@redeemid/emdash 0.0.16 → 0.0.18

package/src/components/Product.astro

@@ -1,72 +1,163 @@
 ---
 /**
- * A Shopify product: image, title, price, description, a variant choice
- * when it has several, a quantity, and "Add to cart" and "Buy now".
- * Everything comes from the Storefront API; the default slot shows if the
- * product can't be loaded.
+ * A Shopify product: images, title, price (with the sale price when there
+ * is one), description, a picker per option (Size, Color…), a choice of
+ * one-time or subscription when the product has selling plans, a quantity,
+ * and "Add to cart" and "Buy now". Everything comes from the Storefront
+ * API; the default slot shows if the product can't be loaded.
  *
- *   <Product handle="harbor-tote" />
+ *   <Product handle="harbor-tote" heading="h1" />
+ *
+ * The form works without JavaScript (the server picks the variant from the
+ * options). With <RedeemIDClient /> on the page the price, image and stock
+ * follow the choice as it changes, and with <CartDrawer /> Add to cart opens
+ * the drawer in place.
+ *
+ * On a product's own page (heading "h1") it prints Product structured data
+ * for search engines; `schema={false}` turns that off.
  */
 import { siteConfig } from "../site-config.js";
-import { money, product as loadProduct, type Product } from "../storefront.js";
+import { money, product as loadProduct, realOptions, storeContext, type Product } from "../storefront.js";
 import { text } from "../text.js";
 
 interface Props {
 	handle: string;
 	/** Heading level for the title. */
 	heading?: "h1" | "h2" | "h3";
-	/** Leave out the description (for cards). */
+	/** Leave out the description and gallery (for cards). */
 	compact?: boolean;
 	addLabel?: string;
 	buyLabel?: string;
+	/** Show Shopify's HTML description (as the merchant wrote it) instead of the plain text. */
+	html?: boolean;
+	/** Product structured data. Defaults to on for heading "h1". */
+	schema?: boolean;
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
-const { handle, heading = "h2", compact = false, addLabel = text(config, "Add to cart"), buyLabel = text(config, "Buy now") } = Astro.props;
+const config = await siteConfig(Astro.locals);
+const { handle, heading = "h2", compact = false, html = false, addLabel = text(config, "Add to cart"), buyLabel = text(config, "Buy now") } = Astro.props;
+const context = storeContext(config, Astro.request);
 let p: Product | null = null;
 if (config) {
 	try {
-		p = await loadProduct(config, handle);
+		p = await loadProduct(config, handle, undefined, context);
 	} catch {
 		p = null;
 	}
 }
+if (context.country && config?.market?.country === "visitor") Astro.response.headers.set("Vary", "CF-IPCountry");
+const options = p ? realOptions(p) : [];
 const available = p?.variants.filter((v) => v.availableForSale) ?? [];
 const first = available[0] ?? p?.variants[0];
+const chosen = Object.fromEntries((first?.selectedOptions ?? []).map((o) => [o.name, o.value]));
+const plans = p?.sellingPlans ?? [];
+const sale = first?.compareAtPrice && Number(first.compareAtPrice.amount) > Number(first.price.amount) ? first.compareAtPrice : null;
+const image = first?.image ?? p?.image ?? null;
+const images = p?.images ?? (p?.image ? [p.image] : []);
 const here = Astro.url.pathname + Astro.url.search;
 const Heading = heading;
 const id = `redeemid-product-${handle}`;
+const variants = (p?.variants ?? []).map((v) => ({
+	id: v.id,
+	available: v.availableForSale,
+	price: money(v.price) ?? "",
+	compareAt: v.compareAtPrice && Number(v.compareAtPrice.amount) > Number(v.price.amount) ? (money(v.compareAtPrice) ?? "") : "",
+	image: v.image?.url ?? null,
+	imageAlt: v.image?.altText ?? "",
+	options: Object.fromEntries((v.selectedOptions ?? []).map((o) => [o.name, o.value])),
+}));
+const json = (v: unknown) => JSON.stringify(v).replace(/</g, "\\u003c");
+const showSchema = (Astro.props.schema ?? heading === "h1") && config?.schema !== false && p;
+const schema =
+	showSchema && p
+		? json({
+				"@context": "https://schema.org",
+				"@type": "Product",
+				name: p.title,
+				description: p.description || undefined,
+				image: images.map((i) => i.url),
+				brand: p.vendor ? { "@type": "Brand", name: p.vendor } : undefined,
+				url: new URL(Astro.url.pathname, Astro.url).href,
+				offers: p.variants.map((v) => ({
+					"@type": "Offer",
+					price: v.price.amount,
+					priceCurrency: v.price.currencyCode,
+					availability: v.availableForSale ? "https://schema.org/InStock" : "https://schema.org/OutOfStock",
+					sku: v.sku || undefined,
+					name: v.title !== "Default Title" ? v.title : undefined,
+				})),
+			})
+		: null;
 ---
 
