@redeemid/emdash 0.0.22 → 0.0.23

package/src/components/AccessBadge.astro

@@ -9,7 +9,7 @@
  * carries `data-redeemid-level` (the level slugs) for styling, and
  * `is-locked` with a lock for readers who can't read the members part.
  */
-import { canRead, describe, entryRequirement, viewer, type Terms } from "../access.js";
+import { badgeColor, canRead, describe, entryRequirement, simplify, viewer, type Terms } from "../access.js";
 import { holdsItem, soldItem, splitAtPaywall } from "../blocks-names.js";
 import { siteConfig } from "../site-config.js";
 import { text } from "../text.js";
@@ -37,12 +37,15 @@ const owner = item ? (await viewer(Astro)).member : null;
 const owned = Boolean(owner && owner.status !== "disabled" && holdsItem(item, owner.tags));
 const locked = required !== null && !owned && !(await canRead(Astro, { collection, terms, id }, { required })).allowed;
 const slugs = required?.flat().join(" ") || (required ? "signed-in" : "free");
+// The colour of the level the badge names first, when that level has one.
+const color = badgeColor(config?.levels?.find((l) => l.slug === simplify(required, config?.levels)?.find((c) => c.length)?.[0]));
 ---
 
 {label && (
 	<span
 		class:list={["redeemid-badge", { "is-locked": locked }, className]}
 		data-redeemid-level={slugs}
+		style={color ? `--redeemid-level-color: ${color}` : undefined}
 	>
 		{locked && <span class="redeemid-badge__lock" aria-hidden="true">🔒&#xFE0E; </span>}
 		{label}

package/src/components/Account.astro

@@ -3,20 +3,31 @@
  * Sign in link for visitors; name, levels, Account and Sign out for members.
  */
 import { siteConfig } from "../site-config.js";
-import { accountUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { accountUrl, badgeColor, signInUrl, signOutUrl, topLevels, viewer } from "../access.js";
 import { text } from "../text.js";
 
 const v = await viewer(Astro);
 const config = await siteConfig(Astro.locals);
 const here = Astro.url.pathname + Astro.url.search;
-const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).map((l) => l.name);
+// "Gold", not "Gold, Silver", when Gold includes Silver.
+const top = topLevels(v.levels, config?.levels);
+const held = (config?.levels ?? []).filter((l) => top.includes(l.slug));
 ---
 
 <div class="redeemid-account" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
 	{v.signedIn ? (
 		<>
 			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? text(config, "Signed in")}</span>
-			{names.length > 0 && <span class="redeemid-account__levels">{names.join(", ")}</span>}
+			{held.length > 0 && (
+				<span class="redeemid-account__levels">
+					{held.map((l, i) => (
+						<>
+							{i > 0 && ", "}
+							<span data-redeemid-level={l.slug} style={badgeColor(l) ? `--redeemid-level-color: ${badgeColor(l)}` : undefined}>{l.name}</span>
+						</>
+					))}
+				</span>
+			)}
 			<a class="redeemid-account__link" href={accountUrl(here)}>{text(config, "Account")}</a>
 			<form method="post" action={signOutUrl(here)}>
 				<button type="submit">{text(config, "Sign out")}</button>

package/src/components/MemberCard.astro

@@ -11,7 +11,7 @@
  * Everything shown comes from the mirrored Shopify customer; Refresh
  * membership reads it from the store again.
  */
-import { accountUrl, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { accountUrl, badgeColor, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
 import { featuresFor } from "../features.js";
 import { siteConfig } from "../site-config.js";
 import { text, textParts } from "../text.js";
@@ -29,6 +29,7 @@ const m = v.member;
 const disabled = m?.status === "disabled";
 const { current, past } = m && !disabled ? membership(m, config?.levels) : { current: [], past: [] };
 const meter = v.signedIn ? await meterUsage(Astro) : null;
+const color = (slug: string) => badgeColor(config?.levels?.find((l) => l.slug === slug));
 const held = m ? featuresFor(m, config?.features, config?.levels) : [];
 const features = (config?.features ?? []).filter((f) => held.includes(f.slug));
 const date = (iso: string | null) => {
@@ -59,8 +60,8 @@ const join = config?.join;
 				<p class="redeemid-member__disabled">{text(config, "Your account is turned off. Contact the store for help.")}</p>
 			) : current.length > 0 ? (
 				<ul class="redeemid-member__levels">
-					{current.map((l) => (
-						<li data-redeemid-level={l.slug}>
+					{current.filter((l) => !l.via).map((l) => (
+						<li data-redeemid-level={l.slug} style={color(l.slug) ? `--redeemid-level-color: ${color(l.slug)}` : undefined}>
 							<strong>{l.name}</strong>
 							{(dates.since ? day(dates.since) : date(l.since)) && <> {textParts(config, "since {date}", { date: <time datetime={dates.since ?? l.since ?? undefined}>{dates.since ? day(dates.since) : date(l.since)}</time> })}</>}
 						</li>

