@redeemid/emdash 0.0.21 → 0.0.23

package/src/files.ts

@@ -16,7 +16,7 @@
  * match case-insensitively. Access still comes only from Shopify tags.
  */
 
-import { readEntry, viewer, type AstroLike, type Terms } from "./access.js";
+import { readEntry, SIGNED_IN, viewer, type AstroLike, type Terms } from "./access.js";
 import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem, splitAtPaywall } from "./blocks-names.js";
 import type { FileRule, RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
@@ -78,18 +78,22 @@ async function entriesUsing(db: unknown, mediaId: string): Promise<Array<{ colle
 		.filter((e) => !seen.has(`${e.collection}:${e.id}`) && Boolean(seen.add(`${e.collection}:${e.id}`)));
 }
 
-/** The levels picked on an entry body's breaks and members-only parts: readers must hold one from each. */
+/**
+ * The levels picked on an entry body's breaks and members-only parts: readers
+ * must hold one from each. A members-only part with none picked needs a
+ * signed-in reader (on top of the entry's rule, which the caller checks).
+ */
 export function bodyClauses(body: unknown): string[][] {
 	const blocks = Array.isArray(body) ? body : [];
 	const out: string[][] = [];
 	const split = splitAtPaywall(blocks);
 	if (split.paywall && split.levels.length) out.push(split.levels);
-	for (const s of sections(blocks)) if (s.members && s.levels.length) out.push(s.levels);
+	for (const s of sections(blocks)) if (s.members) out.push(s.levels.length ? s.levels : [SIGNED_IN]);
 	return out;
 }
 
 /** May this reader read the whole entry: its rule, drip, and every part with levels picked? */
-async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
+export async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
 	const { getEmDashEntry } = await import("emdash");
 	const result = (await getEmDashEntry(entry.collection, entry.id)) as { entry?: { data?: Record<string, unknown> } | null } | null;
 	const data = result?.entry?.data;
@@ -104,7 +108,7 @@ async function readsWhole(astro: AstroLike, entry: { collection: string; id: str
 	const verdict = await readEntry(astro, { collection: entry.collection, terms, ruleId: entry.id });
 	if (!verdict.allowed) return false;
 	const clauses = bodyClauses(body);
-	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === "signed-in" && verdict.viewer.signedIn)));
+	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === SIGNED_IN && verdict.viewer.signedIn)));
 }
 
 export function ruleFor(config: RedeemIDConfig | null, folder: string | null): FileRule | null {

package/src/guard.ts

@@ -24,6 +24,7 @@ import { defineMiddleware } from "astro:middleware";
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
 import { keysFromUrl, pathAccess, refusal } from "./files.js";
+import { guardSearch, SEARCH_PATH, SUGGEST_PATH } from "./search-guard.js";
 import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { shareConfig, siteConfig } from "./site-config.js";
 
@@ -38,8 +39,12 @@ export const MEMBER_PATHS = [
 	"/_emdash/api/plugins/",
 ];
 
+/** Exact paths members may use: site search (results filtered by the guard) and its title suggestions. */
+export const MEMBER_EXACT = [SEARCH_PATH, SUGGEST_PATH];
+
 export function memberMayUse(path: string, extra: string[] = []): boolean {
 	if (!path.startsWith("/_emdash")) return true;
+	if (MEMBER_EXACT.includes(path)) return true;
 	return [...MEMBER_PATHS, ...extra].some((p) => path === p.replace(/\/$/, "") || path.startsWith(p));
 }
 
@@ -123,6 +128,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		return own ? keepPrivate(context, await next()) : next();
 	}
 
