@redeemid/emdash 0.0.7 → 0.0.9

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.7, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
+**Status: 0.0.9, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout, the staff tools and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -19,7 +19,10 @@ Shopify customer accounts, member levels and paywalls for [EmDash](https://githu
 - **Members only block.** For a members part in the middle of a body: "Members only" (pick the levels) and "Members only: end". Everyone else sees the wall in its place and reads on after it.
 - **The wall.** Readers kept out see why and what to do next: sign in, or join, with each level's own wall text. `<Notices>` shows the messages sign-in, Buy, Cart and Account send readers back with.
 - **Plan block.** Editors add a Shopify product to any page with the "Plan" block: title, price and a buy button.
-- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels), a Status page (secrets, store discovery, the URLs to give Shopify, levels and rules) and a dashboard widget.
+- **Shop.** `<Product>`, `<Collection>` and `<CartView>` (with the Product and Collection blocks) give the site product pages, collection grids and a cart page with quantities and discount codes. `<Contribution>` (and its block) takes pay-what-you-want amounts. Carts note the page each sale started on.
+- **Features.** Name perks members hold through levels or tags (ad-free, a supporter thank-you) and show them with `<Feature>` or `hasFeature()`.
+- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels; open a member to resync them or add and remove tags, which are written to Shopify), a bulk resync you start yourself, a Status page (secrets, store discovery, webhook subscriptions with a Register button, recent deliveries, levels and rules), an Access test and a dashboard widget.
+- **Outbound events.** Signed JSON POSTs to a URL of yours when a member signs in, their levels change, or they use the meter, for a CRM, an email tool or your own code.
 - **Keeps members out of EmDash's own APIs**, so the gate is the only way to read locked content.
 
 ## Install
@@ -75,6 +78,8 @@ Set these secrets in the environment (`.env` locally, `wrangler secret put` on W
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID` | Customer Account API | Client ID of the Headless storefront's Customer Account API client |
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET` | Customer Account API | Its client secret. Confidential clients only; leave unset for a public client. |
 | `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET` | Webhooks (Admin API app) | Client secret of the Shopify app that sends the webhooks. Shopify signs each webhook with it. |
+| `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` | Admin API (staff tools) | Client ID of that same app. Optional; with it, staff can resync members, edit tags in Shopify and register webhooks. |
+| `REDEEMID_EVENTS_SECRET` | None | Optional. Signs outbound events; set it with `events.url`. |
 | `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
 | `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
 
@@ -110,6 +115,55 @@ The meter lets a signed-in reader who can't read an entry open it anyway, `limit
 
 Drip holds a rule's entries back from members who pass it until they've held their level for `drip` days. A level starts when the customer first had its tag (for a `match: "all"` level, the last of its tags); with several levels the earliest counts, and with none known, the first sign-in. RedeemID notes when each tag first arrives from sign-in and webhooks, and forgets a tag when Shopify removes it. The wall shows the date the entry opens.
 
+### Features
+
+```ts
+features: [
+	{ slug: "ad-free", name: "Ad-free", levels: ["gold", "premium"] },
+	{ slug: "supporter", name: "Supporter", tags: ["supporter"] },
+],
+```
+
+A member holds a feature through any of its levels or tags; like levels, features come only from the mirrored tags. `<MemberCard>` lists them under the member's levels.
+
+```astro
+---
+import Feature from "@redeemid/emdash/components/Feature.astro";
+import { hasFeature } from "@redeemid/emdash/features";
+---
+<Feature slug="supporter"><p>Thanks for your support.</p><p slot="else">Become a supporter.</p></Feature>
+{!(await hasFeature(Astro, "ad-free")) && <aside class="ad">…</aside>}
+```
+
+### Events
+
+```ts
+events: { url: "https://hooks.example.com/redeemid", only: ["member.signed_in", "member.levels_changed"] },
+```
+
+With `REDEEMID_EVENTS_SECRET` set, RedeemID POSTs `{ id, event, at, data }` to the URL. Headers: `X-RedeemID-Event`, `X-RedeemID-Delivery` (the `id`) and `X-RedeemID-Signature: sha256=<hex HMAC-SHA256 of the raw body with the secret>`. Check the signature before you trust a body. Sending waits at most 3 seconds and never breaks the page; a failed send is logged and dropped, not retried.
