@redeemid/emdash 0.0.22 → 0.0.24

package/src/agents.ts

@@ -10,7 +10,7 @@
  */
 
 import { adminConfigured } from "./admin-api.js";
-import { applyEntryRule, entryRuleFor, describe as describeRequirement, dripDays, levelsFor, membership, passes, requirement, termTree, type Requirement, type Terms } from "./access.js";
+import { applyEntryRule, entryRuleFor, groupsOf, simplify, describe as describeRequirement, dripDays, levelsFor, membership, passes, requirement, termTree, type Requirement, type Terms } from "./access.js";
 import { ENV, env, storeDomain, unknownEnvNames, type RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
 import { bodyClauses } from "./files.js";
@@ -69,7 +69,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 	const disabled = member?.status === "disabled";
 	const held = disabled ? [] : levelsFor(tags, levels);
 	const tree = await termTree(config.rules, collection, terms);
-	const required: Requirement = applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own);
+	const required: Requirement = simplify(applyEntryRule(requirement(config.rules, collection, terms, { combine: config.combine, tree }), own), levels);
 	const owned = !disabled && holdsItem(item, tags);
 	const canReadRule = owned || required === null || (signedIn && !disabled && passes(held, required));
 	const name = (slug: string) => (slug === "signed-in" ? "Signed in" : (levels.find((l) => l.slug === slug)?.name ?? slug));
@@ -101,7 +101,7 @@ export async function explainAccess(config: RedeemIDConfig, s: Stores, input: Ex
 }
 
 export function listLevels(config: RedeemIDConfig): Array<Record<string, unknown>> {
-	return (config.levels ?? []).map((l) => ({ slug: l.slug, name: l.name, tags: l.tags, match: l.match ?? "any", wall: l.wall ?? null, joinUrl: l.joinUrl ?? null }));
+	return (config.levels ?? []).map((l) => ({ slug: l.slug, name: l.name, groups: groupsOf(l).map((g) => ({ tags: g.tags, match: g.match ?? "any" })), includes: l.includes ?? [], wall: l.wall ?? null, joinUrl: l.joinUrl ?? null }));
 }
 
 export function getRules(config: RedeemIDConfig): Record<string, unknown> {

package/src/api-version.ts

@@ -3,4 +3,4 @@
  * when something is added, the major part when something stable changes or
  * goes. Separate from the package version.
  */
-export const API_VERSION = "1.2.0";
+export const API_VERSION = "1.3.0";

package/src/blocks-names.ts

@@ -39,22 +39,20 @@ export function holdsItem(item: SoldItem | null, tags: string[] | undefined): bo
 type Node = { _type?: unknown; levels?: unknown };
 
 /**
- * Split a Portable Text body at its first paywall break: the open part, the
- * members part, and the levels picked on the break (empty = none picked).
- * With no break, everything is in `open` and `paywall` is false.
+ * Split a Portable Text body at its first paywall break: the open part and
+ * the members part. The break only says where the entry's rule starts to
+ * apply; it carries no levels of its own (levels an older break stored are
+ * ignored). With no break, everything is in `open` and `paywall` is false.
  */
 export function splitAtPaywall<T>(value: T[] | null | undefined): {
 	open: T[];
 	locked: T[];
-	levels: string[];
 	paywall: boolean;
 } {
 	const blocks = Array.isArray(value) ? value : [];
 	const at = blocks.findIndex((b) => (b as Node)?._type === PAYWALL_BLOCK);
-	if (at === -1) return { open: blocks, locked: [], levels: [], paywall: false };
-	const raw = (blocks[at] as Node).levels;
-	const levels = Array.isArray(raw) ? raw.filter((l): l is string => typeof l === "string" && l !== "") : [];
-	return { open: blocks.slice(0, at), locked: blocks.slice(at + 1), levels, paywall: true };
+	if (at === -1) return { open: blocks, locked: [], paywall: false };
+	return { open: blocks.slice(0, at), locked: blocks.slice(at + 1), paywall: true };
 }
 
