@redeemid/emdash 0.0.19 → 0.0.21

package/src/access.ts

@@ -11,9 +11,12 @@
  */
 
 import type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
-import type { EntryRule } from "./settings.js";
+import { UNAVAILABLE, type EntryRule } from "./settings.js";
 import { siteConfig } from "./site-config.js";
-import { memberForUser, stores, type MemberRecord } from "./storage.js";
+import { memberForUser, stores, type MemberRecord, type MeterRecord } from "./storage.js";
+
+/** The site's config for a request: the code's config with the admin's saved settings laid over it. */
+export { siteConfig };
 
 /** The parts of Astro's global that access checks read. */
 export interface AstroLike {
@@ -336,7 +339,7 @@ export function passes(held: string[], required: string[][]): boolean {
  */
 export function describe(required: Requirement, levels: LevelConfig[] = [], open = "Free", signedIn = "Signed in"): string {
 	if (required === null) return open;
-	const name = (slug: string) => levels.find((l) => l.slug === slug)?.name ?? slug;
+	const name = (slug: string) => (slug === UNAVAILABLE ? "Members" : (levels.find((l) => l.slug === slug)?.name ?? slug));
 	const parts = reduce(required).filter((c) => c.length > 0).map((c) => c.map(name).join(" or "));
 	return parts.length ? parts.join(" + ") : signedIn;
 }
@@ -384,6 +387,8 @@ export async function entryRequirement(
 	id?: string | null,
 ): Promise<Requirement> {
 	if (!config) return null;
+	// Saved settings can't be read: nobody passes this.
+	if (config.unavailable) return [[UNAVAILABLE]];
 	const own = entryRuleFor(config, collection, id);
 	if (own && (own.mode === "open" || own.mode === "levels") && !own.openUntil && !own.lockedUntil) return applyEntryRule(null, own);
 	const tree = await termTree(config.rules, collection, terms);
@@ -445,7 +450,7 @@ export async function canRead(
 	const v = await viewer(astro);
 
 	if (required === null) return { allowed: true, reason: "open", required: [], viewer: v };
-	if (!config) return { allowed: false, reason: "unconfigured", required, viewer: v };
+	if (!config || config.unavailable) return { allowed: false, reason: "unconfigured", required, viewer: v };
 	if (!v.signedIn) return { allowed: false, reason: "sign_in", required, viewer: v };
 	if (v.member?.status === "disabled") return { allowed: false, reason: "disabled", required, viewer: v };
 	if (!v.member) return { allowed: false, reason: "upgrade", required, viewer: v };
@@ -529,12 +534,31 @@ export async function readEntry(
 	const key = `${user.id}:${periodKey(new Date(), period)}`;
 	try {
 		const s = stores(db);
-		const record = (await s.meter.get(key)) ?? { userId: user.id, period: periodKey(new Date(), period), items: [] };
-		const used = consume(record.items, `${entry.collection}:${entry.id}`, meter.limit);
 		const info = { limit: meter.limit, period };
-		if (!used.allowed) return { ...verdict, meterLeft: 0, meter: info };
-		if (used.items !== record.items) {
-			await s.meter.put(key, { ...record, items: used.items });
+		// Read, count and write with compare-and-set, so parallel requests
+		// can't each take the last free entry.
+		let record: MeterRecord | null = null;
+		let used: ReturnType<typeof consume> | null = null;
+		let wrote = false;
+		for (let attempt = 0; attempt < 3 && !used; attempt++) {
+			const current = await s.meter.getVersioned(key);
+			const r = current?.value ?? { userId: user.id, period: periodKey(new Date(), period), items: [] };
+			const next = consume(r.items, `${entry.collection}:${entry.id}`, meter.limit);
+			if (!next.allowed || next.items === r.items) {
+				record = r;
+				used = next;
+				break;
+			}
+			const write = await s.meter.compareAndSet(key, current?.revision ?? null, { ...r, items: next.items });
+			if (write.applied) {
+				record = r;
+				used = next;
+				wrote = true;
+			}
+		}
+		// Lost every race: count it as used up rather than open one too many.
+		if (!used || !record || !used.allowed) return { ...verdict, meterLeft: 0, meter: info };
+		if (wrote) {
 			const { emit } = await import("./events.js");
 			const data = { userId: user.id, entry: `${entry.collection}:${entry.id}`, used: used.items.length, limit: meter.limit, period: record.period };
 			const { record: log } = await import("./log.js");