+
+| Event | `data` |
+| --- | --- |
+| `member.signed_in` | `customerId`, `levels`, `first` (first sign-in), `refresh` |
+| `member.levels_changed` | `customerId`, `levels`, `added`, `removed`, `source` (`sign-in`, the webhook topic, or a staff resync or tag edit) |
+| `meter.used` | `userId` (EmDash), `entry` (`collection:id`), `used`, `limit`, `period` (`2026-11`, or `2026-W45` by week) |
+| `meter.exhausted` | the same, sent with the last free read |
+
+No event carries an email address or a name: match people by the Shopify `customerId`. `only` limits which events are sent; leave it out for all of them.
+
+### Staff tools
+
+With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set, RedeemID gets an Admin API token for the webhook app with the client credentials grant (the app must belong to the same Shopify organization as the store, as Dev Dashboard apps do) and needs the `read_customers` and `write_customers` scopes. Then, in the admin:
+
+- **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
+- **Bulk resync.** Reads the 50 members synced longest ago from Shopify in one request. Run it again for the next 50. It never runs on its own.
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Recent deliveries.** The last webhooks the site took, with their topics and times.
+- **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
+
+Resync updates email, name and tags. Status stays with the enable and disable webhooks.
+
 ## Use it in templates
 
 EmDash has no content filter hook, so templates decide what to render. Render the entry body with `<Content>` instead of `<PortableText>`:
@@ -168,6 +222,34 @@ import Plan from "@redeemid/emdash/components/Plan.astro";
 </Plan>
 ```
 
+### Shop
+
+Products, collections and the cart come from the Storefront API; Shopify works out prices, discounts, taxes and stock.
+
+```astro
+---
+import Product from "@redeemid/emdash/components/Product.astro";
+import Collection from "@redeemid/emdash/components/Collection.astro";
+import CartView from "@redeemid/emdash/components/CartView.astro";
+import Contribution from "@redeemid/emdash/components/Contribution.astro";
+---
+<!-- /shop/ -->
+<Collection handle="shop" productHref="/shop/{handle}/" showTitle />
+<!-- /shop/[handle]/ -->
+<Product handle={Astro.params.handle} heading="h1"><p>No such product.</p></Product>
+<!-- /cart/ -->
+<CartView productHref="/shop/{handle}/" />
+<!-- anywhere -->
+<Contribution handle="support" amounts={[5, 10, 25]} />
+```
+
+- `<Product>`: image, title, price, description, the variants (sold-out ones shown but not choosable), a quantity, Add to cart (back to the page with the `cart_added` notice) and Buy now (straight to checkout).
+- `<Collection>`: the collection's products (`limit`, up to 50) as cards linking to `productHref`.
+- `<CartView>`: each line with its price, a quantity to change (0 removes it) and Remove, a discount code field, the subtotal and total, and Checkout. Pages with it are sent `Cache-Control: private, no-store`.
+- `<Contribution>`: pay what you want. Make a Shopify product priced at 1.00; the amount the reader picks becomes the quantity, so Shopify charges exactly that.
+
+The forms post to `/_emdash/api/auth/redeemid/cart-edit`, which reads every product and variant from Shopify again and only changes lines in the visitor's own cart. A new cart carries the `_redeemid_page` attribute (the page the first item was added on), which shows on the order in Shopify admin; Shopify hides attributes starting with `_` at checkout. Editors get the same with the Product, Collection and Contribution blocks.