 type TextNode = { _type?: unknown; children?: Array<{ text?: unknown }> };

package/src/components/AccessBadge.astro

@@ -1,7 +1,6 @@
 ---
 /**
- * The level an entry needs, read from its rules (and from a paywall break
- * with levels):
+ * The level an entry needs, read from its rules:
  *
  *   <AccessBadge collection="posts" terms={post.data.terms} content={post.data.content} id={post.id} />
  *
@@ -9,15 +8,15 @@
  * carries `data-redeemid-level` (the level slugs) for styling, and
  * `is-locked` with a lock for readers who can't read the members part.
  */
-import { canRead, describe, entryRequirement, viewer, type Terms } from "../access.js";
-import { holdsItem, soldItem, splitAtPaywall } from "../blocks-names.js";
+import { badgeColor, canRead, describe, entryRequirement, simplify, viewer, type Terms } from "../access.js";
+import { holdsItem, soldItem } from "../blocks-names.js";
 import { siteConfig } from "../site-config.js";
 import { text } from "../text.js";
 
 interface Props {
 	collection: string;
 	terms?: Terms;
-	/** The entry's body, so a paywall break's levels count. */
+	/** The entry's body, for its "Sold on its own" block. */
 	content?: unknown[] | null;
 	/** The entry's id or slug, so its own rule from the editor counts. */
 	id?: string;
@@ -27,22 +26,22 @@ interface Props {
 
 const config = await siteConfig(Astro.locals);
 const { collection, terms, content, id, free = text(config, "Free"), class: className } = Astro.props;
-const split = splitAtPaywall(content);
-const required = split.paywall && split.levels.length
-	? [split.levels]
-	: await entryRequirement(config, collection, terms, id);
+const required = await entryRequirement(config, collection, terms, id);
 const label = describe(required, config?.levels, free, text(config, "Signed in"));
 const item = soldItem(content);
 const owner = item ? (await viewer(Astro)).member : null;
 const owned = Boolean(owner && owner.status !== "disabled" && holdsItem(item, owner.tags));
 const locked = required !== null && !owned && !(await canRead(Astro, { collection, terms, id }, { required })).allowed;
 const slugs = required?.flat().join(" ") || (required ? "signed-in" : "free");
+// The colour of the level the badge names first, when that level has one.
+const color = badgeColor(config?.levels?.find((l) => l.slug === simplify(required, config?.levels)?.find((c) => c.length)?.[0]));
 ---
 
 {label && (
 	<span
 		class:list={["redeemid-badge", { "is-locked": locked }, className]}
 		data-redeemid-level={slugs}
+		style={color ? `--redeemid-level-color: ${color}` : undefined}
 	>
 		{locked && <span class="redeemid-badge__lock" aria-hidden="true">🔒&#xFE0E; </span>}
 		{label}

package/src/components/Account.astro

@@ -3,20 +3,31 @@
  * Sign in link for visitors; name, levels, Account and Sign out for members.
  */
 import { siteConfig } from "../site-config.js";
-import { accountUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { accountUrl, badgeColor, signInUrl, signOutUrl, topLevels, viewer } from "../access.js";
 import { text } from "../text.js";
 
 const v = await viewer(Astro);
 const config = await siteConfig(Astro.locals);
 const here = Astro.url.pathname + Astro.url.search;
-const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).map((l) => l.name);
+// "Gold", not "Gold, Silver", when Gold includes Silver.
+const top = topLevels(v.levels, config?.levels);
+const held = (config?.levels ?? []).filter((l) => top.includes(l.slug));
 ---
 