package/src/admin-api.ts

@@ -11,7 +11,7 @@
 
 import { env, ENV, shopOrigin, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
-import { cleanTags, emptyMember, stampTags, type MemberRecord, type Stores } from "./storage.js";
+import { cleanTags, emptyMember, metaDate, stampTags, type MemberRecord, type MembershipDates, type Stores } from "./storage.js";
 import { timed } from "./log.js";
 
 export const ADMIN_API_VERSION = "2026-10";
@@ -100,15 +100,32 @@ export interface AdminCustomer {
 	lastName: string | null;
 	tags: string[];
 	updatedAt: number | null;
+	emailMarketing: string | null;
+	dates: MembershipDates;
 }
 
+/** The membership.* customer metafields read with each customer (see MemberRecord.dates). */
+const DATE_FIELDS = `since: metafield(namespace: "membership", key: "member_since") { value } renews: metafield(namespace: "membership", key: "renews_on") { value } ends: metafield(namespace: "membership", key: "ends_on") { value } gift: metafield(namespace: "membership", key: "gift_until") { value }`;
+
 /** Up to 100 customers by numeric id. Customers Shopify no longer has are left out. */
 export async function customers(config: RedeemIDConfig, ids: string[], fetcher: typeof fetch = fetch): Promise<AdminCustomer[]> {
 	if (ids.length === 0) return [];
-	type Node = { id: string; firstName: string | null; lastName: string | null; tags: string[]; updatedAt: string; defaultEmailAddress: { emailAddress: string | null } | null } | null;
+	type Meta = { value: string | null } | null;
+	type Node = {
+		id: string;
+		firstName: string | null;
+		lastName: string | null;
+		tags: string[];
+		updatedAt: string;
+		defaultEmailAddress: { emailAddress: string | null; marketingState?: string | null } | null;
+		since?: Meta;
+		renews?: Meta;
+		ends?: Meta;
+		gift?: Meta;
+	} | null;
 	const data = await admin<{ nodes: Node[] }>(
 		config,
-		`query RedeemIDCustomers($ids: [ID!]!) { nodes(ids: $ids) { ... on Customer { id firstName lastName tags updatedAt defaultEmailAddress { emailAddress } } } }`,
+		`query RedeemIDCustomers($ids: [ID!]!) { nodes(ids: $ids) { ... on Customer { id firstName lastName tags updatedAt defaultEmailAddress { emailAddress marketingState } ${DATE_FIELDS} } } }`,
 		{ ids: ids.slice(0, 100).map(gid) },
 		fetcher,
 	);
@@ -121,11 +138,14 @@ export async function customers(config: RedeemIDConfig, ids: string[], fetcher:
 			lastName: n.lastName || null,
 			tags: cleanTags(n.tags),
 			updatedAt: Number.isFinite(Date.parse(n.updatedAt)) ? Date.parse(n.updatedAt) : null,
+			emailMarketing: n.defaultEmailAddress?.marketingState ?? null,
+			dates: { since: metaDate(n.since?.value), renews: metaDate(n.renews?.value), ends: metaDate(n.ends?.value), gift: metaDate(n.gift?.value) },
 		}));
 }
 