package/src/components/Plan.astro

@@ -6,11 +6,16 @@
  *
  *   <Plan handle="gold-membership" levels={["gold"]} />
  *
- * With `levels`, members who hold one of them see "You're on this plan"
- * in place of the button, and a member who held one before (Shopify removed
- * its tag) sees "Renew" instead of "Join".
+ * `levels` are the levels the plan gives; left out, they are the levels
+ * whose `products` list the handle. Then the card fits the member:
+ *
+ * - held: they hold one of them through its own tags: "You're on this plan."
+ * - included: a level they hold includes it: "Included in your Gold membership."
+ * - upgrade: the plan's level includes one they hold: the button says "Upgrade".
+ * - renew: they held one before (Shopify removed its tag): "Renew".
+ * - join: anyone else.
  */
-import { membership, viewer } from "../access.js";
+import { closure, directLevels, membership, topLevels, viewer } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { money, plan as loadPlan, storeContext, type Plan } from "../storefront.js";
 import { text } from "../text.js";
@@ -21,15 +26,19 @@ interface Props {
 	label?: string;
 	/** Heading override; defaults to the Shopify product title. */
 	title?: string;
-	/** The levels this plan gives. Members holding one see `heldLabel`, not the button. */
+	/** The levels this plan gives. Defaults to the levels whose `products` list `handle`. */
 	levels?: string[];
 	heldLabel?: string;
 	/** Button text for a member whose plan lapsed. */
 	renewLabel?: string;
+	/** Button text for a member this plan would move up. */
+	upgradeLabel?: string;
 }
 
 const config = await siteConfig(Astro.locals);
-const { handle, label = text(config, "Join"), title, levels = [], heldLabel = text(config, "You're on this plan."), renewLabel = text(config, "Renew") } = Astro.props;
+const { handle, label = text(config, "Join"), title, heldLabel = text(config, "You're on this plan."), renewLabel = text(config, "Renew"), upgradeLabel = text(config, "Upgrade") } = Astro.props;
+const all = config?.levels ?? [];
+const levels = Astro.props.levels?.length ? Astro.props.levels : all.filter((l) => l.products?.some((h) => h.toLowerCase() === handle.toLowerCase())).map((l) => l.slug);
 let p: Plan | null = null;
 if (config) {
 	try {
@@ -42,23 +51,34 @@ if (config) {
 const price = money(p?.price);
 const here = Astro.url.pathname + Astro.url.search;
 const v = levels.length > 0 ? await viewer(Astro) : null;
-const held = Boolean(v?.levels.some((l) => levels.includes(l)));
+const live = v?.member && v.member.status !== "disabled" ? v.member : null;
+const direct = live ? directLevels(live.tags, all) : [];
+const top = topLevels(v?.levels ?? [], all);
+const held = levels.some((l) => direct.includes(l));
+// Held only through a bigger level: name that one.
+const via = held ? undefined : top.find((t) => levels.some((l) => t !== l && closure(t, all).includes(l)));
+const viaName = via ? (all.find((l) => l.slug === via)?.name ?? via) : null;
+// The plan's level includes one the member holds: it moves them up.
+const upgrade = !held && !via && top.length > 0 && levels.some((l) => top.some((t) => t !== l && closure(l, all).includes(t)));
 // Lapsed: held one of these levels before. Offered their plan back, not "Join" as if new.
-const lapsed = Boolean(!held && v?.member && v.member.status !== "disabled" && membership(v.member, config?.levels).past.some((p) => levels.includes(p.slug)));
+const lapsed = Boolean(!held && !via && live && membership(live, all).past.some((p) => levels.includes(p.slug)));
+const state = held ? "held" : via ? "included" : upgrade ? "upgrade" : lapsed ? "renew" : "join";
 ---
 