 {p ? (
 	<div class="redeemid-product" data-redeemid-product={p.handle}>
-		{p.image && <img class="redeemid-product__image" src={p.image.url} alt={p.image.altText ?? ""} loading="lazy" />}
+		{schema && <script type="application/ld+json" set:html={schema} />}
+		{image && <img class="redeemid-product__image" src={image.url} alt={image.altText ?? ""} loading={heading === "h1" ? "eager" : "lazy"} data-redeemid-product-image />}
+		{!compact && images.length > 1 && (
+			<ul class="redeemid-product__thumbs">
+				{images.map((img, i) => (
+					<li>
+						<button type="button" data-redeemid-thumb={img.url} data-redeemid-alt={img.altText ?? ""} aria-pressed={String(i === 0)}>
+							<img src={img.url} alt={img.altText || text(config, "Image {number} of {count}", { number: i + 1, count: images.length })} loading="lazy" />
+						</button>
+					</li>
+				))}
+			</ul>
+		)}
 		<Heading class="redeemid-product__title">{p.title}</Heading>
-		{first && <p class="redeemid-product__price">{money(first.price)}</p>}
-		{!compact && p.description && <p class="redeemid-product__description">{p.description}</p>}
+		<p class="redeemid-product__price">
+			<span data-redeemid-price>{first && money(first.price)}</span>
+			<s class="redeemid-product__compare-at" data-redeemid-compare-at hidden={!sale}>{sale && money(sale)}</s>
+		</p>
+		{!compact && (html && p.descriptionHtml ? <div class="redeemid-product__description" set:html={p.descriptionHtml} /> : p.description && <p class="redeemid-product__description">{p.description}</p>)}
 		{available.length > 0 ? (
-			<form method="post" action="/_emdash/api/auth/redeemid/cart-edit">
+			<form method="post" action="/_emdash/api/auth/redeemid/cart-edit" data-redeemid-product-form>
 				<input type="hidden" name="action" value="add" />
 				<input type="hidden" name="product" value={p.handle} />
 				<input type="hidden" name="return" value={here} />
-				{p.variants.length > 1 ? (
-					<p>
-						<label for={`${id}-variant`}>{text(config, "Option")}</label>
-						<select id={`${id}-variant`} name="variant">
-							{p.variants.map((v) => (
-								<option value={v.id} disabled={!v.availableForSale}>
-									{text(config, v.availableForSale ? "{option} ({price})" : "{option} ({price}) sold out", { option: v.title, price: money(v.price) })}
-								</option>
-							))}
-						</select>
-					</p>
+				{options.length > 0 ? (
+					<>
+						<script type="application/json" data-redeemid-variants set:html={json(variants)} />
+						{options.map((o, i) => (
+							<p class="redeemid-product__option">
+								<label for={`${id}-option-${i}`}>{o.name}</label>
+								<select id={`${id}-option-${i}`} name={`option.${o.name}`}>
+									{o.values.map((value) => (
+										<option value={value} selected={chosen[o.name] === value} disabled={options.length === 1 && !p.variants.some((v) => v.availableForSale && v.selectedOptions?.some((x) => x.name === o.name && x.value === value))}>
+											{value}
+										</option>
+									))}
+								</select>
+							</p>
+						))}
+					</>
 				) : (
 					<input type="hidden" name="variant" value={first?.id} />
 				)}
+				{plans.length > 0 && (
+					<fieldset class="redeemid-product__plans">
+						<legend>{text(config, "Purchase options")}</legend>
+						{!p.requiresSellingPlan && (
+							<p>
+								<input type="radio" id={`${id}-plan-none`} name="selling_plan" value="" checked />
+								<label for={`${id}-plan-none`}>{text(config, "One-time purchase")}</label>
+							</p>
+						)}
+						{plans.map((sp, i) => (
+							<p>
+								<input type="radio" id={`${id}-plan-${i}`} name="selling_plan" value={sp.id} checked={p.requiresSellingPlan && i === 0} />
+								<label for={`${id}-plan-${i}`}>{sp.group && sp.group !== sp.name ? text(config, "{group}: {plan}", { group: sp.group, plan: sp.name }) : sp.name}</label>
+							</p>
+						))}
+					</fieldset>
+				)}
 				<p>
 					<label for={`${id}-quantity`}>{text(config, "Quantity")}</label>
 					<input id={`${id}-quantity`} name="quantity" type="number" min="1" max="1000" value="1" inputmode="numeric" />
 				</p>
+				<p class="redeemid-product__availability" role="status" data-redeemid-availability></p>
+				<p class="redeemid-product__form-status" role="status" data-redeemid-form-status></p>
 				<button type="submit" name="then" value="back">{addLabel}</button>
 				<button type="submit" name="then" value="checkout">{buyLabel}</button>
 			</form>