+	// Site search answers visitors and members only with what they may read.
+	if (url.pathname === SEARCH_PATH && config && (!user || (user.role ?? 0) <= SUBSCRIBER)) {
+		try {
+			return await guardSearch(context, url, await next());
+		} catch (e) {
+			console.error("[redeemid] search check failed:", (e as Error).message);
+			return new Response(JSON.stringify({ error: { code: "SEARCH_ERROR", message: "Search failed" } }), { status: 500, headers: { "content-type": "application/json", "cache-control": "private, no-store" } });
+		}
+	}
+
 	if (!user || user.role !== SUBSCRIBER) return next();
 
 	if (memberMayUse(url.pathname, config?.memberPaths)) return next();

package/src/log.ts

@@ -42,6 +42,7 @@ export const LOG_EVENTS: Record<string, string> = {
 	"shopify.admin": "Admin API call",
 	"staff.resync": "Resync",
 	"staff.tags": "Tag edit",
+	"staff.link": "Account link",
 	"staff.webhooks": "Webhook registration",
 	"settings.saved": "Settings saved",
 	"events.failed": "Outbound event failed",

package/src/plugin.ts

@@ -28,17 +28,17 @@
 import type { PluginContext, ResolvedPlugin, RouteContext } from "emdash";
 import { definePlugin } from "emdash";
 
-import { levelsFor, SIGNED_IN, type Terms } from "./access.js";
+import { levelsFor, SIGNED_IN, topLevels, type Terms } from "./access.js";
 import { accessAction, accessPage, entryPanel, entrySave, entrySlugChanged, isAccessAction, type AccessEnv, type PanelEntry } from "./access-admin.js";
 import { deleteAccess, entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
-import { env, ENV, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
+import { env, ENV, shopOrigin, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
 import { EDITOR_PANELS, PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
 import { AdminError, adminConfigured } from "./admin-api.js";
 import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
-import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit } from "./staff.js";
+import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, staffLink, staffUnlink, tagEdit } from "./staff.js";
 import { textProblems } from "./text.js";
 import { gatedFindings, templateFindings } from "./template-scan.js";
 import { setupFacts, setupPage, WEBHOOK } from "./setup.js";
@@ -539,6 +539,20 @@ async function action(
 				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
 			}
 		}
+		case "member_link":
+		case "member_unlink": {
+			const id = i.action_id === "member_link" ? String(i.block_id ?? "").replace(/^link:/, "") : String(i.value ?? "");
+			try {
+				const { getDb } = await import("emdash/runtime");
+				const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+				const adapter = createKyselyAdapter((await getDb()) as never);
+				const m = i.action_id === "member_link" ? await staffLink(adapter, s, id, i.values?.email) : await staffUnlink(adapter, s, id);
+				return memberDetail(config, m, { type: "success", message: m.userId ? "Linked. Their next sign-in uses that site user." : "Unlinked." });
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
 		case "member_tag_add":
 		case "member_tag_remove": {
 			const add = i.action_id === "member_tag_add";
@@ -675,7 +689,7 @@ async function membersPage(config: RedeemIDConfig) {
 	}));
 	const name = (m: MemberRecord) => [m.firstName, m.lastName].filter(Boolean).join(" ") || "No name";
 	const levelNames = (m: MemberRecord) => {
-		const held = levelsFor(m.tags, levels);
+		const held = topLevels(levelsFor(m.tags, levels), levels);
 		return levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ");
 	};
 	return {
@@ -812,6 +826,7 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 						},
 					]
 				: []),
+			...customDomainBlocks(config),
 			...templateBlocks(config),
 			{ type: "context", text: "Setting up a store step by step is under Setup. Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
 			{ type: "divider" },
@@ -831,6 +846,30 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	};
 }
 
