@redeemid/emdash 0.0.16 → 0.0.18

package/src/routes/api/search.ts

@@ -0,0 +1,49 @@
+/**
+ * GET /_emdash/api/auth/redeemid/api/search: the shop's catalog as JSON.
+ *
+ * - ?q=tote&suggest=1 : suggestions while typing { queries, products, collections }
+ * - ?q=tote           : a page of matching products { products, filters, pageInfo, total }
+ * - ?collection=shop  : a page of a collection's products, with its filters
+ *
+ * Paging and filters use the same params as the components: sort, after,
+ * before, filter (Shopify's filter input, repeatable), price_min,
+ * price_max, first (1 to 50). Everything is public catalog data, so answers
+ * may be cached briefly by browsers and CDNs.
+ */
+
+import type { APIRoute } from "astro";
+
+import { browseFromUrl, collectionPage, searchProducts, suggest } from "../../catalog.js";
+import { readConfig, storeDomain } from "../../config.js";
+import { storeContext } from "../../storefront.js";
+import { json } from "./shared.js";
+
+export const prerender = false;
+
+const PUBLIC = "public, max-age=60";
+
+export const GET: APIRoute = async ({ request, locals }) => {
+	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config || !storeDomain(config)) return json(404, { error: "not_configured" });
+	const url = new URL(request.url);
+	const first = Number.parseInt(url.searchParams.get("first") ?? "", 10);
+	const browse = browseFromUrl(url.searchParams, Number.isFinite(first) ? first : 24);
+	const context = storeContext(config, request);
+	// A visitor-country answer differs per visitor.
+	const cache = config.market?.country === "visitor" ? "private, max-age=60" : PUBLIC;
+	try {
+		const handle = (url.searchParams.get("collection") ?? "").trim();
+		if (handle) {
+			if (!/^[a-z0-9][a-z0-9-]*$/i.test(handle)) return json(400, { error: "bad_request" });
+			const page = await collectionPage(config, handle, browse, { context });
+			return page ? json(200, page, cache) : json(404, { error: "not_found" });
+		}
+		if (url.searchParams.get("suggest") === "1") {
+			const limit = Number.parseInt(url.searchParams.get("limit") ?? "6", 10);
+			return json(200, await suggest(config, browse.query, Number.isFinite(limit) ? limit : 6, { context }), cache);
+		}
+		return json(200, await searchProducts(config, browse.query, browse, { context }), cache);
+	} catch {
+		return json(502, { error: "unavailable" });
+	}
+};

package/src/routes/api/shared.ts

@@ -0,0 +1,4 @@
+/** Shared bits of the JSON routes under /_emdash/api/auth/redeemid/api/. */
+
+export const json = (status: number, body: unknown, cache = "private, no-store") =>
+	new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json", "Cache-Control": cache } });