 /**
- * Read members from Shopify again and update the mirror: profile and tags.
+ * Read members from Shopify again and update the mirror: profile, tags,
+ * email marketing state and the membership dates.
  * Status stays with the enable/disable webhooks. Members Shopify no longer
  * has are reported in `missing` and left alone.
  */
@@ -142,6 +162,8 @@ export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], s
 		m.lastName = c.lastName ?? m.lastName;
 		m.tags = c.tags;
 		m.profileUpdatedAt = c.updatedAt ?? m.profileUpdatedAt;
+		m.emailMarketing = c.emailMarketing ?? m.emailMarketing ?? null;
+		m.dates = c.dates;
 		m.syncedAt = new Date().toISOString();
 		m.source = source;
 		await s.members.put(c.customerId, stampTags(m));

package/src/api-version.ts

@@ -3,4 +3,4 @@
  * when something is added, the major part when something stable changes or
  * goes. Separate from the package version.
  */
-export const API_VERSION = "1.0.0";
+export const API_VERSION = "1.1.0";

package/src/cart-ops.ts

@@ -11,6 +11,7 @@
 import { readCart, saveCart } from "./cart.js";
 import type { RedeemIDConfig } from "./config.js";
 import { memberForUser, stores } from "./storage.js";
+import { sessionUser } from "./routes/shared.js";
 import { addToCart, cartDetails, product, realOptions, removeLines, setDiscountCodes, storeContext, updateLines, variantFor, type Cart, type CartDetails, type Product, type Variant } from "./storefront.js";
 
 export const MAX_QUANTITY = 1000;
@@ -100,8 +101,8 @@ export async function editCart(input: CartInput, ctx: CartContext): Promise<Cart
 		const variant = p ? pickVariant(p, input) : undefined;
 		const plan = p ? pickSellingPlan(p, input.sellingPlan) : undefined;
 		if (!p || !variant?.availableForSale || plan === undefined) return { notice: "plan_unavailable", cart: null };
-		const user = (await session?.get("user")) as { id?: string } | undefined;
-		const member = user?.id && ctx.db ? await memberForUser(stores(ctx.db), user.id) : null;
+		const user = await sessionUser(session, ctx.db);
+		const member = user && ctx.db ? await memberForUser(stores(ctx.db), user.id) : null;
 		const current = await readCart(session);
 		const cart = await addToCart(
 			config,

package/src/checkout.ts

@@ -4,7 +4,7 @@
  * A signed-in member's cart gets their Customer Account API access token
  * (cartBuyerIdentityUpdate), so checkout opens signed in and the order lands
  * on their Shopify customer, where the shop's Flow or apps tag it. The token
- * lives only in the server-side session and is renewed with its refresh
+ * lives only in the server-side session, sealed (token-vault.ts), and is renewed with its refresh
  * token when it's about to expire. Anything that fails falls back to a guest
  * checkout: buying never breaks because sign-in couldn't be carried over.
  */
@@ -13,6 +13,7 @@ import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { SESSION_CUSTOMER_TOKEN, callbackUrl, type CustomerToken } from "./routes/shared.js";
 import { discover, refreshTokens } from "./shopify.js";
 import { signInCart } from "./storefront.js";
+import { seal, unseal } from "./token-vault.js";
 
 type Session = { get(key: string): unknown; set(key: string, value: unknown): void; delete?(key: string): void } | undefined;
 
@@ -23,9 +24,9 @@ const RENEW_MS = 2 * 60 * 1000;
 export async function customerToken(
 	config: RedeemIDConfig,
 	session: Session,
-	opts: { url: URL; emdashConfig?: unknown; fetcher?: typeof fetch; now?: number },
+	opts: { url: URL; emdashConfig?: unknown; fetcher?: typeof fetch; now?: number; db?: unknown },
 ): Promise<string | null> {
-	const t = (await session?.get(SESSION_CUSTOMER_TOKEN)) as CustomerToken | undefined;
+	const t = await unseal(await session?.get(SESSION_CUSTOMER_TOKEN), opts.db);
 	if (!t?.accessToken) return null;
 	const now = opts.now ?? Date.now();
 	if (!t.expiresAt || t.expiresAt - now > RENEW_MS) return t.accessToken;
@@ -45,7 +46,7 @@ export async function customerToken(
 			{ clientId, clientSecret: env(ENV.clientSecret), origin: new URL(redirect).origin, refreshToken: t.refreshToken },
 			opts.fetcher,
 		);
-		session?.set(SESSION_CUSTOMER_TOKEN, next satisfies CustomerToken);
+		session?.set(SESSION_CUSTOMER_TOKEN, await seal(next satisfies CustomerToken, opts.db));
 		return next.accessToken;
 	} catch {
 		forget();

