@redeemid/emdash 0.0.17 → 0.0.19

package/src/config.ts

@@ -144,6 +144,20 @@ export interface RedeemIDConfig {
 	 * { "Sign in": "Log in" }. One string at a time; see text.ts for the list.
 	 */
 	text?: Record<string, string>;
+	/**
+	 * Local prices and currency through Shopify Markets: `country` is a fixed
+	 * two-letter code, or "visitor" for the country Cloudflare reports for
+	 * each request (CF-IPCountry). `language` is a Shopify language code such
+	 * as "FR". Prices are always Shopify's; leave this out for the store's
+	 * default market.
+	 */
+	market?: { country?: string; language?: string };
+	/**
+	 * Checkout. `signIn: false` stops RedeemID passing a signed-in member's
+	 * store sign-in to the cart, so they check out as a guest (their email is
+	 * still filled in).
+	 */
+	checkout?: { signIn?: false };
 	/** The wall's join link: where readers become members, e.g. { href: "/join/", label: "Become a member" }. */
 	join?: { href: string; label?: string };
 	/**

package/src/contract.ts

@@ -0,0 +1,50 @@
+/**
+ * The developer API, as a list: what site code, other plugins and agents may
+ * rely on. docs/developer-api.md is the readable version, and
+ * tests/contract.test.ts fails when the code, this list and that page
+ * disagree.
+ *
+ * - Everything here is stable: it changes only with a changelog entry and an
+ *   API_VERSION bump (minor when added, major when changed or removed).
+ *   Before 1.0.0 of the package a breaking change can still happen, but
+ *   never silently.
+ * - Anything not listed is internal, even when a module exports it.
+ */
+
+export { API_VERSION } from "./api-version.js";
+
+/** Stable exports, by import path. */
+export const MODULES = {
+	"@redeemid/emdash": ["redeemid", "redeemidGuard", "redeemidPlugin"],
+	"@redeemid/emdash/access": ["viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
+	"@redeemid/emdash/features": ["hasFeature", "viewerFeatures", "featuresFor"],
+	"@redeemid/emdash/preferences": ["readPreferences", "savePreferences", "preferenceFields"],
+	"@redeemid/emdash/storefront": ["plan", "product", "collection", "money", "realOptions", "variantFor", "storeContext", "cartDetails", "addToCart", "updateLines", "removeLines", "setDiscountCodes"],
+	"@redeemid/emdash/catalog": ["searchProducts", "collectionPage", "suggest", "recommendations", "browseFromUrl", "browseHref", "parseFilters", "priceFilter", "SORTS"],
+	"@redeemid/emdash/events": ["signBody"],
+	"@redeemid/emdash/text": ["STRINGS", "text", "textParts"],
+} as const;
+
+/** Public JSON routes under /_emdash/api/auth/redeemid/. */
+export const JSON_ROUTES = ["api/state", "api/cart", "api/search", "preferences", "privacy"] as const;
+
+/** Form routes under /_emdash/api/auth/redeemid/ (each redirects back with a notice). */
+export const FORM_ROUTES = ["login", "callback", "logout", "webhook", "buy", "cart", "cart-edit", "account"] as const;
+
+/** window.redeemid members. */
+export const CLIENT = ["version", "apiVersion", "events", "subscribe", "emit", "state", "refresh", "signIn", "signOut", "cart", "openCart", "closeCart", "search", "suggest", "collection"] as const;
+
+/** window.redeemid.cart members. */
+export const CLIENT_CART = ["get", "add", "update", "remove", "discount", "checkout"] as const;
+
+/** Browser events, in the order of window.redeemid.events. */
+export const CLIENT_EVENTS = ["ready", "state", "wall_shown", "metered_view", "sign_in_click", "checkout_click", "cart_changed", "cart_opened", "search"] as const;
+
+/** Signed outbound server events (events.ts). */
+export const SERVER_EVENTS = ["member.signed_in", "member.levels_changed", "meter.used", "meter.exhausted", "preferences.saved", "member.erased"] as const;
+
+/** MCP tools, always offered (read-only). */
+export const MCP_TOOLS = ["explain_access", "list_levels", "get_rules", "get_member", "site_health", "level_changes", "find_products", "get_product", "get_collection"] as const;
+
+/** MCP tools offered only with config agents.actions. */
+export const MCP_ACTIONS = ["resync_member", "resync_batch", "edit_member_tags"] as const;