package/src/routes/api/state.ts

@@ -0,0 +1,69 @@
+/**
+ * GET /_emdash/api/auth/redeemid/api/state: the visitor's own state, for the
+ * browser client and other site code.
+ *
+ *   { apiVersion, version, signedIn, linked, levels, features, cart: { count }, meter }
+ *
+ * `levels` and `features` are slugs. Never an email, a name, a customer id
+ * or a Shopify tag. Always private, never cached.
+ */
+
+import type { APIRoute } from "astro";
+
+import { levelsFor, periodKey } from "../../access.js";
+import { API_VERSION } from "../../api-version.js";
+import { readCart } from "../../cart.js";
+import { featuresFor } from "../../features.js";
+import { siteConfig } from "../../site-config.js";
+import { memberForUser, stores } from "../../storage.js";
+import { VERSION } from "../../version.js";
+import { json } from "./shared.js";
+
+export const prerender = false;
+
+export interface State {
+	apiVersion: string;
+	version: string;
+	signedIn: boolean;
+	/** Signed in with a store account RedeemID has synced. */
+	linked: boolean;
+	levels: string[];
+	features: string[];
+	cart: { count: number };
+	meter: { used: number; limit: number; period: "month" | "week" } | null;
+}
+
+export const GET: APIRoute = async ({ locals, session }) => {
+	const config = await siteConfig(locals);
+	const db = (locals as { emdash?: { db?: unknown } }).emdash?.db;
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const ref = await readCart(session);
+	const state: State = {
+		apiVersion: API_VERSION,
+		version: VERSION,
+		signedIn: Boolean(user?.id),
+		linked: false,
+		levels: [],
+		features: [],
+		cart: { count: ref?.count ?? 0 },
+		meter: null,
+	};
+	if (user?.id && db && config) {
+		const s = stores(db);
+		const member = await memberForUser(s, user.id).catch(() => null);
+		if (member) {
+			state.linked = true;
+			if (member.status !== "disabled") {
+				state.levels = levelsFor(member.tags, config.levels);
+				state.features = featuresFor(member, config.features, config.levels);
+			}
+		}
+		const meter = config.meter;
+		if (meter && meter.limit > 0) {
+			const period = meter.period ?? "month";
+			const record = await s.meter.get(`${user.id}:${periodKey(new Date(), period)}`).catch(() => null);
+			state.meter = { used: Math.min(record?.items.length ?? 0, meter.limit), limit: meter.limit, period };
+		}
+	}
+	return json(200, state);
+};

package/src/routes/buy.ts

@@ -14,7 +14,8 @@ import { readConfig, storeDomain } from "../config.js";
 import { safeReturn } from "../access.js";
 import { memberForUser, stores } from "../storage.js";
 import { saveCart, readCart } from "../cart.js";
-import { addToCart, plan } from "../storefront.js";
+import { checkoutFor } from "../checkout.js";
+import { addToCart, plan, storeContext } from "../storefront.js";
 import { fail } from "./shared.js";
 
 export const prerender = false;
@@ -39,10 +40,10 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip") },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context: storeContext(config, request) },
 		);
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
-		return redirect(cart.checkoutUrl, 303);
+		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }), 303);
 	} catch {
 		return fail(redirect, returnTo, "checkout_failed");
 	}

package/src/routes/callback.ts

@@ -14,14 +14,16 @@ import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/
 import type { APIRoute } from "astro";
 import type { Kysely } from "kysely";
 
-import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
+import { env, ENV, PROVIDER_ID, storeDomain } from "../config.js";
+import { siteConfig } from "../site-config.js";
 import { emit, levelChange } from "../events.js";
+import { record } from "../log.js";
 import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
 
-import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
+import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_CUSTOMER_TOKEN, SESSION_ID_TOKEN, type CustomerToken, type Flow } from "./shared.js";
 
 export const prerender = false;
 
@@ -32,19 +34,21 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	session?.delete(SESSION_FLOW);
 	const returnTo = flow?.returnTo ?? "/";
 
-	const config = readConfig(emdash?.config);
+	const config = await siteConfig(locals);
 	const clientId = env(ENV.clientId);
 	if (!config || !storeDomain(config) || !clientId || !emdash?.db || !session) return fail(redirect, returnTo, "not_configured");
 
 	if (url.searchParams.get("error")) {
 		// Refresh found no open store session: sign in as usual.
 		if (flow?.refresh) return redirect(`/_emdash/api/auth/redeemid/login?return=${encodeURIComponent(returnTo)}`);
+		await refused("sign_in_cancelled", "ok");
 		return fail(redirect, returnTo, "sign_in_cancelled");
 	}
 
 	const state = url.searchParams.get("state");
 	const code = url.searchParams.get("code");
 	if (!flow || !state || state !== flow.state || !code || Date.now() - flow.at > FLOW_TTL_MS) {
+		await refused("sign_in_expired", "warn");
 		return fail(redirect, returnTo, "sign_in_expired");
 	}
 