package/src/components/LockedPanel.astro

@@ -8,7 +8,7 @@
  * and `joinUrl` come from the level's config, the join link from `join`.
  * Anything in the default slot is shown above the built-in text.
  */
-import { passes, signInUrl, type Reason } from "../access.js";
+import { membership, passes, refreshUrl, signInUrl, viewer, type Reason } from "../access.js";
 import type { SoldItem } from "../blocks-names.js";
 import { plan as loadPlan } from "../storefront.js";
 import { siteConfig } from "../site-config.js";
@@ -39,6 +39,9 @@ const config = await siteConfig(Astro.locals);
 const missing = required.find((clause) => clause.length > 0 && !passes(held, [clause]));
 const level = missing ? config?.levels?.find((l) => l.slug === missing[0]) : undefined;
 const joinHref = level?.joinUrl ?? config?.join?.href;
+// A member who held the level before is offered it back ("Renew"), not "Join" as if new.
+const member = reason === "upgrade" && level ? (await viewer(Astro)).member : null;
+const lapsed = Boolean(member && member.status !== "disabled" && membership(member, config?.levels).past.some((p) => p.slug === level?.slug));
 const joinLabel = config?.join?.label ?? text(config, "Become a member");
 const week = meterPeriod === "week";
 // "Buy just this": the item's product and price, read from Shopify.
@@ -73,7 +76,14 @@ const here = Astro.url.pathname + Astro.url.search;
 			{opens ? textParts(config, "This opens for you on {date}.", { date: <time datetime={opensAt?.toISOString()}>{opens}</time> }) : text(config, "This opens for you after you've been a member a little longer.")}
 		</p>
 	)}
-	{reason === "upgrade" && (
+	{reason === "upgrade" && lapsed && level && (
+		<p class="redeemid-locked__renew">
+			{text(config, "Your {level} membership has ended.", { level: level.name })}
+			{joinHref && <> <a href={joinHref}>{text(config, "Renew {level}", { level: level.name })}</a></>}
+			{" "}{textParts(config, "Already renewed? {refresh}", { refresh: <a href={refreshUrl(here)}>{text(config, "Refresh")}</a> })}
+		</p>
+	)}
+	{reason === "upgrade" && !lapsed && (
 		<p>
 			{level ? text(config, "This is for {level} members.", { level: level.name }) : text(config, "Your membership doesn't include this yet.")}
 			{joinHref && <> <a href={joinHref}>{joinLabel}</a></>}

package/src/components/MemberCard.astro

@@ -1,7 +1,9 @@
 ---
 /**
  * The member's own account card, for an account page: their levels with
- * when each started, levels they held before, the meter, and links to the
+ * when each started, when the membership renews or ends and any gift
+ * membership (from the shop's membership.* customer metafields), levels
+ * they held before, the meter, and links to the
  * store account, Refresh membership and Sign out. Visitors get a sign-in link.
  *
  *   <MemberCard />
@@ -35,6 +37,11 @@ const date = (iso: string | null) => {
 	return Number.isNaN(t) ? null : new Intl.DateTimeFormat("en-US", { dateStyle: "long", timeZone: "UTC" }).format(new Date(t));
 };
 const name = [m?.firstName, m?.lastName].filter(Boolean).join(" ");
+// Dates the shop keeps in Shopify (Flow or a subscription app). Display only.
+const dates = m && !disabled ? (m.dates ?? {}) : {};
+const today = new Date().toISOString().slice(0, 10);
+const gift = dates.gift && dates.gift >= today ? dates.gift : null;
+const day = (ymd: string | null | undefined) => (ymd ? date(`${ymd}T12:00:00Z`) : null);
 const join = config?.join;
 ---
 