+
 Or ask directly:
 
 ```ts

package/docs/shopify-setup.md

@@ -29,6 +29,8 @@ RedeemID keeps tags and status current from webhooks. Point these topics at `htt
 
 Subscribe them from a Shopify app on the store (for example a Dev Dashboard app). If the app already sends webhooks to another site, add this URL as extra subscriptions. `customers/merge` needs the `read_customer_merge` scope. Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
 
+For the staff tools (member resync, tag edits written to Shopify, the Register webhooks button), give the same app the `read_customers` and `write_customers` Admin API scopes and set its **client ID** as well. RedeemID uses the client credentials grant, which works when the app and the store are in the same Shopify organization.
+
 ## 3. The site
 
 Add the package and config as in the [README](../README.md#install), with `shop` set to the store's domain. A custom customer-account domain works as well as `*.myshopify.com`.
@@ -40,6 +42,8 @@ npx wrangler secret put REDEEMID_SHOPIFY_STORE_DOMAIN                   # e.g. m
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID     # Customer Account API client ID
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET # confidential clients only
 npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET        # the webhook app's client secret
+npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID            # optional; the webhook app's client ID, for the staff tools
+npx wrangler secret put REDEEMID_EVENTS_SECRET                          # optional; signs outbound events (events.url)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN       # Headless storefront's Storefront API private token (plans, checkout)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN        # optional; used only without the private token
 ```
@@ -53,4 +57,4 @@ The Workers free plan is enough: RedeemID is a native plugin and doesn't need sa
 3. Click **Sign in**, sign in with that customer's email, and you come back to the post, unlocked.
 4. Add or remove the tag in Shopify; the post opens or locks again once the webhook arrives.
 
-If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails. Refresh membership returns `refreshed` once it has read the member's tags again.
+If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails. Cart changes return `cart_added`, `cart_updated`, `discount_applied` or `discount_not_applicable`. Refresh membership returns `refreshed` once it has read the member's tags again.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.7",
+	"version": "0.0.9",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -15,6 +15,8 @@
 		"./access": "./src/access.ts",
 		"./guard.ts": "./src/guard.ts",
 		"./storefront": "./src/storefront.ts",
+		"./features": "./src/features.ts",
+		"./events": "./src/events.ts",
 		"./plugin": "./src/plugin.ts",
 		"./blocks": "./src/blocks/index.ts",
 		"./components/*": "./src/components/*",

package/src/access.ts

@@ -469,7 +469,13 @@ export async function readEntry(
 		const used = consume(record.items, `${entry.collection}:${entry.id}`, meter.limit);
 		const info = { limit: meter.limit, period };
 		if (!used.allowed) return { ...verdict, meterLeft: 0, meter: info };
-		if (used.items !== record.items) await s.meter.put(key, { ...record, items: used.items });
+		if (used.items !== record.items) {
+			await s.meter.put(key, { ...record, items: used.items });
+			const { emit } = await import("./events.js");
+			const data = { userId: user.id, entry: `${entry.collection}:${entry.id}`, used: used.items.length, limit: meter.limit, period: record.period };
+			await emit(config, "meter.used", data);
+			if (used.left === 0) await emit(config, "meter.exhausted", data);
+		}
 		return { ...verdict, allowed: true, reason: "metered", meterLeft: used.left, meter: info };
 	} catch {
 		return verdict;

package/src/admin-api.ts

@@ -0,0 +1,191 @@
+/**
+ * Shopify Admin API, for staff tools only: resync a member, write tags to
+ * Shopify, register webhooks. The token comes from the client credentials
+ * grant of the Shopify app whose webhooks the site receives
+ * (REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID + _CLIENT_SECRET). Tokens last about
+ * a day; this keeps one per store in memory until shortly before expiry.
+ *
+ * Nothing here grants access: tag edits go to Shopify, and the mirror only
+ * changes from what Shopify answers.