package/src/files.ts

@@ -118,7 +118,8 @@ export async function fileAccess(astro: AstroLike, config: RedeemIDConfig | null
 	if (!config?.files?.length) return { protected: false };
 	const locals = astro.locals as { user?: { role?: number } | null; emdash?: { db?: unknown } | null };
 	const db = locals.emdash?.db;
-	if (!db) return { protected: false };
+	// No database to look the file up in: the caller fails closed.
+	if (!db) throw new Error("no database for the file check");
 	const media = await mediaByKey(db, key);
 	const rule = ruleFor(config, media?.folder ?? null);
 	if (!media || !rule) return { protected: false };
@@ -162,12 +163,49 @@ export function keysFromPath(pathname: string): string[] | null {
 			break;
 		}
 		out.push(decoded);
+		// The file route drops slashes around the key, so the check does too.
+		const trimmed = decoded.replace(/^\/+|\/+$/g, "");
+		if (trimmed && trimmed !== decoded) out.push(trimmed);
 		if (decoded === candidate) break;
 		candidate = decoded;
 	}
 	return [...new Set(out)];
 }
 
+/** Astro's image endpoint, which reads the file its `href` names and answers with it. */
+export const IMAGE_PATH = "/_image";
+
+/**
+ * The storage keys a request could reach: a file URL's own, or those of the
+ * file an image-endpoint request asks for by `href`. Null when it names none.
+ */
+export function keysFromUrl(url: URL): string[] | null {
+	const direct = keysFromPath(url.pathname);
+	if (direct) return direct;
+	if (url.pathname.replace(/\/+$/, "") !== IMAGE_PATH) return null;
+	const out: string[] = [];
+	for (const href of url.searchParams.getAll("href")) {
+		let candidate = href;
+		for (let layer = 0; layer < 4; layer++) {
+			try {
+				const keys = keysFromPath(new URL(candidate, url.origin).pathname);
+				if (keys) out.push(...keys);
+			} catch {
+				// Not a URL: nothing to check.
+			}
+			let decoded: string;
+			try {
+				decoded = decodeURIComponent(candidate);
+			} catch {
+				break;
+			}
+			if (decoded === candidate) break;
+			candidate = decoded;
+		}
+	}
+	return out.length ? [...new Set(out)] : null;
+}
+
 /** Decide a download that may name several keys: the first protected one decides. */
 export async function pathAccess(astro: AstroLike, config: RedeemIDConfig | null, keys: string[]): Promise<FileVerdict> {
 	for (const key of keys) {

package/src/guard.ts

@@ -23,7 +23,7 @@ import { defineMiddleware } from "astro:middleware";
 
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
-import { keysFromPath, pathAccess, refusal } from "./files.js";
+import { keysFromUrl, pathAccess, refusal } from "./files.js";
 import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { shareConfig, siteConfig } from "./site-config.js";
 
@@ -49,7 +49,14 @@ export function memberMayUse(path: string, extra: string[] = []): boolean {
  */
 async function withUser(context: { locals: unknown; session?: { get(k: string): Promise<unknown> } }) {
 	const locals = context.locals as { user?: { id: string; role?: number } | null; emdash?: { db?: unknown } | null };
-	if (locals.user || !locals.emdash?.db) return context;
+	if (!locals.emdash?.db) {
+		// EmDash leaves the database off some public requests: fetch it, so the check can run.
+		const { getDb } = await import("emdash/runtime");
+		const next = { ...locals, emdash: { ...(locals.emdash ?? {}), db: await getDb() } };
+		shareConfig(locals, next);
+		return withUser({ ...context, locals: next });
+	}
+	if (locals.user) return context;
 	const sessionUser = (await context.session?.get("user")) as { id?: string } | undefined;
 	if (!sessionUser?.id) return context;
 	const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
@@ -80,7 +87,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const config = await siteConfig(locals);
 
