@redeemid/emdash 0.0.22 → 0.0.24

package/README.md

@@ -7,7 +7,7 @@ Memberships and paywalls for [EmDash](https://github.com/emdash-cms/emdash) site
 
 Readers sign in with the store's own customer account. Their Shopify customer tags decide what they can read. Shopify keeps the store, checkout, orders and subscriptions, and EmDash keeps the content. Nothing on the site grants access by itself, so there is one source of truth for who paid for what.
 
-**Status: 0.0.22, early.** Runs on Node and Cloudflare Workers. Unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store cover the features below. Expect changes before 1.0.
+**Status: 0.0.24, early.** Runs on Node and Cloudflare Workers. Unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store cover the features below. Expect changes before 1.0.
 
 ## Contents
 
@@ -26,7 +26,7 @@ Readers sign in with the store's own customer account. Their Shopify customer ta
 
 1. **Sign in.** A reader clicks "Sign in", signs in on the store's customer account page, and comes back signed in as an EmDash Subscriber. That role only means "signed in". It never opens content.
 2. **Mirror.** RedeemID keeps a copy of the customer: email, name, tags and whether the account is enabled. Signed Shopify webhooks keep it current.
-3. **Levels.** You map tags to levels and name them whatever you like, such as `gold-member` to Gold. Tags come from Shopify Flow, a subscription app or staff, never from the site.
+3. **Levels.** You map tags to levels and name them whatever you like, such as `gold-member` to Gold, or Gold for `gold` or for `silver` with `annual`. A level can include others, so Gold members read everything for Silver. Tags come from Shopify Flow, a subscription app or staff, never from the site.
 4. **Rules.** You say which content types or terms need which levels, in the admin (Plugins → RedeemID → Access) or in code. Each entry can have its own rule in the editor's Access panel, and editors can drop a Paywall break or a Members only block into any body.
 5. **Render.** Templates render bodies with `<Content>`. Readers who pass see everything. Everyone else gets a teaser and the wall, and the locked part never reaches the page.
 
@@ -161,7 +161,7 @@ Use `<Content>` in place of `<PortableText>` for every body that may be locked,
 
 EmDash has no content filter hook, so templates decide what to render.
 
-**`<Content>`** renders an entry body. Everything before the first Paywall break block is shown to everyone. What follows reaches the page only for readers the break allows: the levels picked on it ("Signed in" for any member) or, with none picked, the entry's rule. With none picked and no rule covering the entry, the break changes nothing. A body with no break follows the entry's rule as a whole, and readers it keeps out see the collection's `teaser` if one is set (whole paragraphs, never half of one).
+**`<Content>`** renders an entry body. Levels come from the entry's rule (its content type, its terms, or its own Access panel); a Paywall break only says where that rule starts. Everything before the first Paywall break block is shown to everyone, and what follows reaches the page only for readers the rule lets in. With no rule covering the entry, the break changes nothing. A body with no break follows the entry's rule as a whole, and readers it keeps out see the collection's `teaser` if one is set (whole paragraphs, never half of one).
 
 ```astro
 <Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id} title={post.data.title}>
@@ -181,7 +181,7 @@ Pass `id` on the entry's own page. It lets the meter count the read, and a locke
 <Gate levels={["pro"]}><a href="/reports/archive.zip">Download the archive</a></Gate>
 ```
 
-**`<AccessBadge>`** shows what an entry needs, on cards and on the entry. It shows "Free" for open entries (`free=""` hides it), adds `is-locked` and a lock for readers it keeps out, and puts the level slugs in `data-redeemid-level` for colours:
+**`<AccessBadge>`** shows what an entry needs, on cards and on the entry. It shows "Free" for open entries (`free=""` hides it), adds `is-locked` and a lock for readers it keeps out, and puts the level slugs in `data-redeemid-level` for colours (and the first level's `badge` colour in `--redeemid-level-color`):
 
 ```astro
 <AccessBadge collection="posts" terms={post.data.terms} content={post.data.content} />
@@ -191,7 +191,7 @@ Pass `id` on the entry's own page. It lets the meter count the read, and a locke
 
 **`<MemberCard />`** is for an account page: levels with start dates, the renewal or end date and any gift membership that Shopify keeps (see [membership dates](#membership-dates)), past levels, the meter, and links to the store account, Refresh membership and Sign out. Refresh membership sends a member to the store with no sign-in form; one still signed in there comes straight back with their tags read again. Add `<Preferences />` and `<YourData />` beside it.
 
-**`<Plan>`** sells a membership: a Shopify product's title and price with a button that starts checkout (members check out with their email). With `levels`, members who already hold one see "You're on this plan." in place of the button, and a member who held one before (Shopify has since removed its tag) gets **Renew** (`renewLabel`) instead of `label`. The wall does the same: a lapsed member reads "Your Pro membership has ended." with **Renew Pro** and **Already renewed? Refresh**, not the newcomer's join link.
+**`<Plan>`** sells a membership: a Shopify product's title and price with a button that starts checkout (members check out with their email). Its levels are `levels`, or else the levels whose `products` list the handle. Then the card fits the member: one who holds a level through its own tags sees "You're on this plan." in place of the button; one whose bigger level includes it sees "Included in your Gold membership."; one the plan would move up (its level includes theirs) gets **Upgrade** (`upgradeLabel`); and one who held it before (Shopify has since removed its tag) gets **Renew** (`renewLabel`) instead of `label`. `data-redeemid-state` is `held`, `included`, `upgrade`, `renew` or `join`. The wall does the same: a lapsed member reads "Your Pro membership has ended." with **Renew Pro** and **Already renewed? Refresh**, not the newcomer's join link.
 