 {p ? (
-	<div class:list={["redeemid-plan", { "is-held": held, "is-lapsed": lapsed }]} data-redeemid-plan={p.handle} data-redeemid-state={held ? "held" : lapsed ? "renew" : "join"}>
+	<div class:list={["redeemid-plan", { "is-held": held || Boolean(via), "is-lapsed": lapsed }]} data-redeemid-plan={p.handle} data-redeemid-state={state}>
 		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
 		{price && <p class="redeemid-plan__price">{price}</p>}
 		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
 		{held ? (
 			<p class="redeemid-plan__held">{heldLabel}</p>
+		) : viaName ? (
+			<p class="redeemid-plan__held">{text(config, "Included in your {level} membership.", { level: viaName })}</p>
 		) : p.availableForSale ? (
 			<form method="post" action="/_emdash/api/auth/redeemid/buy">
 				<input type="hidden" name="plan" value={p.handle} />
 				<input type="hidden" name="return" value={here} />
-				<button type="submit">{lapsed ? renewLabel : label}</button>
+				<button type="submit">{upgrade ? upgradeLabel : lapsed ? renewLabel : label}</button>
 			</form>
 		) : (
 			<p class="redeemid-plan__unavailable">{text(config, "Not available right now.")}</p>

package/src/config.ts

@@ -15,14 +15,65 @@ export interface LevelConfig {
 	slug: string;
 	/** Name shown to members. */
 	name: string;
-	/** Shopify customer tags that grant this level. Matched case-insensitively. */
-	tags: string[];
-	/** "any" (default): one of the tags is enough. "all": every tag is needed. */
+	/**
+	 * Shopify customer tags that grant this level. Matched case-insensitively.
+	 * This is the level's first tag group; `groups` adds more.
+	 */
+	tags?: string[];
+	/** For `tags`: "any" (default): one of the tags is enough. "all": every tag is needed. */
 	match?: "any" | "all";
+	/**
+	 * More tag groups, any one of which also grants the level: a level that is
+	 * "gold", or "silver" and "annual", is `tags: ["gold"]` with
+	 * `groups: [{ tags: ["silver", "annual"], match: "all" }]`.
+	 */
+	groups?: TagGroup[];
+	/**
+	 * Slugs of levels this one also opens: Gold with `includes: ["silver"]`
+	 * reads everything for Silver. Inclusion carries on (Gold includes Silver
+	 * includes Members), so rules name only the lowest level that may read.
+	 */
+	includes?: string[];
 	/** What the wall says to readers this level would let in, e.g. "Gold members read every investigation." */
 	wall?: string;
 	/** Where the wall's join link goes for this level. Falls back to `join.href`. */
 	joinUrl?: string;
+	/**
+	 * Handles of the Shopify products whose purchase leads to this level
+	 * (Flow or an app tags the buyer). Display only: plan cards use it to say
+	 * "You're on this plan", "Included in your Gold membership" or "Upgrade".
+	 * It grants nothing.
+	 */
+	products?: string[];
+	/**
+	 * Members' home: a same-site path members of this level land on after
+	 * signing in from the home page or a plain sign-in link, e.g. "/members/gold/".
+	 * Signing in from an entry returns them to it.
+	 */
+	home?: string;
+	/** Badge colour, a hex such as "#c9a227", set as `--redeemid-level-color` on badges and level names. Badges always show the name too. */
+	badge?: string;
+}
+
+/** One way to hold a level: any one of `tags`, or every one with `match: "all"`. */
+export interface TagGroup {
+	tags: string[];
+	match?: "any" | "all";
+}
+
+/** A level's tag groups: `tags`/`match` first, then `groups`. Empty groups are dropped. */
+export function groupsOf(level: LevelConfig): TagGroup[] {
+	const out: TagGroup[] = [];
+	if (level.tags?.length) out.push({ tags: level.tags, ...(level.match === "all" ? { match: "all" as const } : {}) });
+	for (const g of level.groups ?? []) {
+		if (g && Array.isArray(g.tags) && g.tags.length) out.push({ tags: g.tags, ...(g.match === "all" ? { match: "all" as const } : {}) });
+	}
+	return out;
+}
+
+/** Every tag any of the level's groups names, lower case. */
+export function levelTags(level: LevelConfig): string[] {
+	return [...new Set(groupsOf(level).flatMap((g) => g.tags.map((t) => t.toLowerCase())))];
 }
 
