@redeemid/emdash 0.0.21 → 0.0.22

package/README.md

@@ -7,7 +7,7 @@ Memberships and paywalls for [EmDash](https://github.com/emdash-cms/emdash) site
 
 Readers sign in with the store's own customer account. Their Shopify customer tags decide what they can read. Shopify keeps the store, checkout, orders and subscriptions, and EmDash keeps the content. Nothing on the site grants access by itself, so there is one source of truth for who paid for what.
 
-**Status: 0.0.21, early.** Runs on Node and Cloudflare Workers. Unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store cover the features below. Expect changes before 1.0.
+**Status: 0.0.22, early.** Runs on Node and Cloudflare Workers. Unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store cover the features below. Expect changes before 1.0.
 
 ## Contents
 
@@ -214,6 +214,18 @@ const needs = await entryRequirement(config, "posts", post.data.terms, post.id);
 // e.g. [["gold", "pro"]]: readers pass every clause, each with any one of its levels; null when open
 ```
 
+**Site search.** EmDash's search API (`/_emdash/api/search`, which its live search box uses) is public and answers with a snippet of the matching text. `redeemidGuard()` checks each result for visitors and members: an entry the reader can't read in full keeps its title but loses its snippet, and stays in the results only when its title holds every searched word, so a search can't show locked text or tell which locked entry contains a word. Staff get every result. A search page that calls EmDash's `search()` in its template filters the same way with `readableResults()`:
+
+```astro
+---
+import { search } from "emdash";
+import { readableResults } from "@redeemid/emdash/search";
+
+const q = Astro.url.searchParams.get("q") ?? "";
+const results = q ? await readableResults(Astro, q, (await search(q)).items) : [];
+---
+```
+
 `siteConfig(Astro.locals)` is the config for this request: your code's config with the Access page's saved settings laid over it. Pass it to the functions that take a `config`, such as `entryRequirement()`, `readPreferences()` and the storefront and catalog calls.
 
 ## Guides
@@ -619,6 +631,7 @@ Import each from `@redeemid/emdash/components/<Name>.astro`.
 | `@redeemid/emdash/catalog` | `searchProducts()`, `collectionPage()`, `suggest()`, `recommendations()` |
 | `@redeemid/emdash/events` | `signBody(body, secret)`, the signature a receiver checks against `X-RedeemID-Signature` |
 | `@redeemid/emdash/text` | `STRINGS`, the list of every replaceable string |
+| `@redeemid/emdash/search` | `readableResults()`, for a search page that calls EmDash's `search()` |
 | `@redeemid/emdash/contract` | The stable API as a list, and `API_VERSION` |
 
 The full developer API (stable exports, JSON routes, the browser client and its events, MCP tools) is in [docs/developer-api.md](docs/developer-api.md).
@@ -649,7 +662,7 @@ Reword one with `messages={{ cart_empty: "…" }}`, or for every page with `text
 - Shopify is the only source of entitlements. Nothing on the site grants access.
 - Levels read the mirrored tags as they are, however old. They change only when Shopify sends new ones.
 - Enabled or disabled status comes only from the `customers/enable` and `customers/disable` webhooks.
-- Locked content never reaches the content API, search, feeds or the sitemap for readers kept out, nor a page that renders bodies with `<Content>` (the Status page flags templates that use `<PortableText>` for a gated collection). The end-to-end test checks each of these. Members are refused EmDash's own APIs except what they need.
+- Locked content never reaches the content API, site search (snippets, or which entry matched), feeds or the sitemap for readers kept out, nor a page that renders bodies with `<Content>` (the Status page flags templates that use `<PortableText>` for a gated collection). The end-to-end test checks each of these. Members are refused EmDash's own APIs except what they need.
 - Staff accounts (any EmDash role above Subscriber) can't sign in through the store, even with a matching email. When that happens, the store session ends too, so the next sign-in attempt starts fresh.
 - Customers can't create the first (admin) account on a new site.
 - Webhooks are checked against the app's signature before anything changes.

package/docs/developer-api.md

@@ -1,6 +1,6 @@
 # Developer API
 
-What site code, other plugins and AI agents can rely on in `@redeemid/emdash`. API version **1.1.0** (`API_VERSION` in `@redeemid/emdash/contract`, also in `api/state` and `window.redeemid.apiVersion`).
+What site code, other plugins and AI agents can rely on in `@redeemid/emdash`. API version **1.2.0** (`API_VERSION` in `@redeemid/emdash/contract`, also in `api/state` and `window.redeemid.apiVersion`).