 ```astro
 <Plan handle="gold-membership" label="Join Gold" levels={["gold"]}>
@@ -247,13 +247,35 @@ Each rule names a collection and the levels, any of which may read. An empty `le
 
 Term rules beat the collection's rule, which beats the site default. When several term rules cover one entry (a story in Investigations, which needs Gold, and Culture, which needs Silver), readers must pass every one of them, so only members with both read it. Set `combine: "any"` to let one be enough.
 
-Levels can need several tags: `{ slug: "both", name: "Member + Pro", tags: ["member", "pro"], match: "all" }`. A level's `wall` is what the wall says to readers it would let in, and its `joinUrl` overrides `join.href`.
+### Levels
+
+A level is a name for customers who hold some Shopify tags. `tags` is one group: any one of them grants the level, or every one with `match: "all"`. `groups` adds more groups, and any one group is enough:
+
+```js
+levels: [
+	{ slug: "silver", name: "Silver", tags: ["silver"] },
+	// "gold", or "silver" with "annual".
+	{ slug: "gold", name: "Gold", tags: ["gold"], groups: [{ tags: ["silver", "annual"], match: "all" }], includes: ["silver"] },
+],
+```
+
+`includes` lists levels this one also opens: Gold members read everything for Silver, and inclusion carries on (Gold includes Silver includes Members). So a rule names only the lowest level that may read, and an entry that needs Silver and Gold needs Gold once. Members hold the levels their tags grant and every level those include; the account box and member card show only the top one ("Gold", not "Gold, Silver"), and `member.levels_changed` lists them all.
+
+The rest of a level is how it looks and where it leads:
+
+| Key | What it does |
+| --- | --- |
+| `wall` | What the wall says to readers this level would let in |
+| `joinUrl` | Where the wall's join link goes for this level (else `join.href`) |
+| `products` | Handles of the Shopify products whose purchase leads to the level. Display only: plan cards use it (see `<Plan>`). It grants nothing. |
+| `home` | Members' home: the same-site path a member lands on after signing in from the home page or a plain sign-in link (their top level's, in level order). Signing in from an entry returns them to it. |
+| `badge` | A hex colour, set as `--redeemid-level-color` on badges, the account box and the member card. Badges always show the name too. |
 
 ### Access settings in the admin
 
 Everything about who reads what can be set in the EmDash admin, so a new content type, taxonomy or level never needs a code change. Under **Plugins → RedeemID → Access**:
 
-- **Levels.** Add, rename and remove levels and the Shopify tags that grant them. Name them anything; the slug is made from the name. A level that rules, features or folders still use can't be removed.
+- **Levels.** Add, rename and remove levels and the Shopify tags that grant them: one group per line, commas between tags, and `all:` before a line that needs every tag on it. Tick the levels each one includes, and set its plan products, members' home and badge colour. Name them anything; the slug is made from the name. A level that rules, features or folders still use can't be removed; removing one drops it from other levels' includes.
 - **Site rules.** The site default, how term rules combine, the meter and the wall's join link.
 - **Content types.** Who can read each collection, with drip, the meter and the teaser. Every collection on the site is listed, including ones made after RedeemID was set up.
 - **Taxonomies.** Rules for terms in every taxonomy, for one collection or every collection the taxonomy is on.
@@ -283,7 +305,7 @@ teaser: { posts: 40 },
 
 The meter lets a signed-in reader open a locked entry anyway, `limit` entries per `period` (`"month"`, the default, or `"week"`, in UTC). Each entry counts once per period, when its own page renders through `<Content>` with an `id`. Lists, feeds, search and the content API never count. Visitors get the wall and a nudge to sign in. While it runs, `<Content>` says how many free reads are left, and when it runs out the wall says so. Rules with `meter: false` are never metered, and the meter never opens an entry a member is waiting on by drip.
 
-Drip holds a rule's entries back from members who pass it until they've held their level for `drip` days. A level starts when the customer first had its tag (for a `match: "all"` level, the last of its tags). With several levels the earliest counts, and with none known, the first sign-in. RedeemID notes when each tag first arrives and forgets it when Shopify removes it. The wall shows the date the entry opens.
+Drip holds a rule's entries back from members who pass it until they've held their level for `drip` days. A level starts when the customer first had a tag of its group (for a `match: "all"` group, the last of its tags); a level held through another's `includes` starts with that one. With several levels the earliest counts, and with none known, the first sign-in. RedeemID notes when each tag first arrives and forgets it when Shopify removes it. The wall shows the date the entry opens.
 
 ### Selling one entry on its own
 
@@ -410,7 +432,7 @@ What RedeemID keeps about a member: the synced record (Shopify customer ID, emai
 | Staff, on a member's page | **Export data**, **Erase site data**, and **Also request erasure in Shopify** (orders included, after Shopify's wait; **Cancel the Shopify erasure** withdraws it). The Shopify request needs the `write_customer_data_erasure` scope. |
 | Shopify `customers/data_request` | An open request on the **Privacy** page. Press **Export and mark done**, then send the export to the store owner. |
 | Shopify `customers/redact` | The member's record and meter are erased. |
-| Shopify `shop/redact` | Every member record and meter is erased. |
+| Shopify `shop/redact` | Every member record and meter is erased, a hundred at a time, so even a large shop fits in one request on the Workers Free plan. |
 
 The Privacy page shows each request's source and Shopify customer ID, never an email or a name. The daily check deletes finished requests after a year; open ones stay until staff mark them done. An erase sends the `member.erased` event so a CRM can delete its copy too. The site's own user account stays; delete it under Users if the person asks. The JSON route is `/_emdash/api/auth/redeemid/privacy`: `GET` downloads, `POST` with `confirm=yes` erases, only for the signed-in member and only from the site's own origin.
 