package/src/components/ProductGrid.astro

@@ -0,0 +1,52 @@
+---
+/**
+ * Product cards in a grid: image, title, lowest price (with the sale price
+ * when there is one). Used by <Collection>, <ProductSearch> and
+ * <Recommendations>; use it for your own lists of Storefront products.
+ *
+ * `quickAdd` puts Add to cart on cards whose product has one variant and
+ * needs no choice.
+ */
+import { siteConfig } from "../site-config.js";
+import { money, type ProductCard } from "../storefront.js";
+import { text } from "../text.js";
+
+interface Props {
+	products: ProductCard[];
+	/** Link for each product; `{handle}` is replaced. */
+	productHref?: string;
+	/** Heading level of each card's title. */
+	heading?: "h2" | "h3" | "h4";
+	quickAdd?: boolean;
+}
+
+const { products, productHref, heading = "h3", quickAdd = false } = Astro.props;
+const config = await siteConfig(Astro.locals);
+const href = (h: string) => productHref?.replaceAll("{handle}", encodeURIComponent(h));
+const here = Astro.url.pathname + Astro.url.search;
+const Heading = heading;
+---
+
+<ul class="redeemid-collection__grid">
+	{products.map((p) => (
+		<li class="redeemid-collection__item" data-redeemid-product={p.handle}>
+			{p.image && <img src={p.image.url} alt={p.image.altText ?? ""} loading="lazy" />}
+			<Heading>{href(p.handle) ? <a href={href(p.handle)}>{p.title}</a> : p.title}</Heading>
+			<p class="redeemid-collection__price">
+				{p.availableForSale ? (p.price ? text(config, "From {price}", { price: money(p.price) }) : "") : text(config, "Sold out")}
+				{p.availableForSale && p.compareAtPrice && <s class="redeemid-collection__compare-at">{money(p.compareAtPrice)}</s>}
+			</p>
+			{quickAdd && p.quickAddVariantId && (
+				<form method="post" action="/_emdash/api/auth/redeemid/cart-edit">
+					<input type="hidden" name="action" value="add" />
+					<input type="hidden" name="product" value={p.handle} />
+					<input type="hidden" name="variant" value={p.quickAddVariantId} />
+					<input type="hidden" name="return" value={here} />
+					<button type="submit" name="then" value="back">
+						{text(config, "Add to cart")}<span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap"> {p.title}</span>
+					</button>
+				</form>
+			)}
+		</li>
+	))}
+</ul>