+/**
+ * Status: the Admin API (staff tools, webhook registration, tag reads) only
+ * answers on the store's myshopify.com domain, so a custom domain in `shop`
+ * breaks it while sign-in still works.
+ */
+export function customDomainBlocks(config: RedeemIDConfig): unknown[] {
+	if (!adminConfigured() || config.allowInsecureShop) return [];
+	let host = "";
+	try {
+		host = new URL(shopOrigin(config)).hostname;
+	} catch {
+		return [];
+	}
+	if (host.endsWith(".myshopify.com")) return [];
+	return [
+		{
+			type: "banner",
+			variant: "alert",
+			title: "Use the myshopify.com domain",
+			description: `The store domain is ${host}. Shopify's Admin API, which the staff tools, webhook registration and tag reads use, only answers on the store's myshopify.com domain. Set REDEEMID_SHOPIFY_STORE_DOMAIN (or shop) to it; sign-in works with it too.`,
+		},
+	];
+}
+
 /** Status: templates that would show a gated body in full (see template-scan.ts). */
 function templateBlocks(config: RedeemIDConfig): unknown[] {
 	const found = templateFindings();

package/src/privacy.ts

@@ -82,22 +82,25 @@ export async function eraseMember(config: RedeemIDConfig | null, s: Stores, cust
 	return Boolean(member);
 }
 
-/** shop/redact: erase every member and meter record. */
+/**
+ * shop/redact: erase every member and meter record. Deletes a page of 100 at
+ * a time in one statement, so even a large shop stays well inside a Workers
+ * Free request's query limit (a few queries per hundred members).
+ */
 export async function eraseAll(config: RedeemIDConfig | null, s: Stores): Promise<number> {
 	let n = 0;
 	for (;;) {
 		const page = await s.members.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) {
-			for (const m of await meterFor(s, r.data.userId)) await s.meter.delete(m.id);
-			await s.members.delete(r.id);
-			n++;
-		}
+		const deleted = await s.members.deleteMany(page.items.map((r) => r.id));
+		n += page.items.length;
+		// A store that deletes nothing would loop forever.
+		if (deleted === 0) throw new Error("shop/redact: members could not be deleted");
 	}
 	for (;;) {
 		const page = await s.meter.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) await s.meter.delete(r.id);
+		if ((await s.meter.deleteMany(page.items.map((r) => r.id))) === 0) throw new Error("shop/redact: meter records could not be deleted");
 	}
 	await log(s, { kind: "erase", source: "shopify", customerId: null, status: "done", note: `Shop redacted: ${n} members` });
 	return n;

package/src/routes/buy.ts

@@ -30,7 +30,8 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 	if (!/^[a-z0-9][a-z0-9-]*$/i.test(handle)) return fail(redirect, returnTo, "plan_unavailable");
 
 	try {
-		const p = await plan(config, handle);
+		const context = storeContext(config, request);
+		const p = await plan(config, handle, undefined, context);
 		if (!p?.variantId || !p.availableForSale) return fail(redirect, returnTo, "plan_unavailable");
 		// Provider routes are public, so read the member from the session.
 		const user = await sessionUser(session, emdash?.db);
@@ -40,7 +41,7 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context: storeContext(config, request) },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context },
 		);
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
 		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }), 303);

package/src/routes/callback.ts

@@ -18,7 +18,7 @@ import { env, ENV, PROVIDER_ID, storeDomain } from "../config.js";
 import { siteConfig } from "../site-config.js";
 import { emit, levelChange } from "../events.js";
 import { record } from "../log.js";
-import { levelsFor } from "../access.js";
+import { levelsFor, memberHome } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
@@ -139,7 +139,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
 		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
 
-		session.regenerate?.();
+		// A new session id for the signed-in session (it keeps the data so far).
+		await session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
 		// Kept only for signed-in checkout, and sealed (see token-vault.ts).
@@ -148,7 +149,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			if (sealed) session.set(SESSION_CUSTOMER_TOKEN, sealed);
 			else session.delete?.(SESSION_CUSTOMER_TOKEN);
 		} else session.delete?.(SESSION_CUSTOMER_TOKEN);
-		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
+		if (flow.refresh) return fail(redirect, returnTo, "refreshed");
+		// From the home page or a plain sign-in link: the member's home for their level.
+		const home = returnTo === "/" && member.status !== "disabled" ? memberHome(who.tags, config.levels) : null;
+		return redirect(home ?? returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";
 		console.error("[redeemid] sign-in failed:", (e as Error).message);

package/src/routes/webhook.ts

@@ -16,7 +16,7 @@ import { stores, type Stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
 import type { RedeemIDConfig } from "../config.js";
 import { record } from "../log.js";
-import { apply, customerOf, kindOf, verifyHmac, type Outcome } from "../webhooks.js";
+import { apply, customerOf, kindOf, mergeIds, verifyHmac, type Outcome } from "../webhooks.js";
 
 export const prerender = false;
 