@@ -419,6 +441,7 @@ The Privacy page shows each request's source and Shopify customer ID, never an e
 With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set, RedeemID gets an Admin API token for the webhook app with the client credentials grant. The app must be in the same Shopify organization as the store, as Dev Dashboard apps are, and needs `read_customers` and `write_customers`. Then, under **Plugins → RedeemID**:
 
 - **Member detail.** Levels, tags and features; resync from Shopify; add and remove tags. Tag edits are made in Shopify and read back. Nothing is granted on the site.
+- **Site user.** Signing in links a customer to the site user with the same verified email. When the emails differ, staff link the customer to an existing Subscriber by that user's email on the member's page (never a staff account, never a user linked to another customer), or unlink them. This part needs no Admin API app.
 - **Bulk resync.** Reads the 25 members synced longest ago, few enough for the Workers free limit of 50 database queries a request. Press it again for the next 25. It never runs on its own.
 - **Webhook subscriptions.** Webhooks → Setup lists the store's subscriptions to this site and registers any that are missing. A topic Shopify refuses, such as `customers/merge` without `read_customer_merge`, is named with the reason and doesn't stop the others. `customers/redact` stays in the app's own settings.
 - **Access test.** A collection, an entry, terms and a reader's tags in; the verdict out.
@@ -457,7 +480,7 @@ Staff questions as data, for AI agents and scripts. Every one needs an administr
 | MCP tool | Command | What it answers |
 | --- | --- | --- |
 | `explain_access` | `access <collection>` | Can this reader read this entry, and why. Give the entry by `id` or `terms`, and the reader by `tags`, `customerId` or `signedIn: false`. |
-| `list_levels` | `levels` | Every level, its tags, wall text and join link |
+| `list_levels` | `levels` | Every level, its tag groups, the levels it includes, wall text and join link |
 | `get_rules` | `rules` | How rules combine, every rule, the meter, teasers, features and file rules |
 | `get_member` | `member <id or email>` | One member: status, tags, levels with start dates, past levels, features, last sync |
 | `site_health` | `health` | Each setting (set or not, never a value), the last webhook, open privacy requests, ignored text replacements |
@@ -536,9 +559,9 @@ Pass one object to both `redeemid(config)` and `redeemidPlugin(config)`. `levels
 
 | Option | Type | What it does |
 | --- | --- | --- |
-| `shop` | `string` | The store's `*.myshopify.com` domain (a custom customer-account domain works too). Leave it out to read `REDEEMID_SHOPIFY_STORE_DOMAIN`. |
+| `shop` | `string` | The store's `*.myshopify.com` domain. A custom domain works for sign-in, but the Admin API (staff tools, webhook registration, tag reads) answers only on myshopify.com, and the Status page warns when the app is set up with a custom domain. Leave it out to read `REDEEMID_SHOPIFY_STORE_DOMAIN`. |
 | `label` | `string` | The sign-in button's label. Default "Sign in". |
-| `levels` | `{ slug, name, tags, match?, wall?, joinUrl? }[]` | Levels from customer tags. `match: "all"` needs every tag. |
+| `levels` | `{ slug, name, tags?, match?, groups?, includes?, wall?, joinUrl?, products?, home?, badge? }[]` | Levels from customer tags. See [levels](#levels). |
 | `rules` | `{ collection, taxonomy?, term?, levels, open?, drip?, meter? }[]` | What needs which levels. See [rules](#rules). |
 | `combine` | `"all"` \| `"any"` | How several term rules on one entry combine. Default `"all"`. |
 | `join` | `{ href, label? }` | The wall's join link. |
@@ -590,7 +613,7 @@ Import each from `@redeemid/emdash/components/<Name>.astro`.
 | `YourData` | `title`, `heading` | Download or delete my data |
 | `Feature` | `slug`; slot `else` | Shows its content to members holding the feature |
 | `Notices` | `messages` | The message for `?redeemid_notice=` |
-| `Plan` | `handle`, `label`, `title`, `levels`, `heldLabel`, `renewLabel` | A product with a buy button |
+| `Plan` | `handle`, `label`, `title`, `levels`, `heldLabel`, `renewLabel`, `upgradeLabel` | A product with a buy button that fits the member |
 | `Product` | `handle`, `heading`, `compact`, `html`, `schema`, `addLabel`, `buyLabel` | A product page |
 | `Collection` | `handle`, `limit`, `productHref`, `showTitle`, `browse`, `quickAdd` | A grid of products, with filters and pages |
 | `ProductSearch` | `productHref`, `limit`, `boxOnly`, `action`, `label`, `quickAdd` | Product search |
@@ -609,7 +632,7 @@ Import each from `@redeemid/emdash/components/<Name>.astro`.
 
 | Block | Type | Does |
 | --- | --- | --- |
-| Paywall break | `redeemid-paywall` | Members-only content starts here, for the levels picked or the entry's rule |
+| Paywall break | `redeemid-paywall` | Everyone reads up to here; the rest follows the entry's rule |
 | Members only / Members only: end | `redeemid-members`, `redeemid-members-end` | A members-only part in the middle of a body |
 | Sold on its own | `redeemid-item` | Sells the entry by itself to holders of a tag |
 | Plan | `redeemid-plan` | A product with a buy button |
@@ -666,6 +689,7 @@ Reword one with `messages={{ cart_empty: "…" }}`, or for every page with `text
 - Staff accounts (any EmDash role above Subscriber) can't sign in through the store, even with a matching email. When that happens, the store session ends too, so the next sign-in attempt starts fresh.
 - Customers can't create the first (admin) account on a new site.
 - Webhooks are checked against the app's signature before anything changes.
+- `customers/merge` moves the sign-in link to the customer Shopify kept. With the Admin API app set up, the kept customer's tags are read straight away; without it they arrive with its next webhook or sign-in.
 - Access fails closed: when the saved access settings can't be read, a server keeps the ones it last read, and with none it locks every entry.
 