package/src/components/ProductSearch.astro

@@ -0,0 +1,83 @@
+---
+/**
+ * Product search for a search page: a search box, Shopify's matching
+ * products with its filters, sort orders and paging, all from the page URL
+ * (?q=…), so the page must be rendered on demand. With <RedeemIDClient />
+ * the box also suggests products as the visitor types.
+ *
+ *   <ProductSearch productHref="/shop/{handle}/" />
+ *
+ * `boxOnly` renders just the search box (for a header), sending searches to
+ * `action`, the search page's path.
+ */
+import { browseFromUrl, searchProducts, type ProductPage } from "../catalog.js";
+import { siteConfig } from "../site-config.js";
+import { storeContext } from "../storefront.js";
+import { text } from "../text.js";
+import BrowseControls from "./BrowseControls.astro";
+import ProductGrid from "./ProductGrid.astro";
+
+interface Props {
+	productHref?: string;
+	/** Products per page, 1 to 50. */
+	limit?: number;
+	/** Only the search box. */
+	boxOnly?: boolean;
+	/** Where searches go. Defaults to this page. */
+	action?: string;
+	label?: string;
+	quickAdd?: boolean;
+}
+
+const config = await siteConfig(Astro.locals);
+const { productHref, limit = 24, boxOnly = false, action = Astro.url.pathname, label = text(config, "Search products"), quickAdd = false } = Astro.props;
+const browse = browseFromUrl(Astro.url.searchParams, limit);
+let page: ProductPage | null = null;
+let failed = false;
+if (!boxOnly && config && browse.query) {
+	try {
+		page = await searchProducts(config, browse.query, browse, { context: storeContext(config, Astro.request) });
+	} catch {
+		failed = true;
+	}
+}
+const id = boxOnly ? "redeemid-search-box" : "redeemid-search";
+---
+
+<section class="redeemid-search" role="search">
+	<form method="get" action={action} class="redeemid-search__form">
+		<label for={`${id}-q`}>{label}</label>
+		<input
+			id={`${id}-q`}
+			name="q"
+			type="search"
+			value={boxOnly ? "" : browse.query}
+			autocomplete="off"
+			maxlength="200"
+			data-redeemid-suggest
+			data-redeemid-product-href={productHref}
+			aria-controls={`${id}-suggestions`}
+			aria-expanded="false"
+		/>
+		<button type="submit">{text(config, "Search")}</button>
+		<ul id={`${id}-suggestions`} class="redeemid-search__suggestions" hidden></ul>
+		<p style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap" role="status" data-redeemid-suggest-status></p>
+	</form>
+	{!boxOnly && browse.query && (
+		failed ? (
+			<p>{text(config, "Search isn't available right now. Try again in a few minutes.")}</p>
+		) : page && (
+			<>
+				<p class="redeemid-search__count" role="status">
+					{page.products.length === 0
+						? text(config, "No products match “{query}”.", { query: browse.query })
+						: (page.total ?? page.products.length) === 1
+							? text(config, "1 result for “{query}”", { query: browse.query })
+							: text(config, "{count} results for “{query}”", { count: page.total ?? page.products.length, query: browse.query })}
+				</p>
+				{(page.products.length > 0 || page.filters.length > 0) && <BrowseControls filters={page.filters} pageInfo={page.pageInfo} search query={browse.query} id={id} />}
+				<ProductGrid products={page.products} productHref={productHref} heading="h2" quickAdd={quickAdd} />
+			</>
+		)
+	)}
+</section>

package/src/components/Recommendations.astro

@@ -0,0 +1,45 @@
+---
+/**
+ * Shopify's product recommendations under a product: "related" (You may also
+ * like) or "complementary" (Pair it with, set in the Search & Discovery
+ * app). Renders nothing when Shopify has none.
+ *
+ *   <Recommendations handle="harbor-tote" productHref="/shop/{handle}/" />
+ */
+import { recommendations } from "../catalog.js";
+import { siteConfig } from "../site-config.js";
+import { product, storeContext, type ProductCard } from "../storefront.js";
+import { text } from "../text.js";
+import ProductGrid from "./ProductGrid.astro";
+
+interface Props {
+	handle: string;
+	intent?: "related" | "complementary";
+	/** Up to 10. */
+	limit?: number;
+	productHref?: string;
+	title?: string;
+	quickAdd?: boolean;
+}
+
+const config = await siteConfig(Astro.locals);
+const { handle, intent = "related", limit = 4, productHref, quickAdd = false } = Astro.props;
+const title = Astro.props.title ?? text(config, intent === "complementary" ? "Pair it with" : "You may also like");
+let cards: ProductCard[] = [];
+if (config) {
+	try {
+		const context = storeContext(config, Astro.request);
+		const p = await product(config, handle, undefined, context);
+		if (p?.id) cards = (await recommendations(config, p.id, intent, { context })).slice(0, Math.max(1, Math.min(10, limit)));
+	} catch {
+		cards = [];
+	}
+}
+---
+
+{cards.length > 0 && (
+	<section class="redeemid-recommendations" aria-labelledby={`redeemid-recs-${handle}`}>
+		<h2 id={`redeemid-recs-${handle}`}>{title}</h2>
+		<ProductGrid products={cards} productHref={productHref} quickAdd={quickAdd} />
+	</section>
+)}