 
 Everything on this page is stable: it changes only with a changelog entry and an API version bump (minor when something is added, major when something changes or goes). Anything not listed is internal, even when a module exports it. `src/contract.ts` is the same list as code, and a test fails when the code, that list and this page disagree.
 
@@ -24,6 +24,7 @@ Import these in Astro pages, components and endpoints.
 | `@redeemid/emdash/catalog` | `searchProducts`, `collectionPage`, `suggest`, `recommendations`, `browseFromUrl`, `browseHref`, `parseFilters`, `priceFilter`, `SORTS` |
 | `@redeemid/emdash/events` | `signBody` |
 | `@redeemid/emdash/text` | `STRINGS`, `text`, `textParts` |
+| `@redeemid/emdash/search` | `readableResults` |
 
 Functions that take a `config` want the site's config for the request: `await siteConfig(Astro.locals)`, which is the code's config with the admin's saved settings laid over it. Passing the object from `astro.config.mjs` instead skips what staff saved on the Access page. A few examples:
 
@@ -50,7 +51,7 @@ Under `/_emdash/api/auth/redeemid/`. Same-origin only: EmDash checks `Origin` on
 - `api/state` (GET): the visitor's own state.
 
   ```json
-  { "apiVersion": "1.1.0", "version": "0.0.21", "signedIn": true, "linked": true,
+  { "apiVersion": "1.2.0", "version": "0.0.22", "signedIn": true, "linked": true,
     "levels": ["gold"], "features": ["ad-free"], "cart": { "count": 2 },
     "meter": { "used": 1, "limit": 3, "period": "month" } }
   ```

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.21",
+	"version": "0.0.22",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -13,6 +13,7 @@
 	"exports": {
 		".": "./src/index.ts",
 		"./access": "./src/access.ts",
+		"./search": "./src/search-guard.ts",
 		"./guard.ts": "./src/guard.ts",
 		"./rate-limit-cloudflare.ts": "./src/rate-limit-cloudflare.ts",
 		"./templates.ts": "./src/templates.ts",

package/src/agents.ts

@@ -72,7 +72,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 	const required: Requirement = applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own);
 	const owned = !disabled && holdsItem(item, tags);
 	const canReadRule = owned || required === null || (signedIn && !disabled && passes(held, required));
-	const name = (slug: string) => levels.find((l) => l.slug === slug)?.name ?? slug;
+	const name = (slug: string) => (slug === "signed-in" ? "Signed in" : (levels.find((l) => l.slug === slug)?.name ?? slug));
 	const partResults = parts.map((clause) => ({
 		needs: clause.map(name),
 		canRead: owned || (signedIn && !disabled && (clause.includes("signed-in") || clause.some((l) => held.includes(l)))),

package/src/api-version.ts

@@ -3,4 +3,4 @@
  * when something is added, the major part when something stable changes or
  * goes. Separate from the package version.
  */
-export const API_VERSION = "1.1.0";
+export const API_VERSION = "1.2.0";

package/src/blocks-names.ts

@@ -62,7 +62,8 @@ type TextNode = { _type?: unknown; children?: Array<{ text?: unknown }> };
 /**
  * The text blocks within the first `words` words of a body:
  * a block is never cut in half, so a block that would pass the count ends the
- * teaser. Images and custom blocks are left out. 0 gives nothing.
+ * teaser. Images and custom blocks are left out. A "Members only" part ends
+ * it too: its text is never teaser. 0 gives nothing.