 ## Troubleshooting

package/docs/developer-api.md

@@ -1,6 +1,6 @@
 # Developer API
 
-What site code, other plugins and AI agents can rely on in `@redeemid/emdash`. API version **1.2.0** (`API_VERSION` in `@redeemid/emdash/contract`, also in `api/state` and `window.redeemid.apiVersion`).
+What site code, other plugins and AI agents can rely on in `@redeemid/emdash`. API version **1.3.0** (`API_VERSION` in `@redeemid/emdash/contract`, also in `api/state` and `window.redeemid.apiVersion`).
 
 Everything on this page is stable: it changes only with a changelog entry and an API version bump (minor when something is added, major when something changes or goes). Anything not listed is internal, even when a module exports it. `src/contract.ts` is the same list as code, and a test fails when the code, that list and this page disagree.
 
@@ -17,7 +17,7 @@ Import these in Astro pages, components and endpoints.
 | Import | Stable exports |
 | --- | --- |
 | `@redeemid/emdash` | `redeemid`, `redeemidGuard`, `redeemidPlugin` |
-| `@redeemid/emdash/access` | `siteConfig`, `viewer`, `canRead`, `readEntry`, `entryRequirement`, `meterUsage`, `membership`, `levelsFor`, `signInUrl`, `signOutUrl`, `accountUrl`, `cartUrl`, `refreshUrl`, `safeReturn` |
+| `@redeemid/emdash/access` | `siteConfig`, `viewer`, `canRead`, `readEntry`, `entryRequirement`, `meterUsage`, `membership`, `levelsFor`, `topLevels`, `closure`, `simplify`, `signInUrl`, `signOutUrl`, `accountUrl`, `cartUrl`, `refreshUrl`, `safeReturn` |
 | `@redeemid/emdash/features` | `hasFeature`, `viewerFeatures`, `featuresFor` |
 | `@redeemid/emdash/preferences` | `readPreferences`, `savePreferences`, `preferenceFields` |
 | `@redeemid/emdash/storefront` | `plan`, `product`, `collection`, `money`, `realOptions`, `variantFor`, `storeContext`, `cartDetails`, `addToCart`, `updateLines`, `removeLines`, `setDiscountCodes` |
@@ -26,6 +26,8 @@ Import these in Astro pages, components and endpoints.
 | `@redeemid/emdash/text` | `STRINGS`, `text`, `textParts` |
 | `@redeemid/emdash/search` | `readableResults` |
 