@@ -52,7 +56,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		const options = new OptionsRepository(emdash.db as ConstructorParameters<typeof OptionsRepository>[0]);
 		const setup = await options.get("emdash:setup_complete");
 		// Never let a customer become the first (admin) user.
-		if (setup !== true && setup !== "true") return fail(redirect, returnTo, "site_not_ready");
+		if (setup !== true && setup !== "true") {
+			await refused("site_not_ready", "warn");
+			return fail(redirect, returnTo, "site_not_ready");
+		}
 
 		const d = await discover(config);
 		const tokens = await exchangeCode(d, {
@@ -66,8 +73,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		const claims = await verifyIdToken(d, tokens.idToken, { clientId, nonce: flow.nonce });
 		// Refusals from here on also end the store session, so the next Sign in
 		// asks for an email again instead of reusing this account.
-		const refuse = (code: string) => signedOut(d, tokens.idToken, url, emdash.config, returnTo, code) ?? fail(redirect, returnTo, code);
 		const who = await identity(d, tokens.accessToken);
+		const refuse = async (code: string) => {
+			await refused(code, "warn", who.customerId);
+			return signedOut(d, tokens.idToken, url, emdash.config, returnTo, code) ?? fail(redirect, returnTo, code);
+		};
 
 		const email = (typeof claims.email === "string" ? claims.email : who.email)?.toLowerCase() ?? null;
 		if (!email) return refuse("email_required");
@@ -114,20 +124,28 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		);
 
 		const levels = levelsFor(who.tags, config.levels);
+		await record({ event: "member.signed_in", label: flow.refresh ? "refresh" : member.linkedAt ? "sign-in" : "first sign-in", status: "ok", origin: "member", customerId: who.customerId });
 		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
 		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
 
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
+		session.set(SESSION_CUSTOMER_TOKEN, { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken);
 		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";
 		console.error("[redeemid] sign-in failed:", (e as Error).message);
+		await refused(code, "error", null, String((e as Error).message).slice(0, 200));
 		return fail(redirect, returnTo, code);
 	}
 };
 
+/** A sign-in that didn't finish, for App events: the reason code, never the email. */
+function refused(code: string, level: "ok" | "warn" | "error", customerId: string | null = null, note?: string): Promise<void> {
+	return record({ event: "member.refused", label: code, status: "refused", level, origin: "member", customerId, ...(note ? { note } : {}) });
+}
+
 /** Ends the store session, then shows `code` on `returnTo` (see AFTER_LOGOUT_COOKIE). */
 function signedOut(d: Discovery, idToken: string, url: URL, emdashConfig: unknown, returnTo: string, code: string): Response | null {
 	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);

package/src/routes/cart-edit.ts

@@ -2,95 +2,44 @@
  * POST /_emdash/api/auth/redeemid/cart-edit: change the visitor's Shopify cart.
  *
  * Fields: `action` (add | update | remove | discount), `return`, and
- * - add: `product` (handle), optional `variant` (must be one of that
- *   product's variants, read again from Shopify), `quantity` (1 to 1000),
+ * - add: `product` (handle); the variant by `variant` (an id of that
+ *   product's, read again from Shopify) or by one `option.<Name>` field per
+ *   option (e.g. option.Size=M); `selling_plan` (one of the product's
+ *   selling plans, or empty for one-time); `quantity` (1 to 1000);
  *   `then` = "checkout" to go straight to checkout;
  * - update: `line` and `quantity` (0 removes the line);
  * - remove: `line`;
  * - discount: `code` (empty clears the codes).
  *
- * Prices, discounts and availability come from Shopify; nothing posted is
- * trusted beyond the ids it names. Back to `return` with a notice:
- * cart_added, cart_updated, discount_applied, discount_not_applicable,
- * plan_unavailable, cart_empty or checkout_failed.
+ * Back to `return` with a notice: cart_added, cart_updated,
+ * discount_applied, discount_not_applicable, plan_unavailable, cart_empty or
+ * checkout_failed. The JSON twin is api/cart.
  */
 
 import type { APIRoute } from "astro";
 
 import { safeReturn } from "../access.js";
-import { readCart, saveCart } from "../cart.js";
+import { cartInputFromForm, editCart } from "../cart-ops.js";
+import { checkoutFor } from "../checkout.js";
 import { readConfig, storeDomain } from "../config.js";
-import { memberForUser, stores } from "../storage.js";
-import { addToCart, cartDetails, product, removeLines, setDiscountCodes, updateLines } from "../storefront.js";
 import { fail } from "./shared.js";
 
 export const prerender = false;
 