  */
 export function teaser<T>(value: T[] | null | undefined, words: number): T[] {
 	if (!Array.isArray(value) || !(words > 0)) return [];
@@ -70,6 +71,7 @@ export function teaser<T>(value: T[] | null | undefined, words: number): T[] {
 	let count = 0;
 	for (const b of value) {
 		const node = b as TextNode;
+		if (node?._type === MEMBERS_BLOCK) break;
 		if (node?._type !== "block") continue;
 		const text = (node.children ?? []).map((c) => (typeof c.text === "string" ? c.text : "")).join("");
 		count += text.split(/\s+/).filter(Boolean).length;

package/src/components/LockedPanel.astro

@@ -10,7 +10,7 @@
  */
 import { membership, passes, refreshUrl, signInUrl, viewer, type Reason } from "../access.js";
 import type { SoldItem } from "../blocks-names.js";
-import { plan as loadPlan } from "../storefront.js";
+import { money, plan as loadPlan, storeContext } from "../storefront.js";
 import { siteConfig } from "../site-config.js";
 import { text, textParts } from "../text.js";
 
@@ -48,10 +48,9 @@ const week = meterPeriod === "week";
 let single: { handle: string; price: string } | null = null;
 if (item?.product && config && (reason === "sign_in" || reason === "upgrade" || reason === "drip")) {
 	try {
-		const p = await loadPlan(config, item.product);
-		if (p?.availableForSale && p.price) {
-			single = { handle: p.handle, price: new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount)) };
-		}
+		const p = await loadPlan(config, item.product, undefined, storeContext(config, Astro.request));
+		const price = p?.availableForSale ? money(p.price) : null;
+		if (p && price) single = { handle: p.handle, price };
 	} catch {
 		single = null;
 	}

package/src/components/Plan.astro

@@ -12,7 +12,7 @@
  */
 import { membership, viewer } from "../access.js";
 import { siteConfig } from "../site-config.js";
-import { plan as loadPlan, type Plan } from "../storefront.js";
+import { money, plan as loadPlan, storeContext, type Plan } from "../storefront.js";
 import { text } from "../text.js";
 
 interface Props {
@@ -33,14 +33,13 @@ const { handle, label = text(config, "Join"), title, levels = [], heldLabel = te
 let p: Plan | null = null;
 if (config) {
 	try {
-		p = await loadPlan(config, handle);
+		// The visitor's market, so the price is the one checkout charges.
+		p = await loadPlan(config, handle, undefined, storeContext(config, Astro.request));
 	} catch {
 		p = null;
 	}
 }
-const price = p?.price
-	? new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount))
-	: null;
+const price = money(p?.price);
 const here = Astro.url.pathname + Astro.url.search;
 const v = levels.length > 0 ? await viewer(Astro) : null;
 const held = Boolean(v?.levels.some((l) => levels.includes(l)));

package/src/contract.ts

@@ -23,6 +23,7 @@ export const MODULES = {
 	"@redeemid/emdash/catalog": ["searchProducts", "collectionPage", "suggest", "recommendations", "browseFromUrl", "browseHref", "parseFilters", "priceFilter", "SORTS"],
 	"@redeemid/emdash/events": ["signBody"],
 	"@redeemid/emdash/text": ["STRINGS", "text", "textParts"],
+	"@redeemid/emdash/search": ["readableResults"],
 } as const;
 
 /** Public JSON routes under /_emdash/api/auth/redeemid/. */

package/src/events.ts

@@ -7,7 +7,7 @@
  * Headers: X-RedeemID-Event (the name), X-RedeemID-Delivery (a fresh id) and
  * X-RedeemID-Signature: sha256=<hex HMAC of the raw body>. Events:
  * member.signed_in, member.levels_changed, meter.used, meter.exhausted,
- * preferences.saved.
+ * preferences.saved, member.erased.
  * Sending never blocks or breaks the page: events go out after the response
  * (waitUntil on Workers), are tried three times, and one that fails every
  * try is kept under App events → Failed events, where staff can send it

package/src/files.ts

@@ -16,7 +16,7 @@
  * match case-insensitively. Access still comes only from Shopify tags.
  */
 
-import { readEntry, viewer, type AstroLike, type Terms } from "./access.js";
+import { readEntry, SIGNED_IN, viewer, type AstroLike, type Terms } from "./access.js";
 import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem, splitAtPaywall } from "./blocks-names.js";
 import type { FileRule, RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
@@ -78,18 +78,22 @@ async function entriesUsing(db: unknown, mediaId: string): Promise<Array<{ colle
 		.filter((e) => !seen.has(`${e.collection}:${e.id}`) && Boolean(seen.add(`${e.collection}:${e.id}`)));
 }
 
-/** The levels picked on an entry body's breaks and members-only parts: readers must hold one from each. */
+/**
+ * The levels picked on an entry body's breaks and members-only parts: readers
+ * must hold one from each. A members-only part with none picked needs a
+ * signed-in reader (on top of the entry's rule, which the caller checks).