 	// Protected files: checked for everyone, on every download.
-	const keys = config?.files?.length ? keysFromPath(url.pathname) : null;
+	const keys = config?.files?.length ? keysFromUrl(url) : null;
 	if (keys) {
 		let verdict;
 		try {

package/src/index.ts

@@ -60,6 +60,9 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
 			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
 			{ pattern: `${BASE}/preferences`, entrypoint: "@redeemid/emdash/routes/preferences.ts" },
 			{ pattern: `${BASE}/privacy`, entrypoint: "@redeemid/emdash/routes/privacy.ts" },
+			{ pattern: `${BASE}/api/state`, entrypoint: "@redeemid/emdash/routes/api/state.ts" },
+			{ pattern: `${BASE}/api/cart`, entrypoint: "@redeemid/emdash/routes/api/cart.ts" },
+			{ pattern: `${BASE}/api/search`, entrypoint: "@redeemid/emdash/routes/api/search.ts" },
 		],
 		publicRoutes: [`${BASE}/`],
 		storage: STORAGE_CONFIG,

package/src/log.ts

@@ -10,6 +10,7 @@
 import type { StorageCollection } from "emdash";
 
 export const LOG_DAYS = 30;
+const PRUNE_PAGES = 5;
 
 export type LogOrigin = "webhook" | "member" | "staff" | "agent" | "cron" | "site";
 
@@ -90,7 +91,13 @@ export async function timed<T>(event: string, label: string, run: () => Promise<
 /** Delete entries (and other dated records) older than `days`, a page at a time. */
 export async function prune<T>(store: StorageCollection<T>, field: string, days = LOG_DAYS): Promise<number> {
 	const before = new Date(Date.now() - days * 86_400_000).toISOString();
-	const { items } = await store.query({ where: { [field]: { lt: before } }, limit: 100 });
-	if (items.length === 0) return 0;
-	return store.deleteMany(items.map((i) => i.id));
+	let gone = 0;
+	// A few pages a run: enough to keep up with a busy site, few enough queries for one request.
+	for (let page = 0; page < PRUNE_PAGES; page++) {
+		const { items } = await store.query({ where: { [field]: { lt: before } }, limit: 100 });
+		if (items.length === 0) break;
+		gone += await store.deleteMany(items.map((i) => i.id));
+		if (items.length < 100) break;
+	}
+	return gone;
 }

package/src/notices.ts

@@ -0,0 +1,29 @@
+/** The message for each `redeemid_notice` code (also what the browser client shows in the cart drawer). */
+
+export const NOTICES: Record<string, string> = {
+	not_configured: "Sign-in isn't set up on this site yet.",
+	sign_in_unavailable: "Sign-in isn't available right now. Try again in a few minutes.",
+	sign_in_expired: "That sign-in took too long. Try again.",
+	staff_account: "This account can't sign in here. Use a different email.",
+	account_disabled: "Your account is turned off. Contact the store for help.",
+	too_many_requests: "Too many tries. Wait a minute, then try again.",
+	site_not_ready: "This site isn't ready for sign-in yet.",
+	email_required: "Your account needs an email address to sign in.",
+	token_failed: "Sign-in didn't finish. Try again.",
+	bad_id_token: "Sign-in didn't finish. Try again.",
+	identity_failed: "Sign-in didn't finish. Try again.",
+	plan_unavailable: "That plan isn't available right now.",
+	checkout_failed: "Checkout didn't open. Try again.",
+	cart_empty: "Your cart is empty.",
+	cart_added: "Added to your cart.",
+	cart_updated: "Your cart is updated.",
+	discount_applied: "Discount applied.",
+	discount_not_applicable: "That discount code doesn't apply to this cart.",
+	refreshed: "Your membership is up to date.",
+	preferences_saved: "Your preferences are saved.",
+	preferences_refused: "Some answers weren't saved. Check them and try again.",
+	preferences_unavailable: "Your preferences can't be saved right now. Try again in a few minutes.",
+	data_erased: "Your data on this site is deleted, and you're signed out.",
+	erase_unconfirmed: "Tick the box to confirm, then try again.",
+	account_unavailable: "Your account page isn't available right now. Try again in a few minutes.",
+};

package/src/plugin.ts

@@ -43,7 +43,7 @@ import { textProblems } from "./text.js";
 import { record } from "./log.js";
 import { eventsPage, healthCheck, HEALTH_TASK, lastCheck, parseFilter, reportsPage, saveMonitor, WEBHOOK_PATH, WEBHOOK_TABS, webhooksPage, type MonitorEnv, type WebhookTab } from "./monitor.js";
 import { z } from "astro/zod";
-import { AgentError, explainAccess, getMember, getRules, levelChanges, listLevels, siteHealth, type ExplainInput } from "./agents.js";
+import { AgentError, explainAccess, findProducts, getCollection, getMember, getProduct, getRules, levelChanges, listLevels, siteHealth, type ExplainInput } from "./agents.js";
 
 import {
 	COLLECTION_BLOCK,
@@ -55,9 +55,10 @@ import {
 	PLAN_BLOCK,
 	PREFERENCES_BLOCK,
 	PRODUCT_BLOCK,
+	SEARCH_BLOCK,
 } from "./blocks-names.js";
 