 /**

package/src/contract.ts

@@ -16,7 +16,7 @@ export { API_VERSION } from "./api-version.js";
 /** Stable exports, by import path. */
 export const MODULES = {
 	"@redeemid/emdash": ["redeemid", "redeemidGuard", "redeemidPlugin"],
-	"@redeemid/emdash/access": ["siteConfig", "viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
+	"@redeemid/emdash/access": ["siteConfig", "viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "topLevels", "closure", "simplify", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
 	"@redeemid/emdash/features": ["hasFeature", "viewerFeatures", "featuresFor"],
 	"@redeemid/emdash/preferences": ["readPreferences", "savePreferences", "preferenceFields"],
 	"@redeemid/emdash/storefront": ["plan", "product", "collection", "money", "realOptions", "variantFor", "storeContext", "cartDetails", "addToCart", "updateLines", "removeLines", "setDiscountCodes"],

package/src/log.ts

@@ -42,6 +42,7 @@ export const LOG_EVENTS: Record<string, string> = {
 	"shopify.admin": "Admin API call",
 	"staff.resync": "Resync",
 	"staff.tags": "Tag edit",
+	"staff.link": "Account link",
 	"staff.webhooks": "Webhook registration",
 	"settings.saved": "Settings saved",
 	"events.failed": "Outbound event failed",

package/src/plugin.ts

@@ -28,17 +28,17 @@
 import type { PluginContext, ResolvedPlugin, RouteContext } from "emdash";
 import { definePlugin } from "emdash";
 
-import { levelsFor, SIGNED_IN, type Terms } from "./access.js";
+import { levelsFor, SIGNED_IN, topLevels, type Terms } from "./access.js";
 import { accessAction, accessPage, entryPanel, entrySave, entrySlugChanged, isAccessAction, type AccessEnv, type PanelEntry } from "./access-admin.js";
 import { deleteAccess, entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
-import { env, ENV, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
+import { env, ENV, shopOrigin, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
 import { EDITOR_PANELS, PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
 import { AdminError, adminConfigured } from "./admin-api.js";
 import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
-import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit } from "./staff.js";
+import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, staffLink, staffUnlink, tagEdit } from "./staff.js";
 import { textProblems } from "./text.js";
 import { gatedFindings, templateFindings } from "./template-scan.js";
 import { setupFacts, setupPage, WEBHOOK } from "./setup.js";
@@ -539,6 +539,20 @@ async function action(
 				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
 			}
 		}
+		case "member_link":
+		case "member_unlink": {
+			const id = i.action_id === "member_link" ? String(i.block_id ?? "").replace(/^link:/, "") : String(i.value ?? "");
+			try {
+				const { getDb } = await import("emdash/runtime");
+				const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+				const adapter = createKyselyAdapter((await getDb()) as never);
+				const m = i.action_id === "member_link" ? await staffLink(adapter, s, id, i.values?.email) : await staffUnlink(adapter, s, id);
+				return memberDetail(config, m, { type: "success", message: m.userId ? "Linked. Their next sign-in uses that site user." : "Unlinked." });
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
 		case "member_tag_add":
 		case "member_tag_remove": {
 			const add = i.action_id === "member_tag_add";
@@ -675,7 +689,7 @@ async function membersPage(config: RedeemIDConfig) {
 	}));
 	const name = (m: MemberRecord) => [m.firstName, m.lastName].filter(Boolean).join(" ") || "No name";
 	const levelNames = (m: MemberRecord) => {
-		const held = levelsFor(m.tags, levels);
+		const held = topLevels(levelsFor(m.tags, levels), levels);
 		return levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ");
 	};
 	return {
@@ -812,6 +826,7 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 						},
 					]
 				: []),
+			...customDomainBlocks(config),
 			...templateBlocks(config),
 			{ type: "context", text: "Setting up a store step by step is under Setup. Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
 			{ type: "divider" },
@@ -831,6 +846,30 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	};
 }
 