@@ -55,7 +62,7 @@ const join = config?.join;
 					{current.map((l) => (
 						<li data-redeemid-level={l.slug}>
 							<strong>{l.name}</strong>
-							{date(l.since) && <> {textParts(config, "since {date}", { date: <time datetime={l.since ?? undefined}>{date(l.since)}</time> })}</>}
+							{(dates.since ? day(dates.since) : date(l.since)) && <> {textParts(config, "since {date}", { date: <time datetime={dates.since ?? l.since ?? undefined}>{dates.since ? day(dates.since) : date(l.since)}</time> })}</>}
 						</li>
 					))}
 				</ul>
@@ -64,6 +71,13 @@ const join = config?.join;
 					{text(config, "You don't have a membership yet.")}{join && <> <a href={join.href}>{join.label ?? text(config, "Become a member")}</a></>}
 				</p>
 			)}
+			{current.length > 0 && (dates.renews || dates.ends || gift) && (
+				<ul class="redeemid-member__dates">
+					{dates.renews && <li data-redeemid-date="renews">{textParts(config, "Renews on {date}", { date: <time datetime={dates.renews}>{day(dates.renews)}</time> })}</li>}
+					{dates.ends && <li data-redeemid-date="ends">{textParts(config, "Ends on {date}", { date: <time datetime={dates.ends}>{day(dates.ends)}</time> })}</li>}
+					{gift && <li data-redeemid-date="gift">{textParts(config, "Gift membership until {date}", { date: <time datetime={gift}>{day(gift)}</time> })}</li>}
+				</ul>
+			)}
 			{features.length > 0 && (
 				<p class="redeemid-member__features">
 					{text(config, "Includes: {features}", { features: features.map((f) => f.name).join(", ") })}

package/src/components/Plan.astro

@@ -7,9 +7,10 @@
  *   <Plan handle="gold-membership" levels={["gold"]} />
  *
  * With `levels`, members who hold one of them see "You're on this plan"
- * in place of the button.
+ * in place of the button, and a member who held one before (Shopify removed
+ * its tag) sees "Renew" instead of "Join".
  */
-import { viewer } from "../access.js";
+import { membership, viewer } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { plan as loadPlan, type Plan } from "../storefront.js";
 import { text } from "../text.js";
@@ -23,10 +24,12 @@ interface Props {
 	/** The levels this plan gives. Members holding one see `heldLabel`, not the button. */
 	levels?: string[];
 	heldLabel?: string;
+	/** Button text for a member whose plan lapsed. */
+	renewLabel?: string;
 }
 
 const config = await siteConfig(Astro.locals);
-const { handle, label = text(config, "Join"), title, levels = [], heldLabel = text(config, "You're on this plan.") } = Astro.props;
+const { handle, label = text(config, "Join"), title, levels = [], heldLabel = text(config, "You're on this plan."), renewLabel = text(config, "Renew") } = Astro.props;
 let p: Plan | null = null;
 if (config) {
 	try {
@@ -39,11 +42,14 @@ const price = p?.price
 	? new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount))
 	: null;
 const here = Astro.url.pathname + Astro.url.search;
-const held = levels.length > 0 && (await viewer(Astro)).levels.some((l) => levels.includes(l));
+const v = levels.length > 0 ? await viewer(Astro) : null;
+const held = Boolean(v?.levels.some((l) => levels.includes(l)));
+// Lapsed: held one of these levels before. Offered their plan back, not "Join" as if new.
+const lapsed = Boolean(!held && v?.member && v.member.status !== "disabled" && membership(v.member, config?.levels).past.some((p) => levels.includes(p.slug)));
 ---
 
 {p ? (
-	<div class:list={["redeemid-plan", { "is-held": held }]} data-redeemid-plan={p.handle}>
+	<div class:list={["redeemid-plan", { "is-held": held, "is-lapsed": lapsed }]} data-redeemid-plan={p.handle} data-redeemid-state={held ? "held" : lapsed ? "renew" : "join"}>
 		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
 		{price && <p class="redeemid-plan__price">{price}</p>}
 		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
@@ -53,7 +59,7 @@ const held = levels.length > 0 && (await viewer(Astro)).levels.some((l) => level
 			<form method="post" action="/_emdash/api/auth/redeemid/buy">
 				<input type="hidden" name="plan" value={p.handle} />
 				<input type="hidden" name="return" value={here} />
-				<button type="submit">{label}</button>
+				<button type="submit">{lapsed ? renewLabel : label}</button>
 			</form>
 		) : (
 			<p class="redeemid-plan__unavailable">{text(config, "Not available right now.")}</p>