-export { COLLECTION_BLOCK, CONTRIBUTION_BLOCK, ITEM_BLOCK, MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK, PREFERENCES_BLOCK, PRODUCT_BLOCK };
+export { COLLECTION_BLOCK, CONTRIBUTION_BLOCK, ITEM_BLOCK, MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK, PREFERENCES_BLOCK, PRODUCT_BLOCK, SEARCH_BLOCK };
 
 /**
  * The editor's level pickers. Declared once when the plugin starts, then kept
@@ -157,6 +158,26 @@ function blocks(config: RedeemIDConfig) {
 				{ type: "text_input" as const, action_id: "handle", label: "Shopify collection handle", placeholder: "shop" },
 				{ type: "text_input" as const, action_id: "limit", label: "How many products (up to 50)", placeholder: "12" },
 				{ type: "text_input" as const, action_id: "link", label: "Product page link, with {handle}", placeholder: "/shop/{handle}/" },
+				{
+					type: "checkbox" as const,
+					action_id: "extras",
+					label: "Extras",
+					options: [
+						{ label: "Filters, sorting and pages (the page must render on demand)", value: "browse" },
+						{ label: "Add to cart on cards that need no choice", value: "quick-add" },
+					],
+				},
+			],
+		},
+		{
+			type: SEARCH_BLOCK,
+			label: "Product search",
+			icon: "search",
+			description: "A search box with Shopify's matching products, filters and sorting",
+			placeholder: "Product search",
+			fields: [
+				{ type: "text_input" as const, action_id: "link", label: "Product page link, with {handle}", placeholder: "/shop/{handle}/" },
+				{ type: "text_input" as const, action_id: "label", label: "Search box label", placeholder: "Search products" },
 			],
 		},
 		{
@@ -369,6 +390,9 @@ function agentRoutes(code: RedeemIDConfig) {
 		"get-member": route(MEMBER, (s, i) => getMember(config, s, i as { customerId?: string; email?: string })),
 		"site-health": route(EMPTY, (s) => siteHealth(config, s)),
 		"level-changes": route(CHANGES, (s, i) => levelChanges(config, s, i as { since: string; level?: string })),
+		"find-products": route(FIND, (_s, i) => findProducts(config, i as { query: string; first?: number })),
+		"get-product": route(HANDLE, (_s, i) => getProduct(config, i as { handle: string })),
+		"get-collection": route(COLLECTION, (_s, i) => getCollection(config, i as { handle: string; first?: number })),
 	};
 	if (!code.agents?.actions) return read;
 	return {
@@ -402,6 +426,9 @@ const EXPLAIN = z.object({
 const MEMBER = z.object({ customerId: z.string().optional(), email: z.string().optional() });
 const CUSTOMER = z.object({ customerId: z.string().min(1).describe("Shopify customer id") });
 const CHANGES = z.object({ since: z.string().describe("A date, e.g. 2026-11-01"), level: z.string().optional().describe("Only this level slug") });
+const FIND = z.object({ query: z.string().min(1).describe("Search words, e.g. tote"), first: z.number().int().min(1).max(25).optional().describe("How many (default 10)") });
+const HANDLE = z.object({ handle: z.string().min(1).describe("Shopify product handle") });
+const COLLECTION = z.object({ handle: z.string().min(1).describe("Shopify collection handle"), first: z.number().int().min(1).max(50).optional().describe("How many products (default 25)") });
 const TAGS = z.object({
 	customerId: z.string().min(1).describe("Shopify customer id"),
 	add: z.array(z.string()).optional().describe("Tags to add in Shopify"),
@@ -417,6 +444,9 @@ function agentTools(config: RedeemIDConfig) {
 		get_member: { route: "get-member", input: MEMBER, description: "One synced member by Shopify customer id or email: status, tags, current levels with start dates, past levels, features and last sync." },
 		site_health: { route: "site-health", input: EMPTY, description: "Whether each setting is in place (never the values), the last webhook, open privacy requests and ignored text replacements." },
 		level_changes: { route: "level-changes", input: CHANGES, description: "Who joined or left a level since a date, from each member's tag dates." },
+		find_products: { route: "find-products", input: FIND, description: "Search the Shopify catalog the site sells: handles, titles, prices and availability. Use the handles in Product, Plan and Collection blocks." },
+		get_product: { route: "get-product", input: HANDLE, description: "One Shopify product by handle: options, variants with prices and stock, selling plans (subscriptions) and image count." },
+		get_collection: { route: "get-collection", input: COLLECTION, description: "One Shopify collection by handle: its products, prices and the filters Shopify offers for it." },
 	};
 	if (config.agents?.actions) {
 		tools.resync_member = { route: "resync-member", input: CUSTOMER, description: "Read one member from Shopify now and update the site. Changes nothing in Shopify." };