@@ -81,6 +81,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	try {
 		const config = await siteConfig(locals);
 		const outcome = (await currentTags(config, s, topic, customerId)) ?? (await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config));
+		if (outcome === "processed" && kindOf(topic) === "merge") await mergedTags(config, s, topic, payload);
 		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
 		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
@@ -112,3 +113,22 @@ async function currentTags(config: RedeemIDConfig | null, s: Stores, topic: stri
 		return null;
 	}
 }
+
+/**
+ * customers/merge moves the sign-in link to the customer kept, but the payload
+ * has no tags. With the Admin API app set up, read the survivor's tags now
+ * rather than wait for its next webhook or sign-in. A failed read leaves the
+ * merge as it is.
+ */
+async function mergedTags(config: RedeemIDConfig | null, s: Stores, topic: string, payload: Record<string, unknown>): Promise<void> {
+	const { kept } = mergeIds(payload);
+	if (!config || !kept || !adminConfigured()) return;
+	try {
+		const before = await s.members.get(kept);
+		if (!before) return;
+		const { updated } = await resync(config, s, [kept], topic);
+		if (updated[0]) await levelChange(config, before.tags, updated[0], topic);
+	} catch (e) {
+		console.error("[redeemid] merge resync failed:", (e as Error).message);
+	}
+}

package/src/search-guard.ts

@@ -0,0 +1,100 @@
+/**
+ * EmDash's site search (/_emdash/api/search) is public. It matches the
+ * collection's searchable fields, entry bodies included, and answers with a
+ * snippet of the text around the match. Without this, anyone could search for
+ * a word from a locked entry and read the text around it, or learn which
+ * locked entries contain it.
+ *
+ * For visitors and members (never staff), each result is checked like a
+ * protected file's entry: the reader must be able to read the whole entry
+ * (its rule, drip, and every part with levels picked). A result they can't
+ * read keeps its title, which lists show anyway, but loses its snippet, and
+ * it stays in the results only when its title matches every searched word.
+ */
+
+import type { AstroLike } from "./access.js";
+
+/** Loaded when used: the access checks read the site's build-time config. */
+async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
+	return (await import("./files.js")).readsWhole(astro, entry);
+}
+
+export const SEARCH_PATH = "/_emdash/api/search";
+/** Title suggestions only: nothing from bodies. */
+export const SUGGEST_PATH = "/_emdash/api/search/suggest";
+const SUBSCRIBER = 10;
+
+interface Result {
+	collection?: unknown;
+	id?: unknown;
+	title?: unknown;
+	snippet?: unknown;
+}
+
+/** The searched words, lowercased. */
+export function words(q: string): string[] {
+	return q.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+}
+
+/** Does the title hold every searched word (as a word or the start of one)? */
+export function titleMatches(title: unknown, q: string): boolean {
+	if (typeof title !== "string") return false;
+	const have = words(title);
+	const want = words(q);
+	return want.length > 0 && want.every((w) => have.some((h) => h.startsWith(w)));
+}
+
+/**
+ * Filter one search answer for this reader. `readable` decides one result;
+ * a failed check counts as unreadable.
+ */
+export async function filterResults(
+	items: Result[],
+	q: string,
+	readable: (collection: string, id: string) => Promise<boolean>,
+): Promise<Result[]> {
+	const out: Result[] = [];
+	for (const item of items) {
+		const collection = typeof item.collection === "string" ? item.collection : "";
+		const id = typeof item.id === "string" ? item.id : "";
+		const ok = collection && id ? await readable(collection, id).catch(() => false) : false;
+		if (ok) {
+			out.push(item);
+			continue;
+		}
+		if (!titleMatches(item.title, q)) continue;
+		const { snippet: _gone, ...rest } = item;
+		out.push(rest);
+	}
+	return out;
+}
+
+/**
+ * For a site's own search page that calls EmDash's `search()` in its
+ * template: the results this reader may see, filtered like the API's.
+ *
+ *   const results = await readableResults(Astro, q, (await search(q)).items);
+ */
+export async function readableResults<T extends Result>(astro: AstroLike, q: string, items: T[]): Promise<T[]> {
+	const role = (astro.locals as { user?: { role?: number } | null }).user?.role ?? 0;
+	if (role > SUBSCRIBER) return items;
+	return (await filterResults(items, q, (collection, id) => readsWhole(astro, { collection, id }))) as T[];
+}
+
+/** The search answer with locked text taken out (see above). Other answers pass as they are. */
+export async function guardSearch(astro: AstroLike, url: URL, res: Response): Promise<Response> {
+	if (!res.ok || !(res.headers.get("content-type") ?? "").includes("json")) return res;
+	let body: { data?: { items?: Result[] } };
+	try {
+		body = (await res.clone().json()) as typeof body;
+	} catch {
+		return res;
+	}
+	const items = body.data?.items;
+	if (!Array.isArray(items)) return res;
+	const q = url.searchParams.get("q") ?? "";
+	const filtered = await filterResults(items, q, (collection, id) => readsWhole(astro, { collection, id }));
+	const out = new Response(JSON.stringify({ ...body, data: { ...body.data, items: filtered } }), { status: res.status, headers: res.headers });
+	out.headers.delete("content-length");
+	return out;
+}