-const MAX_QUANTITY = 1000;
-
 export const POST: APIRoute = async ({ request, locals, session, redirect }) => {
 	const form = await request.formData().catch(() => null);
-	const field = (k: string) => String(form?.get(k) ?? "").trim();
-	const returnTo = safeReturn(field("return") || "/");
+	const returnTo = safeReturn(String(form?.get("return") ?? "").trim() || "/");
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
 	const config = readConfig(emdash?.config);
 	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
-	const buyerIp = request.headers.get("cf-connecting-ip");
-	const action = field("action");
 
 	try {
-		if (action === "add") {
-			const handle = field("product");
-			const quantity = Number.parseInt(field("quantity") || "1", 10);
-			if (!/^[a-z0-9][a-z0-9-]*$/i.test(handle) || !Number.isFinite(quantity) || quantity < 1 || quantity > MAX_QUANTITY) {
-				return fail(redirect, returnTo, "plan_unavailable");
-			}
-			const p = await product(config, handle);
-			const wanted = field("variant");
-			const variant = wanted ? p?.variants.find((v) => v.id === wanted) : p?.variants.find((v) => v.availableForSale);
-			if (!p || !variant?.availableForSale) return fail(redirect, returnTo, "plan_unavailable");
-			const user = (await session?.get("user")) as { id?: string } | undefined;
-			const member = user?.id && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
-			const current = await readCart(session);
-			const cart = await addToCart(
-				config,
-				current?.id ?? null,
-				{ variantId: variant.id, sellingPlanId: p.sellingPlanId, quantity },
-				{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp },
-			);
-			saveCart(session, { id: cart.id, count: cart.totalQuantity });
-			return field("then") === "checkout" ? redirect(cart.checkoutUrl, 303) : fail(redirect, returnTo, "cart_added");
-		}
-
-		const ref = await readCart(session);
-		if (!ref) return fail(redirect, returnTo, "cart_empty");
-		const cart = await cartDetails(config, ref.id, { buyerIp });
-		if (!cart) {
-			saveCart(session, null);
-			return fail(redirect, returnTo, "cart_empty");
-		}
-		const line = field("line");
-		const owns = cart.lines.some((l) => l.id === line);
-
-		if (action === "update" || action === "remove") {
-			if (!owns) return fail(redirect, returnTo, "cart_updated");
-			const quantity = action === "remove" ? 0 : Number.parseInt(field("quantity"), 10);
-			if (!Number.isFinite(quantity) || quantity < 0 || quantity > MAX_QUANTITY) return fail(redirect, returnTo, "cart_updated");
-			const next = quantity === 0 ? await removeLines(config, cart.id, [line], { buyerIp }) : await updateLines(config, cart.id, [{ id: line, quantity }], { buyerIp });
-			saveCart(session, { id: next.id, count: next.totalQuantity });
-			return fail(redirect, returnTo, "cart_updated");
-		}
-
-		if (action === "discount") {
-			const code = field("code").slice(0, 100);
-			const next = await setDiscountCodes(config, cart.id, code ? [code] : [], { buyerIp });
-			saveCart(session, { id: next.id, count: next.totalQuantity });
-			if (!code) return fail(redirect, returnTo, "cart_updated");
-			const applied = next.discountCodes.find((d) => d.code.toLowerCase() === code.toLowerCase());
-			return fail(redirect, returnTo, applied?.applicable ? "discount_applied" : "discount_not_applicable");
+		const input = { ...cartInputFromForm(form), page: returnTo };
+		const out = await editCart(input, { config, session, request, db: emdash?.db });
+		if (out.base && String(form?.get("then") ?? "") === "checkout") {
+			return redirect(await checkoutFor(config, out.base, { session, request, emdashConfig: emdash?.config }), 303);
 		}
-
-		return fail(redirect, returnTo, "cart_updated");
+		return fail(redirect, returnTo, out.notice);
 	} catch {
 		return fail(redirect, returnTo, "checkout_failed");
 	}

