levels);