 <div class="redeemid-account" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
 	{v.signedIn ? (
 		<>
 			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? text(config, "Signed in")}</span>
-			{names.length > 0 && <span class="redeemid-account__levels">{names.join(", ")}</span>}
+			{held.length > 0 && (
+				<span class="redeemid-account__levels">
+					{held.map((l, i) => (
+						<>
+							{i > 0 && ", "}
+							<span data-redeemid-level={l.slug} style={badgeColor(l) ? `--redeemid-level-color: ${badgeColor(l)}` : undefined}>{l.name}</span>
+						</>
+					))}
+				</span>
+			)}
 			<a class="redeemid-account__link" href={accountUrl(here)}>{text(config, "Account")}</a>
 			<form method="post" action={signOutUrl(here)}>
 				<button type="submit">{text(config, "Sign out")}</button>

package/src/components/Content.astro

@@ -5,9 +5,9 @@
  *   <Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id} />
  *
  * - "Paywall break": everything before the first one is shown to everyone.
- *   What follows reaches the page only for readers who may read it: the
- *   levels picked on the break, or when none are picked the entry's rule
- *   (with no rule, the break changes nothing).
+ *   What follows reaches the page only for readers the entry's rule lets in
+ *   (with no rule, the break changes nothing). The break says where the
+ *   rule starts; the rule itself comes from the entry's settings.
  * - "Members only" … "Members only: end": the part between is for the levels
  *   picked on the start block, or the entry's rule, or any signed-in member.
  *   Readers who can't read it see the wall in its place, and the body goes on.
@@ -60,9 +60,9 @@ const entryRule = await entryRequirement(config, collection, terms, id);
 const item = soldItem(value);
 const reader = item ? (await viewer(Astro)).member : null;
 const owned = Boolean(reader && reader.status !== "disabled" && holdsItem(item, reader.tags));
-// A break with levels picked locks the rest to them; with none picked it
-// follows the entry's rule, and does nothing when no rule covers the entry.
-const required = split.paywall ? (split.levels.length ? [split.levels] : entryRule) : undefined;
+// The rest after a break follows the entry's rule, and the break does
+// nothing when no rule covers the entry.
+const required = split.paywall ? entryRule : undefined;
 const verdict: Verdict | { allowed: true; reason: "open" } =
 	owned || (split.paywall && required === null)
 		? { allowed: true, reason: "open" }

package/src/components/MemberCard.astro

@@ -11,7 +11,7 @@
  * Everything shown comes from the mirrored Shopify customer; Refresh
  * membership reads it from the store again.
  */
-import { accountUrl, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { accountUrl, badgeColor, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
 import { featuresFor } from "../features.js";
 import { siteConfig } from "../site-config.js";
 import { text, textParts } from "../text.js";
@@ -29,6 +29,7 @@ const m = v.member;
 const disabled = m?.status === "disabled";
 const { current, past } = m && !disabled ? membership(m, config?.levels) : { current: [], past: [] };
 const meter = v.signedIn ? await meterUsage(Astro) : null;
+const color = (slug: string) => badgeColor(config?.levels?.find((l) => l.slug === slug));
 const held = m ? featuresFor(m, config?.features, config?.levels) : [];
 const features = (config?.features ?? []).filter((f) => held.includes(f.slug));
 const date = (iso: string | null) => {
@@ -59,8 +60,8 @@ const join = config?.join;
 				<p class="redeemid-member__disabled">{text(config, "Your account is turned off. Contact the store for help.")}</p>
 			) : current.length > 0 ? (
 				<ul class="redeemid-member__levels">
-					{current.map((l) => (
-						<li data-redeemid-level={l.slug}>
+					{current.filter((l) => !l.via).map((l) => (
+						<li data-redeemid-level={l.slug} style={color(l.slug) ? `--redeemid-level-color: ${color(l.slug)}` : undefined}>
 							<strong>{l.name}</strong>
 							{(dates.since ? day(dates.since) : date(l.since)) && <> {textParts(config, "since {date}", { date: <time datetime={dates.since ?? l.since ?? undefined}>{dates.since ? day(dates.since) : date(l.since)}</time> })}</>}
 						</li>