+ */
+
+import { env, ENV, shopOrigin, type RedeemIDConfig } from "./config.js";
+import { USER_AGENT } from "./shopify.js";
+import { cleanTags, emptyMember, stampTags, type MemberRecord, type Stores } from "./storage.js";
+
+export const ADMIN_API_VERSION = "2026-10";
+
+/** Webhook topics RedeemID needs, as the Admin API names them. customers/redact is set in the app's config, not here. */
+export const WEBHOOK_TOPICS = [
+	"CUSTOMERS_CREATE",
+	"CUSTOMERS_UPDATE",
+	"CUSTOMERS_DELETE",
+	"CUSTOMERS_DISABLE",
+	"CUSTOMERS_ENABLE",
+	"CUSTOMERS_MERGE",
+	"CUSTOMER_TAGS_ADDED",
+	"CUSTOMER_TAGS_REMOVED",
+] as const;
+
+const MARGIN_MS = 5 * 60 * 1000;
+const tokens = new Map<string, { token: string; until: number; scope: string }>();
+
+export function adminConfigured(): boolean {
+	return Boolean(env(ENV.adminClientId) && env(ENV.webhookSecret));
+}
+
+export function resetAdminToken(): void {
+	tokens.clear();
+}
+
+export class AdminError extends Error {}
+
+async function token(config: RedeemIDConfig, fetcher: typeof fetch): Promise<{ token: string; scope: string }> {
+	const origin = shopOrigin(config);
+	const hit = tokens.get(origin);
+	if (hit && hit.until > Date.now()) return hit;
+	const clientId = env(ENV.adminClientId);
+	const secret = env(ENV.webhookSecret);
+	if (!clientId || !secret) throw new AdminError(`Set ${ENV.adminClientId} and ${ENV.webhookSecret} to use the staff tools.`);
+	const res = await fetcher(`${origin}/admin/oauth/access_token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": USER_AGENT },
+		body: new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: secret }).toString(),
+	});
+	const body = (await res.json().catch(() => ({}))) as { access_token?: string; expires_in?: number; scope?: string; error?: string };
+	if (!res.ok || !body.access_token) {
+		// shop_not_permitted: the app and the store are not in the same Shopify organization.
+		throw new AdminError(`Shopify refused the Admin API token (${body.error ?? res.status}).`);
+	}
+	const life = (body.expires_in && body.expires_in > 0 ? body.expires_in : 3600) * 1000;
+	const value = { token: body.access_token, until: Date.now() + Math.max(60_000, life - MARGIN_MS), scope: body.scope ?? "" };
+	tokens.set(origin, value);
+	return value;
+}
+
+/** The scopes the Admin API token carries, or an error message. */
+export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<string> {
+	return (await token(config, fetcher)).scope;
+}
+
+export async function admin<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown> = {}, fetcher: typeof fetch = fetch, retry = true): Promise<T> {
+	const t = await token(config, fetcher);
+	const res = await fetcher(`${shopOrigin(config)}/admin/api/${ADMIN_API_VERSION}/graphql.json`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": USER_AGENT, "X-Shopify-Access-Token": t.token },
+		body: JSON.stringify({ query, variables }),
+	});
+	if (res.status === 401 && retry) {
+		tokens.delete(shopOrigin(config));
+		return admin(config, query, variables, fetcher, false);
+	}
+	const body = (await res.json().catch(() => ({}))) as { data?: T; errors?: Array<{ message?: string }> };
+	if (!res.ok || !body.data) throw new AdminError(body.errors?.[0]?.message ?? `Admin API request failed (${res.status}).`);
+	return body.data;
+}
+
+const gid = (id: string) => `gid://shopify/Customer/${id}`;
+
+export interface AdminCustomer {
+	customerId: string;
+	email: string | null;
+	firstName: string | null;
+	lastName: string | null;
+	tags: string[];
+	updatedAt: number | null;
+}
+
+/** Up to 100 customers by numeric id. Customers Shopify no longer has are left out. */
+export async function customers(config: RedeemIDConfig, ids: string[], fetcher: typeof fetch = fetch): Promise<AdminCustomer[]> {
+	if (ids.length === 0) return [];
+	type Node = { id: string; firstName: string | null; lastName: string | null; tags: string[]; updatedAt: string; defaultEmailAddress: { emailAddress: string | null } | null } | null;
+	const data = await admin<{ nodes: Node[] }>(
+		config,
+		`query RedeemIDCustomers($ids: [ID!]!) { nodes(ids: $ids) { ... on Customer { id firstName lastName tags updatedAt defaultEmailAddress { emailAddress } } } }`,
+		{ ids: ids.slice(0, 100).map(gid) },
+		fetcher,
+	);
+	return data.nodes
+		.filter((n): n is NonNullable<Node> => Boolean(n?.id))
+		.map((n) => ({
+			customerId: n.id.replace(/^gid:\/\/shopify\/Customer\//, ""),
+			email: n.defaultEmailAddress?.emailAddress?.toLowerCase() ?? null,
+			firstName: n.firstName || null,
+			lastName: n.lastName || null,
+			tags: cleanTags(n.tags),
+			updatedAt: Number.isFinite(Date.parse(n.updatedAt)) ? Date.parse(n.updatedAt) : null,
+		}));
+}
+
+/**
+ * Read members from Shopify again and update the mirror: profile and tags.