package/src/setup.ts

@@ -17,7 +17,7 @@
  */
 
 import { adminConfigured, adminScopes, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
-import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { env, ENV, levelTags, storeDomain, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import type { Stores } from "./storage.js";
 
@@ -100,7 +100,7 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 		admin,
 		scopes,
 		webhooksMissing,
-		levels: (config.levels ?? []).map((l) => ({ name: l.name, tags: l.tags })),
+		levels: (config.levels ?? []).map((l) => ({ name: l.name, tags: levelTags(l) })),
 		signedIn,
 		storefront: Boolean(env(ENV.storefrontPrivateToken) || env(ENV.storefrontPublicToken)),
 	};

package/src/staff.ts

@@ -6,12 +6,12 @@
 
 import { adminConfigured, adminScopes, editTags, registerWebhooks, resync, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
 import { applyEntryRule, describe, entryRuleFor, levelsFor, membership, passes, requirement, termTree, type Terms } from "./access.js";
-import type { RedeemIDConfig } from "./config.js";
+import { PROVIDER_ID, type RedeemIDConfig } from "./config.js";
 import { levelChange } from "./events.js";
 import { featuresFor } from "./features.js";
 import { record } from "./log.js";
 import { recentRequests } from "./privacy.js";
-import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
+import { cleanTags, memberForUser, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
 /**
@@ -100,11 +100,98 @@ export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Bl
 				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
 				: { type: "divider" },
 			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+			...linkSection(m),
 			...privacySection(m.customerId),
 		],
 	};
 }
 