package/src/components/Plan.astro

@@ -6,11 +6,16 @@
  *
  *   <Plan handle="gold-membership" levels={["gold"]} />
  *
- * With `levels`, members who hold one of them see "You're on this plan"
- * in place of the button, and a member who held one before (Shopify removed
- * its tag) sees "Renew" instead of "Join".
+ * `levels` are the levels the plan gives; left out, they are the levels
+ * whose `products` list the handle. Then the card fits the member:
+ *
+ * - held: they hold one of them through its own tags: "You're on this plan."
+ * - included: a level they hold includes it: "Included in your Gold membership."
+ * - upgrade: the plan's level includes one they hold: the button says "Upgrade".
+ * - renew: they held one before (Shopify removed its tag): "Renew".
+ * - join: anyone else.
  */
-import { membership, viewer } from "../access.js";
+import { closure, directLevels, membership, topLevels, viewer } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { money, plan as loadPlan, storeContext, type Plan } from "../storefront.js";
 import { text } from "../text.js";
@@ -21,15 +26,19 @@ interface Props {
 	label?: string;
 	/** Heading override; defaults to the Shopify product title. */
 	title?: string;
-	/** The levels this plan gives. Members holding one see `heldLabel`, not the button. */
+	/** The levels this plan gives. Defaults to the levels whose `products` list `handle`. */
 	levels?: string[];
 	heldLabel?: string;
 	/** Button text for a member whose plan lapsed. */
 	renewLabel?: string;
+	/** Button text for a member this plan would move up. */
+	upgradeLabel?: string;
 }
 
 const config = await siteConfig(Astro.locals);
-const { handle, label = text(config, "Join"), title, levels = [], heldLabel = text(config, "You're on this plan."), renewLabel = text(config, "Renew") } = Astro.props;
+const { handle, label = text(config, "Join"), title, heldLabel = text(config, "You're on this plan."), renewLabel = text(config, "Renew"), upgradeLabel = text(config, "Upgrade") } = Astro.props;
+const all = config?.levels ?? [];
+const levels = Astro.props.levels?.length ? Astro.props.levels : all.filter((l) => l.products?.some((h) => h.toLowerCase() === handle.toLowerCase())).map((l) => l.slug);
 let p: Plan | null = null;
 if (config) {
 	try {
@@ -42,23 +51,34 @@ if (config) {
 const price = money(p?.price);
 const here = Astro.url.pathname + Astro.url.search;
 const v = levels.length > 0 ? await viewer(Astro) : null;
-const held = Boolean(v?.levels.some((l) => levels.includes(l)));
+const live = v?.member && v.member.status !== "disabled" ? v.member : null;
+const direct = live ? directLevels(live.tags, all) : [];
+const top = topLevels(v?.levels ?? [], all);
+const held = levels.some((l) => direct.includes(l));
+// Held only through a bigger level: name that one.
+const via = held ? undefined : top.find((t) => levels.some((l) => t !== l && closure(t, all).includes(l)));
+const viaName = via ? (all.find((l) => l.slug === via)?.name ?? via) : null;
+// The plan's level includes one the member holds: it moves them up.
+const upgrade = !held && !via && top.length > 0 && levels.some((l) => top.some((t) => t !== l && closure(l, all).includes(t)));
 // Lapsed: held one of these levels before. Offered their plan back, not "Join" as if new.
-const lapsed = Boolean(!held && v?.member && v.member.status !== "disabled" && membership(v.member, config?.levels).past.some((p) => levels.includes(p.slug)));
+const lapsed = Boolean(!held && !via && live && membership(live, all).past.some((p) => levels.includes(p.slug)));
+const state = held ? "held" : via ? "included" : upgrade ? "upgrade" : lapsed ? "renew" : "join";
 ---
 
 {p ? (
-	<div class:list={["redeemid-plan", { "is-held": held, "is-lapsed": lapsed }]} data-redeemid-plan={p.handle} data-redeemid-state={held ? "held" : lapsed ? "renew" : "join"}>
+	<div class:list={["redeemid-plan", { "is-held": held || Boolean(via), "is-lapsed": lapsed }]} data-redeemid-plan={p.handle} data-redeemid-state={state}>
 		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
 		{price && <p class="redeemid-plan__price">{price}</p>}
 		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
 		{held ? (
 			<p class="redeemid-plan__held">{heldLabel}</p>
+		) : viaName ? (
+			<p class="redeemid-plan__held">{text(config, "Included in your {level} membership.", { level: viaName })}</p>
 		) : p.availableForSale ? (
 			<form method="post" action="/_emdash/api/auth/redeemid/buy">
 				<input type="hidden" name="plan" value={p.handle} />
 				<input type="hidden" name="return" value={here} />
-				<button type="submit">{lapsed ? renewLabel : label}</button>
+				<button type="submit">{upgrade ? upgradeLabel : lapsed ? renewLabel : label}</button>
 			</form>
 		) : (
 			<p class="redeemid-plan__unavailable">{text(config, "Not available right now.")}</p>