+ * Status stays with the enable/disable webhooks. Members Shopify no longer
+ * has are reported in `missing` and left alone.
+ */
+export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], source = "resync", fetcher: typeof fetch = fetch): Promise<{ updated: MemberRecord[]; missing: string[] }> {
+	const found = await customers(config, ids, fetcher);
+	const updated: MemberRecord[] = [];
+	for (const c of found) {
+		const m = (await s.members.get(c.customerId)) ?? emptyMember(c.customerId);
+		m.email = c.email ?? m.email;
+		m.firstName = c.firstName ?? m.firstName;
+		m.lastName = c.lastName ?? m.lastName;
+		m.tags = c.tags;
+		m.profileUpdatedAt = c.updatedAt ?? m.profileUpdatedAt;
+		m.syncedAt = new Date().toISOString();
+		m.source = source;
+		await s.members.put(c.customerId, stampTags(m));
+		updated.push(m);
+	}
+	const seen = new Set(found.map((c) => c.customerId));
+	return { updated, missing: ids.filter((id) => !seen.has(id)) };
+}
+
+/** Add or remove tags on the Shopify customer. Shopify then sends the tag webhook; callers resync to show it now. */
+export async function editTags(config: RedeemIDConfig, customerId: string, change: "add" | "remove", tags: string[], fetcher: typeof fetch = fetch): Promise<void> {
+	const clean = cleanTags(tags);
+	if (clean.length === 0) return;
+	const m = change === "add" ? "tagsAdd" : "tagsRemove";
+	const data = await admin<Record<string, { userErrors: Array<{ message: string }> }>>(
+		config,
+		`mutation RedeemIDTags($id: ID!, $tags: [String!]!) { ${m}(id: $id, tags: $tags) { userErrors { field message } } }`,
+		{ id: gid(customerId), tags: clean },
+		fetcher,
+	);
+	const err = data[m]?.userErrors[0];
+	if (err) throw new AdminError(err.message);
+}
+
+export interface Subscription {
+	id: string;
+	topic: string;
+	uri: string;
+}
+
+export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<Subscription[]> {
+	type Node = { id: string; topic: string; uri?: string | null };
+	const data = await admin<{ webhookSubscriptions: { nodes: Node[] } }>(
+		config,
+		`query RedeemIDWebhooks { webhookSubscriptions(first: 100) { nodes { id topic uri } } }`,
+		{},
+		fetcher,
+	);
+	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
+}
+
+/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
+export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+	const have = await webhookSubscriptions(config, fetcher);
+	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	for (const topic of missing) {
+		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
+			config,
+			`mutation RedeemIDWebhook($topic: WebhookSubscriptionTopic!, $uri: String!) { webhookSubscriptionCreate(topic: $topic, webhookSubscription: { uri: $uri, format: JSON }) { userErrors { field message } } }`,
+			{ topic, uri },
+			fetcher,
+		);
+		const err = data.webhookSubscriptionCreate.userErrors[0];
+		if (err) throw new AdminError(`${topic}: ${err.message}`);
+	}
+	return [...missing];
+}

package/src/blocks/CollectionBlock.astro

@@ -0,0 +1,22 @@
+---
+/** The "Collection" block: a Shopify collection's products as cards. */
+import Collection from "../components/Collection.astro";