package/src/components/RedeemIDClient.astro

@@ -0,0 +1,45 @@
+---
+/**
+ * The browser client, window.redeemid. Put it once in the site layout
+ * (before </body>). See docs/developer-api.md for what it offers.
+ *
+ *   <RedeemIDClient />
+ */
+import { API_VERSION } from "../api-version.js";
+import { NOTICES } from "../notices.js";
+import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
+import { VERSION } from "../version.js";
+
+const config = await siteConfig(Astro.locals);
+const boot = {
+	version: VERSION,
+	apiVersion: API_VERSION,
+	base: "/_emdash/api/auth/redeemid",
+	locale: "en-US",
+	notices: Object.fromEntries(Object.entries(NOTICES).map(([code, message]) => [code, text(config, message)])),
+	strings: {
+		"Your cart is empty.": text(config, "Your cart is empty."),
+		"Loading your cart…": text(config, "Loading your cart…"),
+		"{price} each · {total}": text(config, "{price} each · {total}"),
+		Quantity: text(config, "Quantity"),
+		Update: text(config, "Update"),
+		Remove: text(config, "Remove"),
+		"Discount code": text(config, "Discount code"),
+		Apply: text(config, "Apply"),
+		"{code} doesn't apply to this cart.": text(config, "{code} doesn't apply to this cart."),
+		Subtotal: text(config, "Subtotal"),
+		Total: text(config, "Total"),
+		"Taxes and shipping are worked out at checkout.": text(config, "Taxes and shipping are worked out at checkout."),
+		Checkout: text(config, "Checkout"),
+		"Sold out.": text(config, "Sold out."),
+		"Not available in this combination.": text(config, "Not available in this combination."),
+		"{count} suggestions": text(config, "{count} suggestions"),
+	},
+};
+---
+
+<script type="application/json" id="redeemid-client-config" set:html={JSON.stringify(boot).replace(/</g, "\\u003c")} />
+<script>
+	import "../client/redeemid.ts";
+</script>

package/src/components/YourData.astro

@@ -16,7 +16,7 @@ interface Props {
 	heading?: "h2" | "h3" | "h4";
 }
 
-const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const config = await siteConfig(Astro.locals);
 const { title = text(config, "Your data"), heading = "h2" } = Astro.props;
 const v = await viewer(Astro);
 const route = "/_emdash/api/auth/redeemid/privacy";

package/src/config.ts

@@ -1,10 +1,14 @@
 /**
  * RedeemID configuration.
  *
- * Levels and rules live in code (astro.config.mjs), so they are versioned with
- * the site. Secrets come from the environment and never from config.
+ * Levels and rules can be set in code (astro.config.mjs) as the site's
+ * defaults, and changed in the admin (Plugins → RedeemID → Access), which
+ * wins for each setting it saves (see settings.ts). Secrets come from the
+ * environment and never from config.
  */
 
+import type { EntryRule } from "./settings.js";
+
 /** A member level, held by Shopify customers with its tags. */
 export interface LevelConfig {
 	/** Stable slug, used in rules (e.g. "member"). */
@@ -26,9 +30,11 @@ export interface LevelConfig {
  *
  * - A rule with `taxonomy` and `term` covers entries that carry that term, or
  *   a child of it in a hierarchical taxonomy (a child's own rule wins over its
- *   parent's).
+ *   parent's). With `collection: "*"` it covers that term in every
+ *   collection; a rule for the same term and a named collection wins there.
  * - A rule with neither covers the whole collection.
- * - `collection: "*"` is the site default, for collections with no rule.
+ * - `collection: "*"` with neither is the site default, for collections with
+ *   no rule.
  *
  * Term rules beat the collection rule, which beats the site default. When
  * several term rules cover one entry, a reader must pass every one of them
@@ -44,7 +50,8 @@ export interface RuleConfig {
 	/** Level slugs, any of which may read. An empty list means any signed-in member. */
 	levels: string[];
 	/**
-	 * A term rule that opens its entries to everyone, whatever else covers them
+	 * Opens the entries to everyone: a term rule whatever else covers them, a
+	 * collection rule or the site default unless a term rule locks them.
 	 * `levels` is ignored.
 	 */
 	open?: boolean;
@@ -137,6 +144,20 @@ export interface RedeemIDConfig {
 	 * { "Sign in": "Log in" }. One string at a time; see text.ts for the list.
 	 */
 	text?: Record<string, string>;
+	/**
+	 * Local prices and currency through Shopify Markets: `country` is a fixed
+	 * two-letter code, or "visitor" for the country Cloudflare reports for
+	 * each request (CF-IPCountry). `language` is a Shopify language code such
+	 * as "FR". Prices are always Shopify's; leave this out for the store's
+	 * default market.
+	 */
+	market?: { country?: string; language?: string };
+	/**
+	 * Checkout. `signIn: false` stops RedeemID passing a signed-in member's
+	 * store sign-in to the cart, so they check out as a guest (their email is
+	 * still filled in).
+	 */
+	checkout?: { signIn?: false };
 	/** The wall's join link: where readers become members, e.g. { href: "/join/", label: "Become a member" }. */
 	join?: { href: string; label?: string };
 	/**
@@ -161,6 +182,11 @@ export interface RedeemIDConfig {
 	 * under /_emdash is refused to Subscribers (see guard.ts).
 	 */
 	memberPaths?: string[];
+	/**
+	 * Entries' own rules by "collection:id" (or "collection:slug"). Usually set
+	 * in the editor's Access panel rather than here.
+	 */
+	entries?: Record<string, EntryRule>;
 	/**
 	 * Only for local tests: lets `shop` be a full http:// origin of a fake store.
 	 * Never set this on a live site.