+Levels: `levelsFor(tags, levels)` answers every level the tags hold, including the ones a held level `includes` (so `levels` in `api/state`, `Viewer.levels` and `member.levels_changed` list Silver for a Gold member whose Gold includes Silver). `topLevels(held, levels)` keeps the ones no other held level includes, for showing ("Gold"). `closure(slug, levels)` is every level holding `slug` opens, itself first. `simplify(required, levels)` drops what inclusion already covers from a requirement (`[["silver"], ["gold"]]` becomes `[["gold"]]`); `entryRequirement` already does it. `membership()` marks a level held only through another with `via` (that level's slug).
+
 Functions that take a `config` want the site's config for the request: `await siteConfig(Astro.locals)`, which is the code's config with the admin's saved settings laid over it. Passing the object from `astro.config.mjs` instead skips what staff saved on the Access page. A few examples:
 
 ```astro
@@ -51,7 +53,7 @@ Under `/_emdash/api/auth/redeemid/`. Same-origin only: EmDash checks `Origin` on
 - `api/state` (GET): the visitor's own state.
 
   ```json
-  { "apiVersion": "1.2.0", "version": "0.0.22", "signedIn": true, "linked": true,
+  { "apiVersion": "1.3.0", "version": "0.0.24", "signedIn": true, "linked": true,
     "levels": ["gold"], "features": ["ad-free"], "cart": { "count": 2 },
     "meter": { "used": 1, "limit": 3, "period": "month" } }
   ```

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.22",
+	"version": "0.0.24",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/access-admin.ts

@@ -15,8 +15,8 @@
 
 import type { StorageCollection } from "emdash";
 
-import { applyEntryRule, describe, requirement, ruleSource, SIGNED_IN, termTree, type Requirement, type Terms } from "./access.js";
-import type { FeatureConfig, FileRule, LevelConfig, MeterConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+import { applyEntryRule, badgeColor, describe, requirement, ruleSource, SIGNED_IN, termTree, type Requirement, type Terms } from "./access.js";
+import { groupsOf, type FeatureConfig, type FileRule, type LevelConfig, type MeterConfig, type RedeemIDConfig, type RuleConfig, type TagGroup } from "./config.js";
 import {
 	days,
 	deleteAccess,
@@ -153,6 +153,40 @@ function ruleText(rule: RuleConfig | undefined, levels: LevelConfig[]): string {
 	return extra ? `${who} (${extra})` : who;
 }
 
+/** A level's tag groups as the form shows them: one per line, "all:" before a line that needs every tag. */
+function groupsText(level: LevelConfig | undefined): string {
+	if (!level) return "";
+	return groupsOf(level)
+		.map((g) => `${g.match === "all" && g.tags.length > 1 ? "all: " : ""}${g.tags.join(", ")}`)
+		.join("\n");
+}
+
+/** The level's tags in the table: "gold or silver + annual". */
+function groupsWords(level: LevelConfig): string {
+	return groupsOf(level)
+		.map((g) => g.tags.join(g.match === "all" ? " + " : " or "))
+		.join(" or ");
+}
+
+/**
+ * Tag groups from the form: one per line, tags separated by commas; a line
+ * starting "all:" needs every tag. `firstMatch` ("all") applies to a first
+ * line with no prefix, for callers that still send the old Customer needs field.
+ */
+export function parseGroups(raw: unknown, firstMatch?: unknown): TagGroup[] {
+	const lines = Array.isArray(raw) ? [raw.join(",")] : String(raw ?? "").split(/\r?\n/);
+	const out: TagGroup[] = [];
+	lines.forEach((line, i) => {
+		const all = /^\s*all\s*:/i.test(line);
+		const tags = list(line.replace(/^\s*(all|any)\s*:/i, "").split(","));
+		if (tags.length === 0) return;
+		const match = all || (i === 0 && firstMatch === "all") ? "all" : "any";
+		if (out.some((g) => (g.match ?? "any") === match && g.tags.join("|").toLowerCase() === tags.join("|").toLowerCase())) return;
+		out.push({ tags, ...(match === "all" && tags.length > 1 ? { match: "all" as const } : {}) });
+	});
+	return out;
+}
+
 // ---------------------------------------------------------------- tabs
 
 function levelsTab(env: AccessEnv, editing?: string): unknown[] {
@@ -161,8 +195,9 @@ function levelsTab(env: AccessEnv, editing?: string): unknown[] {
 	const rules = config.rules ?? [];
 	const used = (slug: string) => rules.filter((r) => r.levels.includes(slug)).length;
 	const current = editing ? levels.find((l) => l.slug === editing) : undefined;
+	const others = levels.filter((l) => l.slug !== current?.slug);
 	return [
-		{ type: "context", text: "A level is a name for readers who hold some Shopify customer tags. Name them anything. Tags come from Shopify (Flow, a subscription app or staff), never from this site." },
+		{ type: "context", text: "A level is a name for readers who hold some Shopify customer tags. Name them anything. Tags come from Shopify (Flow, a subscription app or staff), never from this site. A level that includes another reads everything for it too, so a rule names only the lowest level that may read." },
 		...sourceLine(env, "levels", "Levels"),
 		levels.length
 			? {
@@ -173,31 +208,44 @@ function levelsTab(env: AccessEnv, editing?: string): unknown[] {
 						{ key: "name", label: "Level" },
 						{ key: "slug", label: "Slug", format: "code" },
 						{ key: "tags", label: "Shopify tags" },
-						{ key: "match", label: "Needs" },
+						{ key: "includes", label: "Includes" },
 						{ key: "rules", label: "Rules", format: "number" },
 						{ key: "act", label: "", format: "element" },
 					],
 					rows: levels.map((l) => ({
 						name: l.name,
 						slug: l.slug,
-						tags: l.tags.join(", "),
-						match: l.tags.length < 2 ? "The tag" : l.match === "all" ? "Every tag" : "Any tag",
+						tags: groupsWords(l),
+						includes: (l.includes ?? []).map((s) => levels.find((x) => x.slug === s)?.name ?? s).join(", "),
 						rules: used(l.slug),
 						act: { type: "menu", action_id: "level_menu", label: "Edit", items: [{ label: "Edit", value: `edit:${l.slug}` }, { label: "Remove", value: `remove:${l.slug}` }] },
 					})),
 				}
 			: { type: "empty", title: "No levels yet", description: "Add one below, such as Members for the tag member.", size: "sm" },