+/**
+ * Status: the Admin API (staff tools, webhook registration, tag reads) only
+ * answers on the store's myshopify.com domain, so a custom domain in `shop`
+ * breaks it while sign-in still works.
+ */
+export function customDomainBlocks(config: RedeemIDConfig): unknown[] {
+	if (!adminConfigured() || config.allowInsecureShop) return [];
+	let host = "";
+	try {
+		host = new URL(shopOrigin(config)).hostname;
+	} catch {
+		return [];
+	}
+	if (host.endsWith(".myshopify.com")) return [];
+	return [
+		{
+			type: "banner",
+			variant: "alert",
+			title: "Use the myshopify.com domain",
+			description: `The store domain is ${host}. Shopify's Admin API, which the staff tools, webhook registration and tag reads use, only answers on the store's myshopify.com domain. Set REDEEMID_SHOPIFY_STORE_DOMAIN (or shop) to it; sign-in works with it too.`,
+		},
+	];
+}
+
 /** Status: templates that would show a gated body in full (see template-scan.ts). */
 function templateBlocks(config: RedeemIDConfig): unknown[] {
 	const found = templateFindings();

package/src/privacy.ts

@@ -82,22 +82,25 @@ export async function eraseMember(config: RedeemIDConfig | null, s: Stores, cust
 	return Boolean(member);
 }
 
-/** shop/redact: erase every member and meter record. */
+/**
+ * shop/redact: erase every member and meter record. Deletes a page of 100 at
+ * a time in one statement, so even a large shop stays well inside a Workers
+ * Free request's query limit (a few queries per hundred members).
+ */
 export async function eraseAll(config: RedeemIDConfig | null, s: Stores): Promise<number> {
 	let n = 0;
 	for (;;) {
 		const page = await s.members.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) {
-			for (const m of await meterFor(s, r.data.userId)) await s.meter.delete(m.id);
-			await s.members.delete(r.id);
-			n++;
-		}
+		const deleted = await s.members.deleteMany(page.items.map((r) => r.id));
+		n += page.items.length;
+		// A store that deletes nothing would loop forever.
+		if (deleted === 0) throw new Error("shop/redact: members could not be deleted");
 	}
 	for (;;) {
 		const page = await s.meter.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) await s.meter.delete(r.id);
+		if ((await s.meter.deleteMany(page.items.map((r) => r.id))) === 0) throw new Error("shop/redact: meter records could not be deleted");
 	}
 	await log(s, { kind: "erase", source: "shopify", customerId: null, status: "done", note: `Shop redacted: ${n} members` });
 	return n;

package/src/routes/callback.ts

@@ -18,7 +18,7 @@ import { env, ENV, PROVIDER_ID, storeDomain } from "../config.js";
 import { siteConfig } from "../site-config.js";
 import { emit, levelChange } from "../events.js";
 import { record } from "../log.js";
-import { levelsFor } from "../access.js";
+import { levelsFor, memberHome } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
@@ -149,7 +149,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			if (sealed) session.set(SESSION_CUSTOMER_TOKEN, sealed);
 			else session.delete?.(SESSION_CUSTOMER_TOKEN);
 		} else session.delete?.(SESSION_CUSTOMER_TOKEN);
-		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
+		if (flow.refresh) return fail(redirect, returnTo, "refreshed");
+		// From the home page or a plain sign-in link: the member's home for their level.
+		const home = returnTo === "/" && member.status !== "disabled" ? memberHome(who.tags, config.levels) : null;
+		return redirect(home ?? returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";
 		console.error("[redeemid] sign-in failed:", (e as Error).message);

package/src/routes/webhook.ts

@@ -16,7 +16,7 @@ import { stores, type Stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
 import type { RedeemIDConfig } from "../config.js";
 import { record } from "../log.js";
-import { apply, customerOf, kindOf, verifyHmac, type Outcome } from "../webhooks.js";
+import { apply, customerOf, kindOf, mergeIds, verifyHmac, type Outcome } from "../webhooks.js";
 
 export const prerender = false;
 
@@ -81,6 +81,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	try {
 		const config = await siteConfig(locals);
 		const outcome = (await currentTags(config, s, topic, customerId)) ?? (await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config));
+		if (outcome === "processed" && kindOf(topic) === "merge") await mergedTags(config, s, topic, payload);
 		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
 		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
@@ -112,3 +113,22 @@ async function currentTags(config: RedeemIDConfig | null, s: Stores, topic: stri
 		return null;
 	}
 }
+
+/**
+ * customers/merge moves the sign-in link to the customer kept, but the payload
+ * has no tags. With the Admin API app set up, read the survivor's tags now
+ * rather than wait for its next webhook or sign-in. A failed read leaves the
+ * merge as it is.
+ */
+async function mergedTags(config: RedeemIDConfig | null, s: Stores, topic: string, payload: Record<string, unknown>): Promise<void> {
+	const { kept } = mergeIds(payload);
+	if (!config || !kept || !adminConfigured()) return;
+	try {
+		const before = await s.members.get(kept);
+		if (!before) return;
+		const { updated } = await resync(config, s, [kept], topic);
+		if (updated[0]) await levelChange(config, before.tags, updated[0], topic);
+	} catch (e) {
+		console.error("[redeemid] merge resync failed:", (e as Error).message);
+	}
+}

package/src/setup.ts

@@ -17,7 +17,7 @@
  */
 
 import { adminConfigured, adminScopes, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
-import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { env, ENV, levelTags, storeDomain, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import type { Stores } from "./storage.js";
 