+/** Linking the customer to a site user whose email differs, on their detail page. */
+function linkSection(m: MemberRecord): unknown[] {
+	return [
+		{ type: "header", text: "Site user" },
+		{
+			type: "context",
+			text: m.userId
+				? "This customer signs in as the site user linked below. Unlink to let their next sign-in pick the user by email again."
+				: "Signing in links the customer to the site user with the same verified email. When their emails differ, link them here: their next sign-in uses that user.",
+		},
+		m.userId
+			? {
+					type: "actions",
+					elements: [
+						{
+							type: "button",
+							action_id: "member_unlink",
+							label: "Unlink site user",
+							style: "danger",
+							value: m.customerId,
+							confirm: { title: "Unlink this site user?", text: "Their levels stop applying to that user until a sign-in links a user again. Nothing changes in Shopify.", confirm: "Unlink", deny: "Cancel", style: "danger" },
+						},
+					],
+				}
+			: {
+					type: "form",
+					block_id: `link:${m.customerId}`,
+					fields: [{ type: "text_input", action_id: "email", label: "Site user's email", placeholder: "reader@example.com" }],
+					submit: { label: "Link", action_id: "member_link" },
+				},
+	];
+}
+
+/** The parts of EmDash's auth adapter that linking uses. */
+export interface LinkAdapter {
+	getUserByEmail(email: string): Promise<{ id: string; role: number; disabled: boolean } | null>;
+	getOAuthAccount(provider: string, providerAccountId: string): Promise<{ userId: string } | null>;
+	getOAuthAccountsByUserId(userId: string): Promise<Array<{ provider: string; providerAccountId: string }>>;
+	createOAuthAccount(account: { provider: string; providerAccountId: string; userId: string }): Promise<unknown>;
+	deleteOAuthAccount(provider: string, providerAccountId: string): Promise<void>;
+}
+
+/** EmDash's Subscriber role: anything above it is staff. */
+const SUBSCRIBER = 10;
+
+export class LinkError extends Error {}
+
+/**
+ * Link a customer to an existing site user by the user's email, for a member
+ * whose store email differs. Only Subscribers, never staff, and never a user
+ * already linked to another customer. Access still comes only from the
+ * customer's Shopify tags.
+ */
+export async function staffLink(adapter: LinkAdapter, s: Stores, customerId: string, rawEmail: unknown): Promise<MemberRecord> {
+	const m = await s.members.get(customerId);
+	if (!m) throw new LinkError("That member is gone.");
+	if (m.userId) throw new LinkError("This customer is already linked. Unlink first.");
+	const email = String(rawEmail ?? "").trim().toLowerCase();
+	if (!email.includes("@")) throw new LinkError("Give the site user's email.");
+	const user = await adapter.getUserByEmail(email);
+	if (!user) throw new LinkError("No site user has that email.");
+	if (user.role > SUBSCRIBER) throw new LinkError("Staff accounts can't be linked to a store customer.");
+	if (user.disabled) throw new LinkError("That site user is turned off.");
+	const theirs = (await adapter.getOAuthAccountsByUserId(user.id)).find((a) => a.provider === PROVIDER_ID && a.providerAccountId !== customerId);
+	const other = theirs ? null : await memberForUser(s, user.id);
+	if (theirs || (other && other.customerId !== customerId)) throw new LinkError(`That site user is linked to customer ${theirs?.providerAccountId ?? other?.customerId}.`);
+	const held = await adapter.getOAuthAccount(PROVIDER_ID, customerId);
+	if (held && held.userId !== user.id) await adapter.deleteOAuthAccount(PROVIDER_ID, customerId);
+	if (!held || held.userId !== user.id) await adapter.createOAuthAccount({ provider: PROVIDER_ID, providerAccountId: customerId, userId: user.id });
+	const linked = { ...m, userId: user.id, linkedAt: m.linkedAt ?? new Date().toISOString() };
+	await s.members.put(customerId, linked);
+	await record({ event: "staff.link", label: "linked", status: "ok", origin: "staff", customerId });
+	return linked;
+}
+
+/** Undo a link: the customer's next sign-in picks a user by email again. */
+export async function staffUnlink(adapter: LinkAdapter, s: Stores, customerId: string): Promise<MemberRecord> {
+	const m = await s.members.get(customerId);
+	if (!m) throw new LinkError("That member is gone.");
+	if (await adapter.getOAuthAccount(PROVIDER_ID, customerId)) await adapter.deleteOAuthAccount(PROVIDER_ID, customerId);
+	const unlinked = { ...m, userId: null };
+	await s.members.put(customerId, unlinked);
+	await record({ event: "staff.link", label: "unlinked", status: "ok", origin: "staff", customerId });
+	return unlinked;
+}
+
 /** Export and erase for one member, on their detail page. */
 function privacySection(customerId: string): unknown[] {
 	const erase = {