package/src/config.ts

@@ -187,6 +187,12 @@ export interface RedeemIDConfig {
 	 * in the editor's Access panel rather than here.
 	 */
 	entries?: Record<string, EntryRule>;
+	/**
+	 * Set by RedeemID, never in astro.config.mjs: the settings saved in the
+	 * admin couldn't be read and none were read before, so every entry is
+	 * locked until they can be (see lockdown in settings.ts).
+	 */
+	unavailable?: boolean;
 	/**
 	 * Only for local tests: lets `shop` be a full http:// origin of a fake store.
 	 * Never set this on a live site.

package/src/contract.ts

@@ -16,7 +16,7 @@ export { API_VERSION } from "./api-version.js";
 /** Stable exports, by import path. */
 export const MODULES = {
 	"@redeemid/emdash": ["redeemid", "redeemidGuard", "redeemidPlugin"],
-	"@redeemid/emdash/access": ["viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
+	"@redeemid/emdash/access": ["siteConfig", "viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
 	"@redeemid/emdash/features": ["hasFeature", "viewerFeatures", "featuresFor"],
 	"@redeemid/emdash/preferences": ["readPreferences", "savePreferences", "preferenceFields"],
 	"@redeemid/emdash/storefront": ["plan", "product", "collection", "money", "realOptions", "variantFor", "storeContext", "cartDetails", "addToCart", "updateLines", "removeLines", "setDiscountCodes"],

package/src/descriptor.ts

@@ -15,6 +15,7 @@ export const PAGES = [
 	{ path: "/events", label: "App events", icon: "list" },
 	{ path: "/reports", label: "Reports", icon: "chart" },
 	{ path: "/status", label: "Status", icon: "pulse" },
+	{ path: "/setup", label: "Setup", icon: "settings" },
 	{ path: "/test", label: "Access test", icon: "search" },
 	{ path: "/privacy", label: "Privacy", icon: "lock" },
 ];

package/src/events.ts

@@ -8,7 +8,10 @@
  * X-RedeemID-Signature: sha256=<hex HMAC of the raw body>. Events:
  * member.signed_in, member.levels_changed, meter.used, meter.exhausted,
  * preferences.saved.
- * Sending never blocks or breaks the page: failures are logged and dropped.
+ * Sending never blocks or breaks the page: events go out after the response
+ * (waitUntil on Workers), are tried three times, and one that fails every
+ * try is kept under App events → Failed events, where staff can send it
+ * again or clear it.
  * No event carries an email address or a name; match people by `customerId`.
  */
 
@@ -19,6 +22,8 @@ import { record } from "./log.js";
 export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased";
 
 const TIMEOUT_MS = 3000;
+/** Waits before the second and third tries. */
+export const RETRY_DELAYS_MS = [1000, 5000];
 