package/src/rate-limit.ts

@@ -17,6 +17,7 @@ const LIMITED: Record<string, string> = {
 	[`GET ${BASE}/login`]: "login",
 	[`POST ${BASE}/buy`]: "buy",
 	[`POST ${BASE}/cart-edit`]: "cart",
+	[`POST ${BASE}/api/cart`]: "cart",
 };
 
 /** Which limited action a request is, or null. */
@@ -57,6 +58,12 @@ export async function rateLimited(limiter: RateLimiter | undefined, request: Req
 		console.error("[redeemid] rate limit check failed:", (e as Error).message);
 		return null;
 	}
+	if (url.pathname.startsWith(`${BASE}/api/`)) {
+		return new Response(JSON.stringify({ error: "too_many_requests" }), {
+			status: 429,
+			headers: { "content-type": "application/json", "retry-after": "60", "cache-control": "private, no-store" },
+		});
+	}
 	const back = backTo(url, request);
 	const sep = back.includes("?") ? "&" : "?";
 	return new Response(null, {

package/src/routes/api/cart.ts

@@ -0,0 +1,84 @@
+/**
+ * /_emdash/api/auth/redeemid/api/cart: the visitor's Shopify cart as JSON.
+ *
+ * GET answers { cart } (null when there is none).
+ * POST takes JSON { action, ... } with the same fields as cart-edit
+ * (product, variant, options: { Size: "M" }, sellingPlan, quantity, line,
+ * code) and answers { notice, cart, added? }. Action "checkout" answers
+ * { checkoutUrl }: signed in for members, re-read when asked for, as
+ * Shopify recommends. Same-origin only (EmDash checks Origin on POST).
+ */
+
+import type { APIRoute } from "astro";
+
+import { readCart, saveCart } from "../../cart.js";
+import { editCart, type CartInput } from "../../cart-ops.js";
+import { checkoutFor } from "../../checkout.js";
+import { readConfig, storeDomain } from "../../config.js";
+import { cartDetails, getCart, type CartDetails } from "../../storefront.js";
+import { json } from "./shared.js";
+
+export const prerender = false;
+
+type Emdash = { config?: unknown; db?: unknown } | undefined;
+
+async function current(config: NonNullable<ReturnType<typeof readConfig>>, session: Parameters<typeof readCart>[0], request: Request): Promise<CartDetails | null> {
+	const ref = await readCart(session);
+	if (!ref) return null;
+	const cart = await cartDetails(config, ref.id, { buyerIp: request.headers.get("cf-connecting-ip") });
+	if (!cart) saveCart(session, null);
+	else if (cart.totalQuantity !== ref.count) saveCart(session, { id: cart.id, count: cart.totalQuantity });
+	return cart;
+}
+
+export const GET: APIRoute = async ({ request, locals, session }) => {
+	const config = readConfig((locals as { emdash?: Emdash }).emdash?.config);
+	if (!config || !storeDomain(config)) return json(404, { error: "not_configured" });
+	try {
+		return json(200, { cart: await current(config, session, request) });
+	} catch {
+		return json(502, { error: "checkout_failed" });
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, session }) => {
+	const emdash = (locals as { emdash?: Emdash }).emdash;
+	const config = readConfig(emdash?.config);
+	if (!config || !storeDomain(config)) return json(404, { error: "not_configured" });
+	const body = (await request.json().catch(() => null)) as Record<string, unknown> | null;
+	if (!body || typeof body !== "object" || typeof body.action !== "string") return json(400, { error: "bad_request" });
+	const str = (v: unknown) => (typeof v === "string" ? v : typeof v === "number" ? String(v) : undefined);
+	try {
+		if (body.action === "checkout") {
+			const ref = await readCart(session);
+			const cart = ref ? await getCart(config, ref.id, { buyerIp: request.headers.get("cf-connecting-ip") }) : null;
+			if (!cart || cart.totalQuantity < 1) {
+				if (ref) saveCart(session, null);
+				return json(200, { notice: "cart_empty", checkoutUrl: null });
+			}
+			return json(200, { checkoutUrl: await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }) });
+		}
+		const options: Record<string, string> = {};
+		if (body.options && typeof body.options === "object") {
+			for (const [k, v] of Object.entries(body.options as Record<string, unknown>)) if (typeof v === "string") options[k] = v;
+		}
+		const page = str(body.page);
+		const input: CartInput = {
+			action: body.action,
+			product: str(body.product),
+			variant: str(body.variant),
+			options,
+			sellingPlan: body.sellingPlan === undefined ? null : (str(body.sellingPlan) ?? null),
+			quantity: str(body.quantity) ?? "1",
+			line: str(body.line),
+			code: str(body.code),
+			page: page && page.startsWith("/") && !page.startsWith("//") ? page.slice(0, 300) : undefined,
+		};
+		const out = await editCart(input, { config, session, request, db: emdash?.db });
+		const cart = out.cart ?? (out.base ? await current(config, session, request) : null);
+		const status = out.notice === "plan_unavailable" ? 422 : 200;
+		return json(status, { notice: out.notice, cart, ...(out.added ? { added: out.added } : {}) });
+	} catch {
+		return json(502, { error: "checkout_failed" });
+	}
+};