package/src/storefront.ts

@@ -128,13 +128,17 @@ interface PlanData {
 	} | null;
 }
 
-/** A product by handle, cached for five minutes. Null when Shopify has no such product. */
-export async function plan(config: RedeemIDConfig, handle: string, fetcher?: typeof fetch): Promise<Plan | null> {
-	const key = `${shopOrigin(config)}|${handle}`;
+/**
+ * A product by handle, cached for five minutes. Null when Shopify has no such
+ * product. Pass `context` (storeContext) so the price is the visitor's
+ * market's, the one checkout will charge.
+ */
+export async function plan(config: RedeemIDConfig, handle: string, fetcher?: typeof fetch, context?: StoreContext): Promise<Plan | null> {
+	const key = `${shopOrigin(config)}|${handle}|${contextKey(context)}`;
 	const hit = planCache.get(key);
 	if (hit && Date.now() - hit.at < PLAN_TTL_MS) return hit.value;
 
-	const { product: p } = await storefront<PlanData>(config, PLAN_QUERY, { handle }, { fetcher });
+	const { product: p } = await storefront<PlanData>(config, PLAN_QUERY, { handle }, { fetcher, context });
 	const variant = p?.variants.nodes[0] ?? null;
 	const value: Plan | null = p
 		? {

package/src/text.ts

@@ -118,7 +118,7 @@ export const STRINGS = {
 		"I understand",
 		"Delete my data",
 	],
-	plan: ["Join", "Renew", "You're on this plan.", "Not available right now."],
+	plan: ["Join", "Renew", "Upgrade", "You're on this plan.", "Included in your {level} membership.", "Not available right now."],
 	preferences: ["Your preferences", "Save preferences", "Your preferences can't be loaded right now. Try again in a few minutes.", "Not set", "Yes", "No", "One per line."],
 	product: [
 		"Add to cart",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.21";
+export const VERSION = "0.0.23";

package/src/webhooks.ts

@@ -10,6 +10,12 @@ import { cleanTags, emptyMember, numericId, stampTags, type MemberRecord, type S
 import type { RedeemIDConfig } from "./config.js";
 import { eraseAll, eraseMember, shopifyDataRequest } from "./privacy.js";
 
+/** customers/merge: the customer kept and the one merged away, or nulls for a failed merge. */
+export function mergeIds(payload: Record<string, unknown>): { kept: string | null; gone: string | null } {
+	if (payload.status === "failed") return { kept: null, gone: null };
+	return { kept: numericId(payload.admin_graphql_api_customer_kept_id), gone: numericId(payload.admin_graphql_api_customer_deleted_id) };
+}
+
 export type Kind = "profile" | "delete" | "status" | "tags" | "merge" | "compliance" | "ignored";
 
 const TOPICS: Record<string, Kind> = {
@@ -124,9 +130,7 @@ export async function apply(
 	}
 
 	if (kind === "merge") {
-		if (payload.status === "failed") return "skipped";
-		const kept = numericId(payload.admin_graphql_api_customer_kept_id);
-		const gone = numericId(payload.admin_graphql_api_customer_deleted_id);
+		const { kept, gone } = mergeIds(payload);
 		if (!kept || !gone) return "skipped";
 		const old = await s.members.get(gone);
 		if (old?.userId) {
@@ -144,7 +148,10 @@ export async function apply(
 	if (!id) return "skipped";
 
 	if (kind === "delete") {
+		const gone = await s.members.get(id);
 		await s.members.delete(id);
+		// The levels end with the customer: receivers of member.levels_changed hear it.
+		if (gone) await onWrite?.([...gone.tags], { ...gone, tags: [] });
 		return "processed";
 	}