+
+interface Props {
+	node: { handle?: string; limit?: string; link?: string };
+}
+
+const { node } = Astro.props;
+const handle = (node.handle ?? "").trim();
+const limit = Number.parseInt(node.limit ?? "", 10);
+const link = (node.link ?? "").trim();
+---
+
+{handle && (
+	<Collection
+		handle={handle}
+		limit={Number.isFinite(limit) ? limit : 12}
+		productHref={link.startsWith("/") && link.includes("{handle}") ? link : undefined}
+		showTitle
+	/>
+)}

package/src/blocks/ContributionBlock.astro

@@ -0,0 +1,24 @@
+---
+/** The "Contribution" block: pay what you want with a 1.00 Shopify product. */
+import Contribution from "../components/Contribution.astro";
+
+interface Props {
+	node: { handle?: string; title?: string; label?: string; amounts?: string };
+}
+
+const { node } = Astro.props;
+const handle = (node.handle ?? "").trim();
+const amounts = (node.amounts ?? "")
+	.split(",")
+	.map((a) => Number.parseInt(a.trim(), 10))
+	.filter((a) => Number.isFinite(a) && a > 0 && a <= 1000);
+---
+
+{handle && (
+	<Contribution
+		handle={handle}
+		title={node.title?.trim() || undefined}
+		label={node.label?.trim() || "Give"}
+		amounts={amounts.length ? amounts : undefined}
+	/>
+)}

package/src/blocks/ProductBlock.astro

@@ -0,0 +1,12 @@
+---
+/** The "Product" block: a Shopify product with Add to cart and Buy now. */
+import Product from "../components/Product.astro";
+
+interface Props {
+	node: { handle?: string };
+}
+
+const handle = (Astro.props.node.handle ?? "").trim();
+---
+
+{handle && <Product handle={handle} heading="h3" />}

package/src/blocks/index.ts

@@ -3,11 +3,17 @@
  * EmDash from the plugin's `componentsEntry`.
  */
 import Marker from "./PaywallBreak.astro";
+import CollectionBlock from "./CollectionBlock.astro";
+import ContributionBlock from "./ContributionBlock.astro";
 import PlanBlock from "./PlanBlock.astro";
+import ProductBlock from "./ProductBlock.astro";
 
 export const blockComponents = {
 	"redeemid-paywall": Marker,
 	"redeemid-members": Marker,
 	"redeemid-members-end": Marker,
 	"redeemid-plan": PlanBlock,
+	"redeemid-product": ProductBlock,
+	"redeemid-collection": CollectionBlock,
+	"redeemid-contribution": ContributionBlock,
 };

package/src/blocks-names.ts

@@ -1,6 +1,9 @@
 /** Portable Text block types RedeemID adds to the editor. */
 export const PAYWALL_BLOCK = "redeemid-paywall";
 export const PLAN_BLOCK = "redeemid-plan";
+export const PRODUCT_BLOCK = "redeemid-product";
+export const COLLECTION_BLOCK = "redeemid-collection";
+export const CONTRIBUTION_BLOCK = "redeemid-contribution";
 /** Starts a members-only part of the body; it runs to the next end block. */
 export const MEMBERS_BLOCK = "redeemid-members";
 export const MEMBERS_END_BLOCK = "redeemid-members-end";

package/src/components/CartView.astro

@@ -0,0 +1,97 @@
+---
+/**
+ * The visitor's Shopify cart for a cart page: each line with its price and
+ * a quantity to change or remove, a discount code, the totals, and
+ * Checkout. Shopify works out prices and discounts; changes go through
+ * the cart-edit route and come back here with a notice.