@@ -100,7 +100,7 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 		admin,
 		scopes,
 		webhooksMissing,
-		levels: (config.levels ?? []).map((l) => ({ name: l.name, tags: l.tags })),
+		levels: (config.levels ?? []).map((l) => ({ name: l.name, tags: levelTags(l) })),
 		signedIn,
 		storefront: Boolean(env(ENV.storefrontPrivateToken) || env(ENV.storefrontPublicToken)),
 	};

package/src/staff.ts

@@ -6,12 +6,12 @@
 
 import { adminConfigured, adminScopes, editTags, registerWebhooks, resync, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
 import { applyEntryRule, describe, entryRuleFor, levelsFor, membership, passes, requirement, termTree, type Terms } from "./access.js";
-import type { RedeemIDConfig } from "./config.js";
+import { PROVIDER_ID, type RedeemIDConfig } from "./config.js";
 import { levelChange } from "./events.js";
 import { featuresFor } from "./features.js";
 import { record } from "./log.js";
 import { recentRequests } from "./privacy.js";
-import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
+import { cleanTags, memberForUser, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
 /**
@@ -100,11 +100,98 @@ export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Bl
 				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
 				: { type: "divider" },
 			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+			...linkSection(m),
 			...privacySection(m.customerId),
 		],
 	};
 }
 
+/** Linking the customer to a site user whose email differs, on their detail page. */
+function linkSection(m: MemberRecord): unknown[] {
+	return [
+		{ type: "header", text: "Site user" },
+		{
+			type: "context",
+			text: m.userId
+				? "This customer signs in as the site user linked below. Unlink to let their next sign-in pick the user by email again."
+				: "Signing in links the customer to the site user with the same verified email. When their emails differ, link them here: their next sign-in uses that user.",
+		},
+		m.userId
+			? {
+					type: "actions",
+					elements: [
+						{
+							type: "button",
+							action_id: "member_unlink",
+							label: "Unlink site user",
+							style: "danger",
+							value: m.customerId,
+							confirm: { title: "Unlink this site user?", text: "Their levels stop applying to that user until a sign-in links a user again. Nothing changes in Shopify.", confirm: "Unlink", deny: "Cancel", style: "danger" },
+						},
+					],
+				}
+			: {
+					type: "form",
+					block_id: `link:${m.customerId}`,
+					fields: [{ type: "text_input", action_id: "email", label: "Site user's email", placeholder: "reader@example.com" }],
+					submit: { label: "Link", action_id: "member_link" },
+				},
+	];
+}
+
+/** The parts of EmDash's auth adapter that linking uses. */
+export interface LinkAdapter {
+	getUserByEmail(email: string): Promise<{ id: string; role: number; disabled: boolean } | null>;
+	getOAuthAccount(provider: string, providerAccountId: string): Promise<{ userId: string } | null>;
+	getOAuthAccountsByUserId(userId: string): Promise<Array<{ provider: string; providerAccountId: string }>>;
+	createOAuthAccount(account: { provider: string; providerAccountId: string; userId: string }): Promise<unknown>;
+	deleteOAuthAccount(provider: string, providerAccountId: string): Promise<void>;
+}
+
+/** EmDash's Subscriber role: anything above it is staff. */
+const SUBSCRIBER = 10;
+
+export class LinkError extends Error {}
+
+/**
+ * Link a customer to an existing site user by the user's email, for a member
+ * whose store email differs. Only Subscribers, never staff, and never a user
+ * already linked to another customer. Access still comes only from the
+ * customer's Shopify tags.
+ */
+export async function staffLink(adapter: LinkAdapter, s: Stores, customerId: string, rawEmail: unknown): Promise<MemberRecord> {
+	const m = await s.members.get(customerId);
+	if (!m) throw new LinkError("That member is gone.");
+	if (m.userId) throw new LinkError("This customer is already linked. Unlink first.");
+	const email = String(rawEmail ?? "").trim().toLowerCase();
+	if (!email.includes("@")) throw new LinkError("Give the site user's email.");
+	const user = await adapter.getUserByEmail(email);
+	if (!user) throw new LinkError("No site user has that email.");
+	if (user.role > SUBSCRIBER) throw new LinkError("Staff accounts can't be linked to a store customer.");
+	if (user.disabled) throw new LinkError("That site user is turned off.");
+	const theirs = (await adapter.getOAuthAccountsByUserId(user.id)).find((a) => a.provider === PROVIDER_ID && a.providerAccountId !== customerId);
+	const other = theirs ? null : await memberForUser(s, user.id);
+	if (theirs || (other && other.customerId !== customerId)) throw new LinkError(`That site user is linked to customer ${theirs?.providerAccountId ?? other?.customerId}.`);
+	const held = await adapter.getOAuthAccount(PROVIDER_ID, customerId);
+	if (held && held.userId !== user.id) await adapter.deleteOAuthAccount(PROVIDER_ID, customerId);
+	if (!held || held.userId !== user.id) await adapter.createOAuthAccount({ provider: PROVIDER_ID, providerAccountId: customerId, userId: user.id });
+	const linked = { ...m, userId: user.id, linkedAt: m.linkedAt ?? new Date().toISOString() };
+	await s.members.put(customerId, linked);
+	await record({ event: "staff.link", label: "linked", status: "ok", origin: "staff", customerId });
+	return linked;
+}
+
+/** Undo a link: the customer's next sign-in picks a user by email again. */
+export async function staffUnlink(adapter: LinkAdapter, s: Stores, customerId: string): Promise<MemberRecord> {
+	const m = await s.members.get(customerId);
+	if (!m) throw new LinkError("That member is gone.");
+	if (await adapter.getOAuthAccount(PROVIDER_ID, customerId)) await adapter.deleteOAuthAccount(PROVIDER_ID, customerId);
+	const unlinked = { ...m, userId: null };
+	await s.members.put(customerId, unlinked);
+	await record({ event: "staff.link", label: "unlinked", status: "ok", origin: "staff", customerId });
+	return unlinked;
+}
+
 /** Export and erase for one member, on their detail page. */
 function privacySection(customerId: string): unknown[] {
 	const erase = {