package/src/contract.ts

@@ -0,0 +1,50 @@
+/**
+ * The developer API, as a list: what site code, other plugins and agents may
+ * rely on. docs/developer-api.md is the readable version, and
+ * tests/contract.test.ts fails when the code, this list and that page
+ * disagree.
+ *
+ * - Everything here is stable: it changes only with a changelog entry and an
+ *   API_VERSION bump (minor when added, major when changed or removed).
+ *   Before 1.0.0 of the package a breaking change can still happen, but
+ *   never silently.
+ * - Anything not listed is internal, even when a module exports it.
+ */
+
+export { API_VERSION } from "./api-version.js";
+
+/** Stable exports, by import path. */
+export const MODULES = {
+	"@redeemid/emdash": ["redeemid", "redeemidGuard", "redeemidPlugin"],
+	"@redeemid/emdash/access": ["viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
+	"@redeemid/emdash/features": ["hasFeature", "viewerFeatures", "featuresFor"],
+	"@redeemid/emdash/preferences": ["readPreferences", "savePreferences", "preferenceFields"],
+	"@redeemid/emdash/storefront": ["plan", "product", "collection", "money", "realOptions", "variantFor", "storeContext", "cartDetails", "addToCart", "updateLines", "removeLines", "setDiscountCodes"],
+	"@redeemid/emdash/catalog": ["searchProducts", "collectionPage", "suggest", "recommendations", "browseFromUrl", "browseHref", "parseFilters", "priceFilter", "SORTS"],
+	"@redeemid/emdash/events": ["signBody"],
+	"@redeemid/emdash/text": ["STRINGS", "text", "textParts"],
+} as const;
+
+/** Public JSON routes under /_emdash/api/auth/redeemid/. */
+export const JSON_ROUTES = ["api/state", "api/cart", "api/search", "preferences", "privacy"] as const;
+
+/** Form routes under /_emdash/api/auth/redeemid/ (each redirects back with a notice). */
+export const FORM_ROUTES = ["login", "callback", "logout", "webhook", "buy", "cart", "cart-edit", "account"] as const;
+
+/** window.redeemid members. */
+export const CLIENT = ["version", "apiVersion", "events", "subscribe", "emit", "state", "refresh", "signIn", "signOut", "cart", "openCart", "closeCart", "search", "suggest", "collection"] as const;
+
+/** window.redeemid.cart members. */
+export const CLIENT_CART = ["get", "add", "update", "remove", "discount", "checkout"] as const;
+
+/** Browser events, in the order of window.redeemid.events. */
+export const CLIENT_EVENTS = ["ready", "state", "wall_shown", "metered_view", "sign_in_click", "checkout_click", "cart_changed", "cart_opened", "search"] as const;
+
+/** Signed outbound server events (events.ts). */
+export const SERVER_EVENTS = ["member.signed_in", "member.levels_changed", "meter.used", "meter.exhausted", "preferences.saved", "member.erased"] as const;
+
+/** MCP tools, always offered (read-only). */
+export const MCP_TOOLS = ["explain_access", "list_levels", "get_rules", "get_member", "site_health", "level_changes", "find_products", "get_product", "get_collection"] as const;
+
+/** MCP tools offered only with config agents.actions. */
+export const MCP_ACTIONS = ["resync_member", "resync_batch", "edit_member_tags"] as const;