+ */
 export function bodyClauses(body: unknown): string[][] {
 	const blocks = Array.isArray(body) ? body : [];
 	const out: string[][] = [];
 	const split = splitAtPaywall(blocks);
 	if (split.paywall && split.levels.length) out.push(split.levels);
-	for (const s of sections(blocks)) if (s.members && s.levels.length) out.push(s.levels);
+	for (const s of sections(blocks)) if (s.members) out.push(s.levels.length ? s.levels : [SIGNED_IN]);
 	return out;
 }
 
 /** May this reader read the whole entry: its rule, drip, and every part with levels picked? */
-async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
+export async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
 	const { getEmDashEntry } = await import("emdash");
 	const result = (await getEmDashEntry(entry.collection, entry.id)) as { entry?: { data?: Record<string, unknown> } | null } | null;
 	const data = result?.entry?.data;
@@ -104,7 +108,7 @@ async function readsWhole(astro: AstroLike, entry: { collection: string; id: str
 	const verdict = await readEntry(astro, { collection: entry.collection, terms, ruleId: entry.id });
 	if (!verdict.allowed) return false;
 	const clauses = bodyClauses(body);
-	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === "signed-in" && verdict.viewer.signedIn)));
+	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === SIGNED_IN && verdict.viewer.signedIn)));
 }
 
 export function ruleFor(config: RedeemIDConfig | null, folder: string | null): FileRule | null {

package/src/guard.ts

@@ -24,6 +24,7 @@ import { defineMiddleware } from "astro:middleware";
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
 import { keysFromUrl, pathAccess, refusal } from "./files.js";
+import { guardSearch, SEARCH_PATH, SUGGEST_PATH } from "./search-guard.js";
 import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { shareConfig, siteConfig } from "./site-config.js";
 
@@ -38,8 +39,12 @@ export const MEMBER_PATHS = [
 	"/_emdash/api/plugins/",
 ];
 
+/** Exact paths members may use: site search (results filtered by the guard) and its title suggestions. */
+export const MEMBER_EXACT = [SEARCH_PATH, SUGGEST_PATH];
+
 export function memberMayUse(path: string, extra: string[] = []): boolean {
 	if (!path.startsWith("/_emdash")) return true;
+	if (MEMBER_EXACT.includes(path)) return true;
 	return [...MEMBER_PATHS, ...extra].some((p) => path === p.replace(/\/$/, "") || path.startsWith(p));
 }
 
@@ -123,6 +128,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		return own ? keepPrivate(context, await next()) : next();
 	}
 
+	// Site search answers visitors and members only with what they may read.
+	if (url.pathname === SEARCH_PATH && config && (!user || (user.role ?? 0) <= SUBSCRIBER)) {
+		try {
+			return await guardSearch(context, url, await next());
+		} catch (e) {
+			console.error("[redeemid] search check failed:", (e as Error).message);
+			return new Response(JSON.stringify({ error: { code: "SEARCH_ERROR", message: "Search failed" } }), { status: 500, headers: { "content-type": "application/json", "cache-control": "private, no-store" } });
+		}
+	}
+
 	if (!user || user.role !== SUBSCRIBER) return next();
 
 	if (memberMayUse(url.pathname, config?.memberPaths)) return next();

package/src/routes/buy.ts

@@ -30,7 +30,8 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 	if (!/^[a-z0-9][a-z0-9-]*$/i.test(handle)) return fail(redirect, returnTo, "plan_unavailable");
 
 	try {
-		const p = await plan(config, handle);
+		const context = storeContext(config, request);
+		const p = await plan(config, handle, undefined, context);
 		if (!p?.variantId || !p.availableForSale) return fail(redirect, returnTo, "plan_unavailable");
 		// Provider routes are public, so read the member from the session.
 		const user = await sessionUser(session, emdash?.db);
@@ -40,7 +41,7 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context: storeContext(config, request) },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context },
 		);
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
 		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }), 303);

package/src/routes/callback.ts

@@ -139,7 +139,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
 		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
 
-		session.regenerate?.();
+		// A new session id for the signed-in session (it keeps the data so far).
+		await session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
 		// Kept only for signed-in checkout, and sealed (see token-vault.ts).

package/src/search-guard.ts

@@ -0,0 +1,100 @@
+/**
+ * EmDash's site search (/_emdash/api/search) is public. It matches the
+ * collection's searchable fields, entry bodies included, and answers with a
+ * snippet of the text around the match. Without this, anyone could search for
+ * a word from a locked entry and read the text around it, or learn which
+ * locked entries contain it.
+ *
+ * For visitors and members (never staff), each result is checked like a
+ * protected file's entry: the reader must be able to read the whole entry
+ * (its rule, drip, and every part with levels picked). A result they can't
+ * read keeps its title, which lists show anyway, but loses its snippet, and
+ * it stays in the results only when its title matches every searched word.