package/src/text.ts

@@ -118,7 +118,7 @@ export const STRINGS = {
 		"I understand",
 		"Delete my data",
 	],
-	plan: ["Join", "Renew", "You're on this plan.", "Not available right now."],
+	plan: ["Join", "Renew", "Upgrade", "You're on this plan.", "Included in your {level} membership.", "Not available right now."],
 	preferences: ["Your preferences", "Save preferences", "Your preferences can't be loaded right now. Try again in a few minutes.", "Not set", "Yes", "No", "One per line."],
 	product: [
 		"Add to cart",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.22";
+export const VERSION = "0.0.23";

package/src/webhooks.ts

@@ -10,6 +10,12 @@ import { cleanTags, emptyMember, numericId, stampTags, type MemberRecord, type S
 import type { RedeemIDConfig } from "./config.js";
 import { eraseAll, eraseMember, shopifyDataRequest } from "./privacy.js";
 
+/** customers/merge: the customer kept and the one merged away, or nulls for a failed merge. */
+export function mergeIds(payload: Record<string, unknown>): { kept: string | null; gone: string | null } {
+	if (payload.status === "failed") return { kept: null, gone: null };
+	return { kept: numericId(payload.admin_graphql_api_customer_kept_id), gone: numericId(payload.admin_graphql_api_customer_deleted_id) };
+}
+
 export type Kind = "profile" | "delete" | "status" | "tags" | "merge" | "compliance" | "ignored";
 
 const TOPICS: Record<string, Kind> = {
@@ -124,9 +130,7 @@ export async function apply(
 	}
 
 	if (kind === "merge") {
-		if (payload.status === "failed") return "skipped";
-		const kept = numericId(payload.admin_graphql_api_customer_kept_id);
-		const gone = numericId(payload.admin_graphql_api_customer_deleted_id);
+		const { kept, gone } = mergeIds(payload);
 		if (!kept || !gone) return "skipped";
 		const old = await s.members.get(gone);
 		if (old?.userId) {