package/src/config.ts

@@ -15,14 +15,65 @@ export interface LevelConfig {
 	slug: string;
 	/** Name shown to members. */
 	name: string;
-	/** Shopify customer tags that grant this level. Matched case-insensitively. */
-	tags: string[];
-	/** "any" (default): one of the tags is enough. "all": every tag is needed. */
+	/**
+	 * Shopify customer tags that grant this level. Matched case-insensitively.
+	 * This is the level's first tag group; `groups` adds more.
+	 */
+	tags?: string[];
+	/** For `tags`: "any" (default): one of the tags is enough. "all": every tag is needed. */
 	match?: "any" | "all";
+	/**
+	 * More tag groups, any one of which also grants the level: a level that is
+	 * "gold", or "silver" and "annual", is `tags: ["gold"]` with
+	 * `groups: [{ tags: ["silver", "annual"], match: "all" }]`.
+	 */
+	groups?: TagGroup[];
+	/**
+	 * Slugs of levels this one also opens: Gold with `includes: ["silver"]`
+	 * reads everything for Silver. Inclusion carries on (Gold includes Silver
+	 * includes Members), so rules name only the lowest level that may read.
+	 */
+	includes?: string[];
 	/** What the wall says to readers this level would let in, e.g. "Gold members read every investigation." */
 	wall?: string;
 	/** Where the wall's join link goes for this level. Falls back to `join.href`. */
 	joinUrl?: string;
+	/**
+	 * Handles of the Shopify products whose purchase leads to this level
+	 * (Flow or an app tags the buyer). Display only: plan cards use it to say
+	 * "You're on this plan", "Included in your Gold membership" or "Upgrade".
+	 * It grants nothing.
+	 */
+	products?: string[];
+	/**
+	 * Members' home: a same-site path members of this level land on after
+	 * signing in from the home page or a plain sign-in link, e.g. "/members/gold/".
+	 * Signing in from an entry returns them to it.
+	 */
+	home?: string;
+	/** Badge colour, a hex such as "#c9a227", set as `--redeemid-level-color` on badges and level names. Badges always show the name too. */
+	badge?: string;
+}
+
+/** One way to hold a level: any one of `tags`, or every one with `match: "all"`. */
+export interface TagGroup {
+	tags: string[];
+	match?: "any" | "all";
+}
+
+/** A level's tag groups: `tags`/`match` first, then `groups`. Empty groups are dropped. */
+export function groupsOf(level: LevelConfig): TagGroup[] {
+	const out: TagGroup[] = [];
+	if (level.tags?.length) out.push({ tags: level.tags, ...(level.match === "all" ? { match: "all" as const } : {}) });
+	for (const g of level.groups ?? []) {
+		if (g && Array.isArray(g.tags) && g.tags.length) out.push({ tags: g.tags, ...(g.match === "all" ? { match: "all" as const } : {}) });
+	}
+	return out;
+}
+
+/** Every tag any of the level's groups names, lower case. */
+export function levelTags(level: LevelConfig): string[] {
+	return [...new Set(groupsOf(level).flatMap((g) => g.tags.map((t) => t.toLowerCase())))];
 }
 