package/src/routes/cart.ts

@@ -1,7 +1,8 @@
 /**
  * GET /_emdash/api/auth/redeemid/cart?return=/path
  *
- * Sends the visitor to their Shopify cart's checkout. With no cart, or one
+ * Sends the visitor to their Shopify cart's checkout, signed in for members
+ * (see checkout.ts). With no cart, or one
  * Shopify has closed (its checkout completed), they go back with the
  * `cart_empty` notice and the stored cart is cleared.
  */
@@ -11,6 +12,7 @@ import type { APIRoute } from "astro";
 import { safeReturn } from "../access.js";
 import { readCart, saveCart } from "../cart.js";
 import { readConfig, storeDomain } from "../config.js";
+import { checkoutFor } from "../checkout.js";
 import { getCart } from "../storefront.js";
 import { fail } from "./shared.js";
 
@@ -30,7 +32,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			return fail(redirect, returnTo, "cart_empty");
 		}
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
-		return redirect(cart.checkoutUrl, 303);
+		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: (locals as { emdash?: { config?: unknown } }).emdash?.config }), 303);
 	} catch {
 		return fail(redirect, returnTo, "checkout_failed");
 	}

package/src/routes/preferences.ts

@@ -13,7 +13,7 @@
 import type { APIRoute } from "astro";
 
 import { safeReturn, signInUrl } from "../access.js";
-import { readConfig } from "../config.js";
+import { siteConfig } from "../site-config.js";
 import { emit } from "../events.js";
 import { allowSave, formValues, PreferenceError, preferenceFields, preferencesConfigured, readPreferences, savePreferences } from "../preferences.js";
 import { memberForUser, stores } from "../storage.js";
@@ -26,7 +26,7 @@ const json = (status: number, body: unknown) =>
 
 async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
-	const config = readConfig(emdash?.config);
+	const config = await siteConfig(locals);
 	if (!config || !preferencesConfigured(config) || !emdash?.db) return { error: "unavailable" as const };
 	const user = (await session?.get("user")) as { id?: string } | undefined;
 	if (!user?.id) return { error: "sign_in" as const, config };

package/src/routes/privacy.ts

@@ -12,7 +12,7 @@ import type { APIRoute } from "astro";
 import { getPublicOrigin } from "emdash/api/route-utils";
 
 import { safeReturn, signInUrl } from "../access.js";
-import { readConfig } from "../config.js";
+import { siteConfig } from "../site-config.js";
 import { eraseMember, exportRequest } from "../privacy.js";
 import { memberForUser, stores } from "../storage.js";
 import { fail } from "./shared.js";
@@ -26,7 +26,7 @@ async function context(locals: unknown, session: { get(k: string): Promise<unkno
 	if (!user?.id) return null;
 	const s = stores(emdash.db);
 	const member = await memberForUser(s, user.id);
-	return member ? { s, member, config: readConfig(emdash.config), emdash } : null;
+	return member ? { s, member, config: await siteConfig(locals), emdash } : null;
 }
 
 export const GET: APIRoute = async ({ locals, session, redirect, url }) => {

package/src/routes/shared.ts

@@ -2,6 +2,17 @@ import { getPublicOrigin } from "emdash/api/route-utils";
 