 		{ type: "header", text: current ? `Edit ${current.name}` : "Add a level" },
+		{ type: "context", text: "Shopify tags: a line passes when the customer has any one of its tags; start a line with all: to need every tag on it. Any one line grants the level, so gold on one line and all: silver, annual on the next means Gold, or Silver with Annual." },
 		{
 			type: "form",
 			block_id: current ? `level:${current.slug}` : "level:new",
 			fields: [
 				{ type: "text_input", action_id: "name", label: "Name", placeholder: "Members", initial_value: current?.name ?? "" },
 				...(current ? [] : [{ type: "text_input", action_id: "slug", label: "Slug (optional, fixed once saved)", placeholder: "members" }]),
-				{ type: "text_input", action_id: "tags", label: "Shopify tags, comma separated", placeholder: "member", initial_value: current?.tags.join(", ") ?? "" },
-				{ type: "select", action_id: "match", label: "Customer needs", options: [{ label: "Any one tag", value: "any" }, { label: "Every tag", value: "all" }], initial_value: current?.match ?? "any" },
+				{
+					type: "text_input",
+					action_id: "tags",
+					label: "Shopify tags: commas between tags, one group per line",
+					placeholder: "gold\nall: silver, annual",
+					initial_value: groupsText(current),
+					multiline: true,
+				},
+				...(others.length
+					? [{ type: "checkbox", action_id: "includes", label: "Also opens what these levels read", options: others.map((l) => ({ label: l.name, value: l.slug })), initial_value: current?.includes ?? [] }]
+					: []),
 				{ type: "text_input", action_id: "wall", label: "Wall text (optional)", initial_value: current?.wall ?? "", multiline: true },
 				{ type: "text_input", action_id: "join_url", label: "Join link (optional)", placeholder: "/join/", initial_value: current?.joinUrl ?? "" },
+				{ type: "text_input", action_id: "products", label: "Shopify product handles that lead to it (optional, for plan cards)", placeholder: "gold-membership", initial_value: current?.products?.join(", ") ?? "" },
+				{ type: "text_input", action_id: "home", label: "Members' home after sign-in (optional)", placeholder: "/members/gold/", initial_value: current?.home ?? "" },
+				{ type: "text_input", action_id: "badge", label: "Badge colour (optional)", placeholder: "#c9a227", initial_value: current?.badge ?? "" },
 			],
 			submit: { label: current ? "Save level" : "Add level", action_id: "level_save" },
 		},
@@ -497,16 +545,31 @@ export async function accessAction(env: AccessEnv, i: Interaction): Promise<Bloc
 			const now = effective(env);
 			const used = (now.rules ?? []).filter((r) => r.levels.includes(slug!)).length + (now.files ?? []).filter((f) => f.levels?.includes(slug!)).length + (now.features ?? []).filter((f) => f.levels?.includes(slug!)).length;
 			if (used) return bad("levels", `Rules, features or folders use this level (${used}). Change them first.`);
-			await saveSite(env, (site, n) => ({ ...site, levels: start(site, n, "levels").filter((l) => l.slug !== slug) }));
+			await saveSite(env, (site, n) => ({
+				...site,
+				levels: start(site, n, "levels")
+					.filter((l) => l.slug !== slug)
+					.map((l) => {
+						if (!l.includes?.includes(slug!)) return l;
+						const includes = l.includes.filter((s) => s !== slug);
+						const { includes: _gone, ...rest } = l;
+						return includes.length ? { ...rest, includes } : rest;
+					}),
+			}));
 			return ok("levels", "Level removed.");
 		}
 
 		case "level_save": {
 			const name = String(values.name ?? "").trim();
-			const tags = list(values.tags);
+			const groups = parseGroups(values.tags, values.match);
 			const editing = target !== "new" ? target : null;
 			if (!name) return bad("levels", "Give the level a name.", { level: editing ?? undefined });
-			if (tags.length === 0) return bad("levels", "Give it at least one Shopify tag.", { level: editing ?? undefined });
+			if (groups.length === 0) return bad("levels", "Give it at least one Shopify tag.", { level: editing ?? undefined });
+			const home = String(values.home ?? "").trim();
+			if (home && (!home.startsWith("/") || home.startsWith("//"))) return bad("levels", "The members' home must be a path on this site, such as /members/.", { level: editing ?? undefined });
+			const badge = String(values.badge ?? "").trim();
+			if (badge && !badgeColor({ slug: "x", name: "x", badge })) return bad("levels", "The badge colour must be a hex colour, such as #c9a227.", { level: editing ?? undefined });
+			const products = list(values.products).map((h) => h.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "")).filter(Boolean);
 			const fail = await saveSite(env, (site, n) => {
 				const levels = start(site, n, "levels");
 				let slug = editing;
@@ -515,11 +578,19 @@ export async function accessAction(env: AccessEnv, i: Interaction): Promise<Bloc
 					if (typeof made !== "string") return made.error;
 					slug = made;
 				}
-				const level: LevelConfig = { slug, name, tags, ...(values.match === "all" ? { match: "all" as const } : {}) };
+				const [first, ...more] = groups;
+				const level: LevelConfig = { slug, name, tags: first!.tags, ...(first!.match === "all" ? { match: "all" as const } : {}) };
+				if (more.length) level.groups = more;
+				const known = new Set(levels.map((l) => l.slug));
+				const includes = list(values.includes).filter((s) => s !== slug && known.has(s));
+				if (includes.length) level.includes = includes;
 				const wall = String(values.wall ?? "").trim();
 				const joinUrl = String(values.join_url ?? "").trim();
 				if (wall) level.wall = wall;
 				if (joinUrl) level.joinUrl = joinUrl;
+				if (products.length) level.products = [...new Set(products)];
+				if (home) level.home = home;
+				if (badge) level.badge = badge;
 				const at = levels.findIndex((l) => l.slug === slug);
 				if (at >= 0) levels[at] = level;
 				else levels.push(level);
@@ -709,7 +780,7 @@ export async function entryPanel(env: AccessEnv, entry: PanelEntry, toast?: Toas
 				],