 /**

package/src/contract.ts

@@ -16,7 +16,7 @@ export { API_VERSION } from "./api-version.js";
 /** Stable exports, by import path. */
 export const MODULES = {
 	"@redeemid/emdash": ["redeemid", "redeemidGuard", "redeemidPlugin"],
-	"@redeemid/emdash/access": ["siteConfig", "viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
+	"@redeemid/emdash/access": ["siteConfig", "viewer", "canRead", "readEntry", "entryRequirement", "meterUsage", "membership", "levelsFor", "topLevels", "closure", "simplify", "signInUrl", "signOutUrl", "accountUrl", "cartUrl", "refreshUrl", "safeReturn"],
 	"@redeemid/emdash/features": ["hasFeature", "viewerFeatures", "featuresFor"],
 	"@redeemid/emdash/preferences": ["readPreferences", "savePreferences", "preferenceFields"],
 	"@redeemid/emdash/storefront": ["plan", "product", "collection", "money", "realOptions", "variantFor", "storeContext", "cartDetails", "addToCart", "updateLines", "removeLines", "setDiscountCodes"],

package/src/files.ts

@@ -17,7 +17,7 @@
  */
 
 import { readEntry, SIGNED_IN, viewer, type AstroLike, type Terms } from "./access.js";
-import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem, splitAtPaywall } from "./blocks-names.js";
+import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem } from "./blocks-names.js";
 import type { FileRule, RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
 import { text } from "./text.js";
@@ -79,15 +79,14 @@ async function entriesUsing(db: unknown, mediaId: string): Promise<Array<{ colle
 }
 
 /**
- * The levels picked on an entry body's breaks and members-only parts: readers
- * must hold one from each. A members-only part with none picked needs a
+ * The levels picked on an entry body's members-only parts: readers must
+ * hold one from each. A members-only part with none picked needs a
  * signed-in reader (on top of the entry's rule, which the caller checks).
+ * A paywall break adds nothing: what follows it is under the entry's rule.
  */
 export function bodyClauses(body: unknown): string[][] {
 	const blocks = Array.isArray(body) ? body : [];
 	const out: string[][] = [];
-	const split = splitAtPaywall(blocks);
-	if (split.paywall && split.levels.length) out.push(split.levels);
 	for (const s of sections(blocks)) if (s.members) out.push(s.levels.length ? s.levels : [SIGNED_IN]);
 	return out;
 }

package/src/log.ts

@@ -42,6 +42,7 @@ export const LOG_EVENTS: Record<string, string> = {
 	"shopify.admin": "Admin API call",
 	"staff.resync": "Resync",
 	"staff.tags": "Tag edit",
+	"staff.link": "Account link",
 	"staff.webhooks": "Webhook registration",
 	"settings.saved": "Settings saved",
 	"events.failed": "Outbound event failed",

package/src/plugin.ts

@@ -11,10 +11,9 @@
  * test, Privacy), a daily webhook health check and a dashboard widget. Sign-in, webhooks and checkout stay on the
  * auth provider's routes.
  *
- * - "Paywall break" (`redeemid-paywall`): everything after it in the body is
- *   for members. Pick the levels that may read on ("Signed in" for any
- *   member); none picked means the entry's rule, and nothing is locked when
- *   no rule covers the entry.
+ * - "Paywall break" (`redeemid-paywall`): marks where the entry's rule starts.
+ *   Everything before it is for everyone; everything after it follows the
+ *   entry's rule, and nothing is locked when no rule covers the entry.
  * - "Members only" (`redeemid-members`) and "Members only: end"
  *   (`redeemid-members-end`): the part between is for the levels picked on
  *   the start block; everyone else sees the wall there and reads on after.
@@ -28,17 +27,17 @@
 import type { PluginContext, ResolvedPlugin, RouteContext } from "emdash";
 import { definePlugin } from "emdash";
 