 export async function signBody(body: string, secret: string): Promise<string> {
 	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
@@ -26,14 +31,20 @@ export async function signBody(body: string, secret: string): Promise<string> {
 	return [...mac].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-/** Send one event. Returns whether the receiver answered 2xx; never throws. */
-export async function emit(config: RedeemIDConfig | null, name: EventName, data: Record<string, unknown>, fetcher: typeof fetch = fetch): Promise<boolean> {
-	const url = config?.events?.url;
-	const secret = env(ENV.eventsSecret);
-	if (!url || !secret) return false;
-	if (config.events?.only && !config.events.only.includes(name)) return false;
-	const id = crypto.randomUUID();
-	const body = JSON.stringify({ id, event: name, at: new Date().toISOString(), data });
+/** An event that failed every try, kept so staff can send it again or clear it (App events). */
+export interface FailedEvent {
+	/** The delivery id, also the record id: a resend keeps it, so receivers can drop duplicates. */
+	id: string;
+	event: EventName;
+	/** The JSON body as first sent (ids and levels, never an email or a name). */
+	body: string;
+	at: string;
+	attempts: number;
+	error: string;
+}
+
+/** One POST. Resolves to null when the receiver answered 2xx, else what went wrong. */
+async function post(url: string, name: string, id: string, body: string, secret: string, fetcher: typeof fetch): Promise<string | null> {
 	try {
 		const res = await fetcher(url, {
 			method: "POST",
@@ -47,22 +58,117 @@ export async function emit(config: RedeemIDConfig | null, name: EventName, data:
 			body,
 			signal: AbortSignal.timeout(TIMEOUT_MS),
 		});
-		if (!res.ok) await record({ event: "events.failed", label: name, status: `HTTP ${res.status}`, level: "warn", origin: "site" });
-		return res.ok;
+		return res.ok ? null : `HTTP ${res.status}`;
 	} catch (e) {
-		console.error("[redeemid] event not sent:", name, (e as Error).message);
-		await record({ event: "events.failed", label: name, status: "error", level: "error", origin: "site", note: String((e as Error).message).slice(0, 200) });
-		return false;
+		return String((e as Error).message || "error").slice(0, 200);
 	}
 }
 
+type Sleep = (ms: number) => Promise<void>;
+const sleep: Sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Try a delivery up to three times (now, after 1 s, after 5 s). One that
+ * fails every try goes to the failed list (App events) for staff. True when
+ * the receiver took it.
+ */
+export async function deliver(
+	url: string,
+	secret: string,
+	name: EventName,
+	id: string,
+	body: string,
+	opts: { fetcher?: typeof fetch; wait?: Sleep; failed?: (f: FailedEvent) => Promise<void> } = {},
+): Promise<boolean> {
+	const fetcher = opts.fetcher ?? fetch;
+	let error: string | null = null;
+	let attempts = 0;
+	for (const delay of [0, ...RETRY_DELAYS_MS]) {
+		if (delay) await (opts.wait ?? sleep)(delay);
+		attempts++;
+		error = await post(url, name, id, body, secret, fetcher);
+		if (error === null) return true;
+	}
+	console.error("[redeemid] event not sent:", name, error);
+	const failed: FailedEvent = { id, event: name, body, at: new Date().toISOString(), attempts, error: error ?? "error" };
+	await record({ event: "events.failed", label: name, status: error ?? "error", level: "error", origin: "site", note: `${attempts} tries` });
+	await (opts.failed ?? keepFailed)(failed).catch(() => undefined);
+	return false;
+}
+
+async function keepFailed(f: FailedEvent): Promise<void> {
+	const { getDb } = await import("emdash/runtime");
+	const { stores } = await import("./storage.js");
+	await stores(await getDb()).failedEvents.put(f.id, f);
+}
+
+/** Deliveries started and not finished yet: tests and the CLI can wait for them. */
+const pending = new Set<Promise<boolean>>();
+
+/** Wait until every event started so far has been delivered or given up on. */
+export async function flushEvents(): Promise<void> {
+	while (pending.size) await Promise.allSettled([...pending]);
+}
+
+/** EmDash's after(), loaded once; null outside an EmDash site. */
+let afterFn: Promise<((fn: () => Promise<void>) => void) | null> | null = null;
+
+/** Keep the work alive after the response (waitUntil on Workers); plain Node needs nothing. Never waits. */
+function keepAlive(work: Promise<unknown>): void {
+	afterFn ??= import("emdash").then(
+		(m) => m.after,
+		() => null,
+	);
+	void afterFn.then((after) =>
+		after?.(async () => {
+			await work;
+		}),
+	);
+}
+
+/**
+ * Send one event, after the response: the page, sign-in or webhook never
+ * waits for the receiver. Returns at once; false when events are off.
+ */
+export async function emit(
+	config: RedeemIDConfig | null,
+	name: EventName,
+	data: Record<string, unknown>,
+	opts: { fetcher?: typeof fetch; wait?: Sleep; failed?: (f: FailedEvent) => Promise<void> } = {},
+): Promise<boolean> {
+	const url = config?.events?.url;
+	const secret = env(ENV.eventsSecret);
+	if (!url || !secret) return false;
+	if (config.events?.only && !config.events.only.includes(name)) return false;
+	const id = crypto.randomUUID();
+	const body = JSON.stringify({ id, event: name, at: new Date().toISOString(), data });
+	const work = deliver(url, secret, name, id, body, opts).catch(() => false);
+	pending.add(work);
+	void work.finally(() => pending.delete(work));
+	keepAlive(work);
+	return true;
+}
+
+/** Send a failed event again (staff). On success it leaves the failed list. */
+export async function resend(config: RedeemIDConfig, s: { failedEvents: { get(id: string): Promise<FailedEvent | null>; delete(id: string): Promise<boolean> } }, id: string, fetcher: typeof fetch = fetch): Promise<boolean> {
+	const f = await s.failedEvents.get(id);
+	const url = config.events?.url;
+	const secret = env(ENV.eventsSecret);
+	if (!f || !url || !secret) return false;
+	const error = await post(url, f.event, f.id, f.body, secret, fetcher);
+	await record({ event: "events.resent", label: f.event, status: error ?? "ok", level: error ? "warn" : "ok", origin: "staff" });
+	if (error) return false;
+	await s.failedEvents.delete(id);
+	return true;
+}
+
 /** Send member.levels_changed when a mirror write changed the member's levels. */
 export async function levelChange(
 	config: RedeemIDConfig | null,
 	beforeTags: string[] | null,
 	after: { customerId: string; tags: string[]; status: string },
 	source: string,
-	fetcher: typeof fetch = fetch,
+	fetcher?: typeof fetch,
 ): Promise<void> {
 	if (!config?.events?.url) return;
 	const { levelsFor } = await import("./access.js");
@@ -73,6 +179,6 @@ export async function levelChange(
 		config,
 		"member.levels_changed",
 		{ customerId: after.customerId, levels: now, added: now.filter((l) => !was.includes(l)), removed: was.filter((l) => !now.includes(l)), source },
-		fetcher,
+		fetcher ? { fetcher } : {},
 	);
 }