package/src/descriptor.ts

@@ -10,10 +10,16 @@ import { VERSION } from "./version.js";
 
 export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
+	{ path: "/access", label: "Access", icon: "lock" },
+	{ path: "/webhooks", label: "Webhooks", icon: "pulse" },
+	{ path: "/events", label: "App events", icon: "list" },
+	{ path: "/reports", label: "Reports", icon: "chart" },
 	{ path: "/status", label: "Status", icon: "pulse" },
 	{ path: "/test", label: "Access test", icon: "search" },
 	{ path: "/privacy", label: "Privacy", icon: "lock" },
 ];
+/** The Access panel on every saved entry, in every collection (new ones too). */
+export const EDITOR_PANELS = [{ id: "access", title: "Access", route: "access-panel", order: 10 }];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 
 /** The descriptor for `emdash({ plugins: [...] })`. Pass the same config as `redeemid()`. */
@@ -26,6 +32,7 @@ export function redeemidPlugin(config: RedeemIDConfig): PluginDescriptor<RedeemI
 		options: config,
 		adminPages: PAGES,
 		adminWidgets: WIDGETS,
+		editorPanels: EDITOR_PANELS,
 	};
 }
 

package/src/events.ts

@@ -14,6 +14,7 @@
 
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
+import { record } from "./log.js";
 
 export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased";
 
@@ -46,9 +47,11 @@ export async function emit(config: RedeemIDConfig | null, name: EventName, data:
 			body,
 			signal: AbortSignal.timeout(TIMEOUT_MS),
 		});
+		if (!res.ok) await record({ event: "events.failed", label: name, status: `HTTP ${res.status}`, level: "warn", origin: "site" });
 		return res.ok;
 	} catch (e) {
 		console.error("[redeemid] event not sent:", name, (e as Error).message);
+		await record({ event: "events.failed", label: name, status: "error", level: "error", origin: "site", note: String((e as Error).message).slice(0, 200) });
 		return false;
 	}
 }

package/src/features.ts

@@ -32,7 +32,7 @@ export async function hasFeature(astro: AstroLike, slug: string): Promise<boolea
 
 /** The visitor's features. */
 export async function viewerFeatures(astro: AstroLike): Promise<string[]> {
-	const config = siteConfig((astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+	const config = await siteConfig(astro.locals);
 	if (!config?.features?.length) return [];
 	const v = await viewer(astro);
 	return featuresFor(v.member, config.features, config.levels);

package/src/files.ts

@@ -101,7 +101,7 @@ async function readsWhole(astro: AstroLike, entry: { collection: string; id: str
 		const m = (await viewer(astro)).member;
 		if (m && m.status !== "disabled" && holdsItem(item, m.tags)) return true;
 	}
-	const verdict = await readEntry(astro, { collection: entry.collection, terms });
+	const verdict = await readEntry(astro, { collection: entry.collection, terms, ruleId: entry.id });
 	if (!verdict.allowed) return false;
 	const clauses = bodyClauses(body);
 	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === "signed-in" && verdict.viewer.signedIn)));

package/src/guard.ts

@@ -25,7 +25,7 @@ import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
 import { keysFromPath, pathAccess, refusal } from "./files.js";
 import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
-import { siteConfig } from "./site-config.js";
+import { shareConfig, siteConfig } from "./site-config.js";
 
 const SUBSCRIBER = 10;
 
@@ -55,7 +55,9 @@ async function withUser(context: { locals: unknown; session?: { get(k: string):
 	const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
 	const user = await createKyselyAdapter(locals.emdash.db as never).getUserById(sessionUser.id);
 	if (!user || user.disabled) return context;
-	return { ...context, locals: { ...locals, user: { id: user.id, role: user.role, disabled: user.disabled } } };
+	const next = { ...locals, user: { id: user.id, role: user.role, disabled: user.disabled } };
+	shareConfig(locals, next);
+	return { ...context, locals: next };
 }
 
 /** Keep one visitor's response out of every shared cache, the route cache included. */
@@ -75,7 +77,7 @@ export function keepPrivate(context: { cache?: { set(options: false): void } },
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { locals, url } = context;
 	const user = (locals as { user?: { role?: number } | null }).user;
-	const config = siteConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	const config = await siteConfig(locals);
 
 	// Protected files: checked for everyone, on every download.
 	const keys = config?.files?.length ? keysFromPath(url.pathname) : null;