-import { levelsFor, SIGNED_IN, type Terms } from "./access.js";
+import { levelsFor, SIGNED_IN, topLevels, type Terms } from "./access.js";
 import { accessAction, accessPage, entryPanel, entrySave, entrySlugChanged, isAccessAction, type AccessEnv, type PanelEntry } from "./access-admin.js";
 import { deleteAccess, entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
-import { env, ENV, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
+import { env, ENV, shopOrigin, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
 import { EDITOR_PANELS, PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
 import { AdminError, adminConfigured } from "./admin-api.js";
 import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
-import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit } from "./staff.js";
+import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, staffLink, staffUnlink, tagEdit } from "./staff.js";
 import { textProblems } from "./text.js";
 import { gatedFindings, templateFindings } from "./template-scan.js";
 import { setupFacts, setupPage, WEBHOOK } from "./setup.js";
@@ -84,15 +83,8 @@ function blocks(config: RedeemIDConfig) {
 			type: PAYWALL_BLOCK,
 			label: "Paywall break",
 			icon: "lock",
-			description: "Everything after this is for members",
-			fields: [
-				{
-					type: "checkbox" as const,
-					action_id: "levels",
-					label: "Who can read on (none = the entry's rule)",
-					options: levelOptions,
-				},
-			],
+			description: "Everyone reads up to here; the rest follows this entry's access rule",
+			fields: [],
 		},
 		{
 			type: MEMBERS_BLOCK,
@@ -539,6 +531,20 @@ async function action(
 				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
 			}
 		}
+		case "member_link":
+		case "member_unlink": {
+			const id = i.action_id === "member_link" ? String(i.block_id ?? "").replace(/^link:/, "") : String(i.value ?? "");
+			try {
+				const { getDb } = await import("emdash/runtime");
+				const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+				const adapter = createKyselyAdapter((await getDb()) as never);
+				const m = i.action_id === "member_link" ? await staffLink(adapter, s, id, i.values?.email) : await staffUnlink(adapter, s, id);
+				return memberDetail(config, m, { type: "success", message: m.userId ? "Linked. Their next sign-in uses that site user." : "Unlinked." });
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
 		case "member_tag_add":
 		case "member_tag_remove": {
 			const add = i.action_id === "member_tag_add";
@@ -675,7 +681,7 @@ async function membersPage(config: RedeemIDConfig) {
 	}));
 	const name = (m: MemberRecord) => [m.firstName, m.lastName].filter(Boolean).join(" ") || "No name";
 	const levelNames = (m: MemberRecord) => {
-		const held = levelsFor(m.tags, levels);
+		const held = topLevels(levelsFor(m.tags, levels), levels);
 		return levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ");
 	};
 	return {
@@ -812,6 +818,7 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 						},
 					]
 				: []),
+			...customDomainBlocks(config),
 			...templateBlocks(config),
 			{ type: "context", text: "Setting up a store step by step is under Setup. Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
 			{ type: "divider" },
@@ -831,6 +838,30 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	};
 }
 
+/**
+ * Status: the Admin API (staff tools, webhook registration, tag reads) only
+ * answers on the store's myshopify.com domain, so a custom domain in `shop`
+ * breaks it while sign-in still works.
+ */
+export function customDomainBlocks(config: RedeemIDConfig): unknown[] {
+	if (!adminConfigured() || config.allowInsecureShop) return [];
+	let host = "";
+	try {
+		host = new URL(shopOrigin(config)).hostname;
+	} catch {
+		return [];
+	}
+	if (host.endsWith(".myshopify.com")) return [];
+	return [
+		{
+			type: "banner",
+			variant: "alert",
+			title: "Use the myshopify.com domain",
+			description: `The store domain is ${host}. Shopify's Admin API, which the staff tools, webhook registration and tag reads use, only answers on the store's myshopify.com domain. Set REDEEMID_SHOPIFY_STORE_DOMAIN (or shop) to it; sign-in works with it too.`,
+		},
+	];
+}
+
 /** Status: templates that would show a gated body in full (see template-scan.ts). */
 function templateBlocks(config: RedeemIDConfig): unknown[] {
 	const found = templateFindings();

package/src/privacy.ts

@@ -82,22 +82,25 @@ export async function eraseMember(config: RedeemIDConfig | null, s: Stores, cust
 	return Boolean(member);
 }
 