package/src/files.ts

@@ -115,16 +115,22 @@ export function ruleFor(config: RedeemIDConfig | null, folder: string | null): F
 
 /** Decide one download. `key` is the storage key from the file URL. */
 export async function fileAccess(astro: AstroLike, config: RedeemIDConfig | null, key: string): Promise<FileVerdict> {
-	if (!config?.files?.length) return { protected: false };
+	if (!config?.files?.length && !config?.unavailable) return { protected: false };
 	const locals = astro.locals as { user?: { role?: number } | null; emdash?: { db?: unknown } | null };
 	const db = locals.emdash?.db;
 	// No database to look the file up in: the caller fails closed.
 	if (!db) throw new Error("no database for the file check");
 	const media = await mediaByKey(db, key);
+	const role = locals.user?.role ?? 0;
+	// Saved settings can't be read: any file in a folder might be protected.
+	if (config.unavailable) {
+		if (!media?.folder) return { protected: false };
+		if (role > SUBSCRIBER) return { protected: true, allowed: true };
+		return { protected: true, allowed: false, reason: (await viewer(astro)).signedIn ? "denied" : "sign_in" };
+	}
 	const rule = ruleFor(config, media?.folder ?? null);
 	if (!media || !rule) return { protected: false };
 
-	const role = locals.user?.role ?? 0;
 	if (role > SUBSCRIBER) return { protected: true, allowed: true };
 	const v = await viewer(astro);
 	if (!v.signedIn) return { protected: true, allowed: false, reason: "sign_in" };

package/src/guard.ts

@@ -87,7 +87,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const config = await siteConfig(locals);
 
 	// Protected files: checked for everyone, on every download.
-	const keys = config?.files?.length ? keysFromUrl(url) : null;
+	const keys = config?.files?.length || config?.unavailable ? keysFromUrl(url) : null;
 	if (keys) {
 		let verdict;
 		try {