 				submit: { label: "Save access", action_id: "entry_save" },
 			},
-			{ type: "context", text: "Paywall break and Members only blocks can still lock parts of the body." },
+			{ type: "context", text: "With a Paywall break in the body, everyone reads up to it and this rule covers the rest. Members only blocks can lock parts to their own levels." },
 		],
 	};
 }

package/src/access.ts

@@ -10,7 +10,7 @@
  * "entitled".
  */
 
-import type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+import { groupsOf, levelTags, type LevelConfig, type RedeemIDConfig, type RuleConfig, type TagGroup } from "./config.js";
 import { UNAVAILABLE, type EntryRule } from "./settings.js";
 import { siteConfig } from "./site-config.js";
 import { memberForUser, stores, type MemberRecord, type MeterRecord } from "./storage.js";
@@ -72,15 +72,78 @@ export type Terms = Record<string, TermRef[] | undefined>;
 /** Parent slug by term slug, per taxonomy, for walking up a hierarchy. */
 export type TermTree = Record<string, Record<string, string | null>>;
 
-export function levelsFor(tags: string[], levels: LevelConfig[] = []): string[] {
+export { groupsOf, levelTags, type TagGroup };
+
+function groupPasses(g: TagGroup, held: Set<string>): boolean {
+	const has = (t: string) => held.has(t.toLowerCase());
+	return g.match === "all" ? g.tags.every(has) : g.tags.some(has);
+}
+
+/** Levels the tags grant directly, through one of their own groups, in config order. */
+export function directLevels(tags: string[], levels: LevelConfig[] = []): string[] {
 	const held = new Set(tags.map((t) => t.toLowerCase()));
-	return levels
-		.filter((l) => {
-			if (l.tags.length === 0) return false;
-			const has = (t: string) => held.has(t.toLowerCase());
-			return l.match === "all" ? l.tags.every(has) : l.tags.some(has);
-		})
-		.map((l) => l.slug);
+	return levels.filter((l) => groupsOf(l).some((g) => groupPasses(g, held))).map((l) => l.slug);
+}
+
+/**
+ * Every level holding `slug` opens, itself first: the levels it includes, and
+ * theirs (Gold includes Silver includes Members). Unknown slugs are skipped and
+ * loops stop, so a bad config can't hang.
+ */
+export function closure(slug: string, levels: LevelConfig[] = []): string[] {
+	const bySlug = new Map(levels.map((l) => [l.slug, l]));
+	const seen: string[] = [];
+	const queue = [slug];
+	while (queue.length) {
+		const next = queue.shift()!;
+		if (seen.includes(next) || !bySlug.has(next)) continue;
+		seen.push(next);
+		queue.push(...(bySlug.get(next)!.includes ?? []));
+	}
+	return seen;
+}
+
+/** Does holding `holder` open what needs `needed`? */
+export function covers(holder: string, needed: string, levels: LevelConfig[] = []): boolean {
+	return holder === needed || closure(holder, levels).includes(needed);
+}
+
+/**
+ * The levels a member with these tags holds: the ones their tags grant, and
+ * every level those include. In config order.
+ */
+export function levelsFor(tags: string[], levels: LevelConfig[] = []): string[] {
+	const held = new Set(directLevels(tags, levels).flatMap((s) => closure(s, levels)));
+	return levels.filter((l) => held.has(l.slug)).map((l) => l.slug);
+}
+
+/**
+ * The held levels no other held level includes, for showing a member's
+ * levels: "Gold", not "Gold, Silver", when Gold includes Silver.
+ */
+export function topLevels(held: string[], levels: LevelConfig[] = []): string[] {
+	return held.filter((slug) => !held.some((o) => o !== slug && covers(o, slug, levels) && !covers(slug, o, levels)));
+}
+
+/**
+ * Where a member lands after signing in from the home page or a plain
+ * sign-in link: the `home` of their first top level (in level order) that has
+ * one, or null. Only same-site paths count.
+ */
+export function memberHome(tags: string[], levels: LevelConfig[] = []): string | null {
+	const top = topLevels(levelsFor(tags, levels), levels);
+	for (const level of levels) {
+		if (!top.includes(level.slug) || !level.home) continue;
+		const home = safeReturn(level.home.trim());
+		if (home !== "/") return home;
+	}
+	return null;
+}
+
+/** A level's badge colour when it is a hex colour, else null. */
+export function badgeColor(level: LevelConfig | undefined): string | null {
+	const c = level?.badge?.trim() ?? "";
+	return /^#(?:[0-9a-f]{3}|[0-9a-f]{4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(c) ? c : null;
 }
 
 const slugOf = (t: TermRef) => (typeof t === "string" ? t : t.slug);
@@ -89,12 +152,16 @@ const slugOf = (t: TermRef) => (typeof t === "string" ? t : t.slug);
  * The clauses, simplified: duplicates go, a clause that contains another
  * clause goes (needing Pro already passes "Member or Pro"), and an empty
  * clause goes when a level clause is there (any level implies signed in).
+ *
+ * With `levels`, inclusion counts too: in "Silver or Gold" Gold goes when it
+ * includes Silver, and "Silver + Gold" needs only Gold.
  */
-function reduce(clauses: string[][]): string[][] {
+function reduce(clauses: string[][], levels?: LevelConfig[]): string[][] {
 	const seen = new Set<string>();
 	const out: string[][] = [];
 	for (const c of clauses) {
-		const sorted = c.includes(SIGNED_IN) ? [] : [...new Set(c)].sort();
+		let sorted = c.includes(SIGNED_IN) ? [] : [...new Set(c)].sort();
+		if (levels?.length) sorted = sorted.filter((l) => !sorted.some((o) => o !== l && covers(l, o, levels) && !covers(o, l, levels)));
 		const key = sorted.join("|");
 		if (seen.has(key)) continue;
 		seen.add(key);
@@ -102,7 +169,14 @@ function reduce(clauses: string[][]): string[][] {
 	}
 	const levelled = out.filter((c) => c.length > 0);
 	if (levelled.length === 0) return out;
-	return levelled.filter((c) => !levelled.some((o) => o !== c && o.length < c.length && o.every((l) => c.includes(l))));
+	// `o` implies `c` when every level in `o` opens some level in `c`.
+	const implies = (o: string[], c: string[]) => o.every((l) => c.some((x) => (levels?.length ? covers(l, x, levels) : l === x)));
+	return levelled.filter((c) => !levelled.some((o) => o !== c && implies(o, c) && !(implies(c, o) && levelled.indexOf(c) < levelled.indexOf(o))));