-/** shop/redact: erase every member and meter record. */
+/**
+ * shop/redact: erase every member and meter record. Deletes a page of 100 at
+ * a time in one statement, so even a large shop stays well inside a Workers
+ * Free request's query limit (a few queries per hundred members).
+ */
 export async function eraseAll(config: RedeemIDConfig | null, s: Stores): Promise<number> {
 	let n = 0;
 	for (;;) {
 		const page = await s.members.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) {
-			for (const m of await meterFor(s, r.data.userId)) await s.meter.delete(m.id);
-			await s.members.delete(r.id);
-			n++;
-		}
+		const deleted = await s.members.deleteMany(page.items.map((r) => r.id));
+		n += page.items.length;
+		// A store that deletes nothing would loop forever.
+		if (deleted === 0) throw new Error("shop/redact: members could not be deleted");
 	}
 	for (;;) {
 		const page = await s.meter.query({ limit: 100 });
 		if (page.items.length === 0) break;
-		for (const r of page.items) await s.meter.delete(r.id);
+		if ((await s.meter.deleteMany(page.items.map((r) => r.id))) === 0) throw new Error("shop/redact: meter records could not be deleted");
 	}
 	await log(s, { kind: "erase", source: "shopify", customerId: null, status: "done", note: `Shop redacted: ${n} members` });
 	return n;

package/src/routes/callback.ts

@@ -18,7 +18,7 @@ import { env, ENV, PROVIDER_ID, storeDomain } from "../config.js";
 import { siteConfig } from "../site-config.js";
 import { emit, levelChange } from "../events.js";
 import { record } from "../log.js";
-import { levelsFor } from "../access.js";
+import { levelsFor, memberHome } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
@@ -149,7 +149,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			if (sealed) session.set(SESSION_CUSTOMER_TOKEN, sealed);
 			else session.delete?.(SESSION_CUSTOMER_TOKEN);
 		} else session.delete?.(SESSION_CUSTOMER_TOKEN);
-		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
+		if (flow.refresh) return fail(redirect, returnTo, "refreshed");
+		// From the home page or a plain sign-in link: the member's home for their level.
+		const home = returnTo === "/" && member.status !== "disabled" ? memberHome(who.tags, config.levels) : null;
+		return redirect(home ?? returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";
 		console.error("[redeemid] sign-in failed:", (e as Error).message);

package/src/routes/webhook.ts

@@ -16,7 +16,7 @@ import { stores, type Stores } from "../storage.js";
 import { adminConfigured, resync } from "../admin-api.js";
 import type { RedeemIDConfig } from "../config.js";
 import { record } from "../log.js";
-import { apply, customerOf, kindOf, verifyHmac, type Outcome } from "../webhooks.js";
+import { apply, customerOf, kindOf, mergeIds, verifyHmac, type Outcome } from "../webhooks.js";
 
 export const prerender = false;
 
@@ -81,6 +81,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	try {
 		const config = await siteConfig(locals);
 		const outcome = (await currentTags(config, s, topic, customerId)) ?? (await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config));
+		if (outcome === "processed" && kindOf(topic) === "merge") await mergedTags(config, s, topic, payload);
 		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
 		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
@@ -112,3 +113,22 @@ async function currentTags(config: RedeemIDConfig | null, s: Stores, topic: stri
 		return null;
 	}
 }
+
+/**
+ * customers/merge moves the sign-in link to the customer kept, but the payload
+ * has no tags. With the Admin API app set up, read the survivor's tags now
+ * rather than wait for its next webhook or sign-in. A failed read leaves the
+ * merge as it is.
+ */
+async function mergedTags(config: RedeemIDConfig | null, s: Stores, topic: string, payload: Record<string, unknown>): Promise<void> {
+	const { kept } = mergeIds(payload);
+	if (!config || !kept || !adminConfigured()) return;
+	try {
+		const before = await s.members.get(kept);
+		if (!before) return;
+		const { updated } = await resync(config, s, [kept], topic);
+		if (updated[0]) await levelChange(config, before.tags, updated[0], topic);
+	} catch (e) {
+		console.error("[redeemid] merge resync failed:", (e as Error).message);
+	}
+}