package/src/routes/api/search.ts

@@ -0,0 +1,49 @@
+/**
+ * GET /_emdash/api/auth/redeemid/api/search: the shop's catalog as JSON.
+ *
+ * - ?q=tote&suggest=1 : suggestions while typing { queries, products, collections }
+ * - ?q=tote           : a page of matching products { products, filters, pageInfo, total }
+ * - ?collection=shop  : a page of a collection's products, with its filters
+ *
+ * Paging and filters use the same params as the components: sort, after,
+ * before, filter (Shopify's filter input, repeatable), price_min,
+ * price_max, first (1 to 50). Everything is public catalog data, so answers
+ * may be cached briefly by browsers and CDNs.
+ */
+
+import type { APIRoute } from "astro";
+
+import { browseFromUrl, collectionPage, searchProducts, suggest } from "../../catalog.js";
+import { readConfig, storeDomain } from "../../config.js";
+import { storeContext } from "../../storefront.js";
+import { json } from "./shared.js";
+
+export const prerender = false;
+
+const PUBLIC = "public, max-age=60";
+
+export const GET: APIRoute = async ({ request, locals }) => {
+	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config || !storeDomain(config)) return json(404, { error: "not_configured" });
+	const url = new URL(request.url);
+	const first = Number.parseInt(url.searchParams.get("first") ?? "", 10);
+	const browse = browseFromUrl(url.searchParams, Number.isFinite(first) ? first : 24);
+	const context = storeContext(config, request);
+	// A visitor-country answer differs per visitor.
+	const cache = config.market?.country === "visitor" ? "private, max-age=60" : PUBLIC;
+	try {
+		const handle = (url.searchParams.get("collection") ?? "").trim();
+		if (handle) {
+			if (!/^[a-z0-9][a-z0-9-]*$/i.test(handle)) return json(400, { error: "bad_request" });
+			const page = await collectionPage(config, handle, browse, { context });
+			return page ? json(200, page, cache) : json(404, { error: "not_found" });
+		}
+		if (url.searchParams.get("suggest") === "1") {
+			const limit = Number.parseInt(url.searchParams.get("limit") ?? "6", 10);
+			return json(200, await suggest(config, browse.query, Number.isFinite(limit) ? limit : 6, { context }), cache);
+		}
+		return json(200, await searchProducts(config, browse.query, browse, { context }), cache);
+	} catch {
+		return json(502, { error: "unavailable" });
+	}
+};