+ */
+
+import type { AstroLike } from "./access.js";
+
+/** Loaded when used: the access checks read the site's build-time config. */
+async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
+	return (await import("./files.js")).readsWhole(astro, entry);
+}
+
+export const SEARCH_PATH = "/_emdash/api/search";
+/** Title suggestions only: nothing from bodies. */
+export const SUGGEST_PATH = "/_emdash/api/search/suggest";
+const SUBSCRIBER = 10;
+
+interface Result {
+	collection?: unknown;
+	id?: unknown;
+	title?: unknown;
+	snippet?: unknown;
+}
+
+/** The searched words, lowercased. */
+export function words(q: string): string[] {
+	return q.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+}
+
+/** Does the title hold every searched word (as a word or the start of one)? */
+export function titleMatches(title: unknown, q: string): boolean {
+	if (typeof title !== "string") return false;
+	const have = words(title);
+	const want = words(q);
+	return want.length > 0 && want.every((w) => have.some((h) => h.startsWith(w)));
+}
+
+/**
+ * Filter one search answer for this reader. `readable` decides one result;
+ * a failed check counts as unreadable.
+ */
+export async function filterResults(
+	items: Result[],
+	q: string,
+	readable: (collection: string, id: string) => Promise<boolean>,
+): Promise<Result[]> {
+	const out: Result[] = [];
+	for (const item of items) {
+		const collection = typeof item.collection === "string" ? item.collection : "";
+		const id = typeof item.id === "string" ? item.id : "";
+		const ok = collection && id ? await readable(collection, id).catch(() => false) : false;
+		if (ok) {
+			out.push(item);
+			continue;
+		}
+		if (!titleMatches(item.title, q)) continue;
+		const { snippet: _gone, ...rest } = item;
+		out.push(rest);
+	}
+	return out;
+}
+
+/**
+ * For a site's own search page that calls EmDash's `search()` in its
+ * template: the results this reader may see, filtered like the API's.
+ *
+ *   const results = await readableResults(Astro, q, (await search(q)).items);
+ */
+export async function readableResults<T extends Result>(astro: AstroLike, q: string, items: T[]): Promise<T[]> {
+	const role = (astro.locals as { user?: { role?: number } | null }).user?.role ?? 0;
+	if (role > SUBSCRIBER) return items;
+	return (await filterResults(items, q, (collection, id) => readsWhole(astro, { collection, id }))) as T[];
+}
+
+/** The search answer with locked text taken out (see above). Other answers pass as they are. */
+export async function guardSearch(astro: AstroLike, url: URL, res: Response): Promise<Response> {
+	if (!res.ok || !(res.headers.get("content-type") ?? "").includes("json")) return res;
+	let body: { data?: { items?: Result[] } };
+	try {
+		body = (await res.clone().json()) as typeof body;
+	} catch {
+		return res;
+	}
+	const items = body.data?.items;
+	if (!Array.isArray(items)) return res;
+	const q = url.searchParams.get("q") ?? "";
+	const filtered = await filterResults(items, q, (collection, id) => readsWhole(astro, { collection, id }));
+	const out = new Response(JSON.stringify({ ...body, data: { ...body.data, items: filtered } }), { status: res.status, headers: res.headers });
+	out.headers.delete("content-length");
+	return out;
+}

package/src/storefront.ts

@@ -128,13 +128,17 @@ interface PlanData {
 	} | null;
 }
 
-/** A product by handle, cached for five minutes. Null when Shopify has no such product. */
-export async function plan(config: RedeemIDConfig, handle: string, fetcher?: typeof fetch): Promise<Plan | null> {
-	const key = `${shopOrigin(config)}|${handle}`;
+/**
+ * A product by handle, cached for five minutes. Null when Shopify has no such
+ * product. Pass `context` (storeContext) so the price is the visitor's
+ * market's, the one checkout will charge.
+ */
+export async function plan(config: RedeemIDConfig, handle: string, fetcher?: typeof fetch, context?: StoreContext): Promise<Plan | null> {
+	const key = `${shopOrigin(config)}|${handle}|${contextKey(context)}`;
 	const hit = planCache.get(key);
 	if (hit && Date.now() - hit.at < PLAN_TTL_MS) return hit.value;
 
-	const { product: p } = await storefront<PlanData>(config, PLAN_QUERY, { handle }, { fetcher });
+	const { product: p } = await storefront<PlanData>(config, PLAN_QUERY, { handle }, { fetcher, context });
 	const variant = p?.variants.nodes[0] ?? null;
 	const value: Plan | null = p
 		? {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.21";
+export const VERSION = "0.0.22";

package/src/webhooks.ts

@@ -144,7 +144,10 @@ export async function apply(
 	if (!id) return "skipped";
 
 	if (kind === "delete") {
+		const gone = await s.members.get(id);
 		await s.members.delete(id);
+		// The levels end with the customer: receivers of member.levels_changed hear it.
+		if (gone) await onWrite?.([...gone.tags], { ...gone, tags: [] });
 		return "processed";
 	}