 export const SESSION_FLOW = "redeemid:flow";
 export const SESSION_ID_TOKEN = "redeemid:id_token";
+/**
+ * The member's Customer Account API tokens, kept only in the server-side
+ * session, to open Shopify's checkout signed in. Never sent to the browser.
+ */
+export const SESSION_CUSTOMER_TOKEN = "redeemid:customer_token";
+
+export interface CustomerToken {
+	accessToken: string;
+	refreshToken: string | null;
+	expiresAt: number | null;
+}
 /** A sign-in started more than this long ago is refused. */
 export const FLOW_TTL_MS = 10 * 60 * 1000;
 

package/src/routes/webhook.ts

@@ -3,15 +3,18 @@
  *
  * Shopify webhooks. Verifies the HMAC over the raw body, drops duplicate
  * deliveries, and updates the member mirror. Storage errors answer 500 so
- * Shopify retries; a failed delivery is never recorded as seen.
+ * Shopify retries; a failed delivery is never recorded as seen. Each delivery,
+ * rejection and failure goes to App events (topic, outcome, customer id).
  */
 
 import type { APIRoute } from "astro";
 
-import { env, ENV, readConfig } from "../config.js";
+import { env, ENV } from "../config.js";
+import { siteConfig } from "../site-config.js";
 import { levelChange } from "../events.js";
 import { stores } from "../storage.js";
-import { apply, kindOf, verifyHmac } from "../webhooks.js";
+import { record } from "../log.js";
+import { apply, customerOf, kindOf, verifyHmac } from "../webhooks.js";
 
 export const prerender = false;
 
@@ -26,9 +29,12 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	if (body.byteLength > MAX_BYTES) return new Response("Too large", { status: 413 });
 
 	const ok = await verifyHmac(body, request.headers.get("x-shopify-hmac-sha256") ?? "", secret);
-	if (!ok) return new Response("Bad signature", { status: 401 });
-
 	const topic = (request.headers.get("x-shopify-topic") ?? "").toLowerCase();
+	if (!ok) {
+		await record({ event: "webhook.rejected", label: topic || "unknown", status: "rejected", level: "warn", origin: "webhook", note: "Bad signature" });
+		return new Response("Bad signature", { status: 401 });
+	}
+
 	const delivery = request.headers.get("x-shopify-event-id") || request.headers.get("x-shopify-webhook-id");
 	if (!kindOf(topic)) return new Response("Ignored", { status: 200 });
 
@@ -36,25 +42,32 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	try {
 		payload = JSON.parse(new TextDecoder().decode(body)) as Record<string, unknown>;
 	} catch {
+		await record({ event: "webhook.rejected", label: topic, status: "bad JSON", level: "warn", origin: "webhook" });
 		return new Response("Bad JSON", { status: 400 });
 	}
 
 	const s = stores(emdash.db);
+	const started = Date.now();
+	const customerId = topic === "shop/redact" ? null : customerOf(payload);
+	const receivedAt = new Date().toISOString();
 	if (delivery) {
-		const claimed = await s.deliveries.compareAndSet(delivery, null, {
-			topic,
-			receivedAt: new Date().toISOString(),
-		});
-		if (!claimed.applied) return new Response("Duplicate", { status: 200 });
+		const claimed = await s.deliveries.compareAndSet(delivery, null, { topic, receivedAt, outcome: "pending", customerId });
+		if (!claimed.applied) {
+			await record({ event: "webhook.received", label: topic, status: "duplicate", origin: "webhook", customerId });
+			return new Response("Duplicate", { status: 200 });
+		}
 	}
 
 	try {
-		const config = readConfig(emdash.config);
+		const config = await siteConfig(locals);
 		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config);
+		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
+		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
 	} catch (e) {
 		console.error("[redeemid] webhook failed:", topic, (e as Error).message);
 		if (delivery) await s.deliveries.delete(delivery).catch(() => undefined);
+		await record({ event: "webhook.failed", label: topic, status: "error", level: "error", origin: "webhook", customerId, ms: Date.now() - started, note: String((e as Error).message).slice(0, 200) });
 		return new Response("Retry", { status: 500 });
 	}
 };