package/src/routes/api/shared.ts

@@ -0,0 +1,4 @@
+/** Shared bits of the JSON routes under /_emdash/api/auth/redeemid/api/. */
+
+export const json = (status: number, body: unknown, cache = "private, no-store") =>
+	new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json", "Cache-Control": cache } });

package/src/routes/api/state.ts

@@ -0,0 +1,69 @@
+/**
+ * GET /_emdash/api/auth/redeemid/api/state: the visitor's own state, for the
+ * browser client and other site code.
+ *
+ *   { apiVersion, version, signedIn, linked, levels, features, cart: { count }, meter }
+ *
+ * `levels` and `features` are slugs. Never an email, a name, a customer id
+ * or a Shopify tag. Always private, never cached.
+ */
+
+import type { APIRoute } from "astro";
+
+import { levelsFor, periodKey } from "../../access.js";
+import { API_VERSION } from "../../api-version.js";
+import { readCart } from "../../cart.js";
+import { featuresFor } from "../../features.js";
+import { siteConfig } from "../../site-config.js";
+import { memberForUser, stores } from "../../storage.js";
+import { VERSION } from "../../version.js";
+import { json } from "./shared.js";
+
+export const prerender = false;
+
+export interface State {
+	apiVersion: string;
+	version: string;
+	signedIn: boolean;
+	/** Signed in with a store account RedeemID has synced. */
+	linked: boolean;
+	levels: string[];
+	features: string[];
+	cart: { count: number };
+	meter: { used: number; limit: number; period: "month" | "week" } | null;
+}
+
+export const GET: APIRoute = async ({ locals, session }) => {
+	const config = await siteConfig(locals);
+	const db = (locals as { emdash?: { db?: unknown } }).emdash?.db;
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const ref = await readCart(session);
+	const state: State = {
+		apiVersion: API_VERSION,
+		version: VERSION,
+		signedIn: Boolean(user?.id),
+		linked: false,
+		levels: [],
+		features: [],
+		cart: { count: ref?.count ?? 0 },
+		meter: null,
+	};
+	if (user?.id && db && config) {
+		const s = stores(db);
+		const member = await memberForUser(s, user.id).catch(() => null);
+		if (member) {
+			state.linked = true;
+			if (member.status !== "disabled") {
+				state.levels = levelsFor(member.tags, config.levels);
+				state.features = featuresFor(member, config.features, config.levels);
+			}
+		}
+		const meter = config.meter;
+		if (meter && meter.limit > 0) {
+			const period = meter.period ?? "month";
+			const record = await s.meter.get(`${user.id}:${periodKey(new Date(), period)}`).catch(() => null);
+			state.meter = { used: Math.min(record?.items.length ?? 0, meter.limit), limit: meter.limit, period };
+		}
+	}
+	return json(200, state);
+};

package/src/routes/buy.ts

@@ -14,7 +14,8 @@ import { readConfig, storeDomain } from "../config.js";
 import { safeReturn } from "../access.js";
 import { memberForUser, stores } from "../storage.js";
 import { saveCart, readCart } from "../cart.js";
-import { addToCart, plan } from "../storefront.js";
+import { checkoutFor } from "../checkout.js";
+import { addToCart, plan, storeContext } from "../storefront.js";
 import { fail } from "./shared.js";
 
 export const prerender = false;
@@ -39,10 +40,10 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip") },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context: storeContext(config, request) },
 		);
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
-		return redirect(cart.checkoutUrl, 303);
+		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }), 303);
 	} catch {
 		return fail(redirect, returnTo, "checkout_failed");
 	}

package/src/routes/callback.ts

@@ -23,7 +23,7 @@ import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToke
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
 
-import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
+import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_CUSTOMER_TOKEN, SESSION_ID_TOKEN, type CustomerToken, type Flow } from "./shared.js";
 
 export const prerender = false;
 
@@ -48,7 +48,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const state = url.searchParams.get("state");
 	const code = url.searchParams.get("code");
 	if (!flow || !state || state !== flow.state || !code || Date.now() - flow.at > FLOW_TTL_MS) {
-		await refused("sign_in_expired", "warn");
+		// A request with no sign-in behind it (a crawler, a probe) isn't worth an entry.
+		if (flow) await refused("sign_in_expired", "warn");
 		return fail(redirect, returnTo, "sign_in_expired");
 	}
 
@@ -131,6 +132,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
+		session.set(SESSION_CUSTOMER_TOKEN, { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken);
 		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";