+}
+
+/** A requirement simplified with the levels' includes (see reduce). */
+export function simplify(required: Requirement, levels: LevelConfig[] = []): Requirement {
+	return required === null ? null : reduce(required, levels);
 }
 
 function combined(rules: RuleConfig[], mode: "all" | "any"): string[][] {
@@ -229,29 +303,52 @@ export function meterable(rules: RuleConfig[] = [], collection: string, terms: T
 }
 
 /**
- * When a member's membership started, for drip: the earliest start among the
- * levels they hold now (a level starts when its last needed tag arrived),
- * else when they first signed in. Null when neither is known.
+ * When each held level started, by slug (ISO, or null when unknown). A group
+ * starts when its first tag arrived ("any") or its last one ("all"); a level
+ * starts with its earliest passing group, and a level held only because
+ * another includes it starts with the earliest of those.
  */
-export function memberSince(member: MemberRecord, levels: LevelConfig[] = []): string | null {
+export function levelStarts(member: MemberRecord, levels: LevelConfig[] = []): Map<string, string | null> {
 	const since = member.tagsSince ?? {};
-	const starts: string[] = [];
+	const heldTags = new Set(member.tags.map((t) => t.toLowerCase()));
+	const direct = new Map<string, string | null>();
+	for (const level of levels) {
+		const starts: string[] = [];
+		let passing = false;
+		for (const g of groupsOf(level)) {
+			if (!groupPasses(g, heldTags)) continue;
+			passing = true;
+			const dates = g.tags.filter((t) => heldTags.has(t.toLowerCase())).map((t) => since[t.toLowerCase()]).filter((d): d is string => Boolean(d)).sort();
+			const pick = g.match === "all" ? dates.at(-1) : dates[0];
+			if (pick) starts.push(pick);
+		}
+		if (passing) direct.set(level.slug, starts.sort()[0] ?? null);
+	}
+	const out = new Map<string, string | null>();
 	for (const slug of levelsFor(member.tags, levels)) {
-		const level = levels.find((l) => l.slug === slug);
-		const dates = (level?.tags ?? []).map((t) => since[t.toLowerCase()]).filter((d): d is string => Boolean(d)).sort();
-		if (dates.length === 0) continue;
-		const pick = level?.match === "all" ? dates[dates.length - 1] : dates[0];
-		if (pick) starts.push(pick);
+		const dates = [...direct.entries()].filter(([d]) => closure(d, levels).includes(slug)).map(([, at]) => at).filter((d): d is string => Boolean(d)).sort();
+		out.set(slug, dates[0] ?? null);
 	}
-	starts.sort();
+	return out;
+}
+
+/**
+ * When a member's membership started, for drip: the earliest start among the
+ * levels they hold now (see levelStarts), else when they first signed in.
+ * Null when neither is known.
+ */
+export function memberSince(member: MemberRecord, levels: LevelConfig[] = []): string | null {
+	const starts = [...levelStarts(member, levels).values()].filter((d): d is string => Boolean(d)).sort();
 	return starts[0] ?? member.linkedAt ?? null;
 }
 
 export interface HeldLevel {
 	slug: string;
 	name: string;
-	/** When the level started (see memberSince), ISO, or null when unknown. */
+	/** When the level started (see levelStarts), ISO, or null when unknown. */
 	since: string | null;
+	/** Set when the member holds it only because a level they hold includes it: that level's slug. */
+	via?: string;
 }
 
 export interface PastLevel {
@@ -267,15 +364,18 @@ export interface PastLevel {
  */
 export function membership(member: MemberRecord, levels: LevelConfig[] = []): { current: HeldLevel[]; past: PastLevel[] } {
 	const held = levelsFor(member.tags, levels);
+	const direct = directLevels(member.tags, levels);
+	const starts = levelStarts(member, levels);
 	const current = held.map((slug) => {
 		const level = levels.find((l) => l.slug === slug)!;
-		return { slug, name: level.name, since: memberSince({ ...member, linkedAt: null }, [level]) };
+		const via = direct.includes(slug) ? undefined : direct.find((d) => closure(d, levels).includes(slug));
+		return { slug, name: level.name, since: starts.get(slug) ?? null, ...(via ? { via } : {}) };
 	});
 	const pastTags = member.pastTags ?? [];
 	const past: PastLevel[] = [];
 	for (const level of levels) {
 		if (held.includes(level.slug)) continue;
-		const wanted = new Set(level.tags.map((t) => t.toLowerCase()));
+		const wanted = new Set(levelTags(level));
 		const spans = pastTags.filter((p) => wanted.has(p.tag));
 		if (spans.length === 0) continue;
 		const froms = spans.map((p) => p.from).filter((d): d is string => Boolean(d)).sort();
@@ -340,7 +440,7 @@ export function passes(held: string[], required: string[][]): boolean {
 export function describe(required: Requirement, levels: LevelConfig[] = [], open = "Free", signedIn = "Signed in"): string {
 	if (required === null) return open;
 	const name = (slug: string) => (slug === UNAVAILABLE ? "Members" : (levels.find((l) => l.slug === slug)?.name ?? slug));
-	const parts = reduce(required).filter((c) => c.length > 0).map((c) => c.map(name).join(" or "));
+	const parts = reduce(required, levels).filter((c) => c.length > 0).map((c) => c.map(name).join(" or "));
 	return parts.length ? parts.join(" + ") : signedIn;
 }
 
@@ -392,7 +492,7 @@ export async function entryRequirement(
 	const own = entryRuleFor(config, collection, id);
 	if (own && (own.mode === "open" || own.mode === "levels") && !own.openUntil && !own.lockedUntil) return applyEntryRule(null, own);
 	const tree = await termTree(config.rules, collection, terms);
-	return applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own);
+	return simplify(applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own), config.levels);
 }
 
 const viewers = new WeakMap<object, Promise<Viewer>>();
@@ -433,7 +533,7 @@ async function readViewer(astro: AstroLike): Promise<Viewer> {
 
 /**
  * May this visitor read the entry? `override` replaces the entry's rule, for a
- * part of a page locked to its own levels (a paywall break with levels).
+ * part of a page locked to its own levels (a Members only part with levels).
  */
 export async function canRead(
 	astro: AstroLike,