+ *
+ *   <CartView />
+ */
+import { cartUrl } from "../access.js";
+import { readCart, saveCart } from "../cart.js";
+import { siteConfig } from "../site-config.js";
+import { cartDetails, money, type CartDetails } from "../storefront.js";
+
+interface Props {
+	/** Link for each line's product; `{handle}` is replaced. */
+	productHref?: string;
+	/** Shown when the cart is empty. */
+	empty?: string;
+}
+
+const { productHref, empty = "Your cart is empty." } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const ref = await readCart(Astro.session);
+let cart: CartDetails | null = null;
+let failed = false;
+if (config && ref) {
+	try {
+		cart = await cartDetails(config, ref.id, { buyerIp: Astro.request.headers.get("cf-connecting-ip") });
+		if (!cart) saveCart(Astro.session, null);
+		else if (cart.totalQuantity !== ref.count) saveCart(Astro.session, { id: cart.id, count: cart.totalQuantity });
+	} catch {
+		failed = true;
+	}
+}
+// A cart page is the visitor's own.
+Astro.response.headers.set("Cache-Control", "private, no-store");
+const here = Astro.url.pathname;
+const href = (h: string) => productHref?.replaceAll("{handle}", encodeURIComponent(h));
+const action = "/_emdash/api/auth/redeemid/cart-edit";
+const code = cart?.discountCodes[0];
+---
+
+<section class="redeemid-cartview" data-redeemid-cart-count={cart?.totalQuantity ?? 0}>
+	{failed ? (
+		<p>Your cart isn't available right now. Try again in a few minutes.</p>
+	) : !cart || cart.lines.length === 0 ? (
+		<p class="redeemid-cartview__empty">{empty}</p>
+	) : (
+		<>
+			<ul class="redeemid-cartview__lines">
+				{cart.lines.map((l) => (
+					<li class="redeemid-cartview__line" data-redeemid-line={l.id}>
+						{l.image && <img src={l.image.url} alt={l.image.altText ?? ""} loading="lazy" />}
+						<div class="redeemid-cartview__item">
+							<p class="redeemid-cartview__name">
+								{href(l.productHandle) ? <a href={href(l.productHandle)}>{l.productTitle}</a> : l.productTitle}
+								{l.variantTitle && l.variantTitle !== "Default Title" && <span> · {l.variantTitle}</span>}
+							</p>
+							<p class="redeemid-cartview__price">{money(l.price)} each · {money(l.total)}</p>
+							<form method="post" action={action} class="redeemid-cartview__quantity">
+								<input type="hidden" name="action" value="update" />
+								<input type="hidden" name="line" value={l.id} />
+								<input type="hidden" name="return" value={here} />
+								<label for={`q-${l.id}`}>Quantity</label>
+								<input id={`q-${l.id}`} name="quantity" type="number" min="0" max="1000" value={l.quantity} inputmode="numeric" />
+								<button type="submit">Update</button>
+							</form>
+							<form method="post" action={action}>
+								<input type="hidden" name="action" value="remove" />
+								<input type="hidden" name="line" value={l.id} />
+								<input type="hidden" name="return" value={here} />
+								<button type="submit" class="redeemid-cartview__remove">Remove<span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap"> {l.productTitle}</span></button>
+							</form>
+						</div>
+					</li>
+				))}
+			</ul>
+			<form method="post" action={action} class="redeemid-cartview__discount">
+				<input type="hidden" name="action" value="discount" />
+				<input type="hidden" name="return" value={here} />
+				<label for="redeemid-discount">Discount code</label>
+				<input id="redeemid-discount" name="code" type="text" value={code?.code ?? ""} autocomplete="off" />
+				<button type="submit">Apply</button>
+				{code && !code.applicable && <p class="redeemid-cartview__code-note">{code.code} doesn't apply to this cart.</p>}
+			</form>
+			<dl class="redeemid-cartview__totals">
+				<dt>Subtotal</dt>
+				<dd>{money(cart.subtotal)}</dd>
+				<dt>Total</dt>
+				<dd>{money(cart.total)}</dd>
+			</dl>
+			<p class="redeemid-cartview__note">Taxes and shipping are worked out at checkout.</p>
+			<a class="redeemid-cartview__checkout" href={cartUrl(here)}>Checkout</a>
+		</>
+	)}
+</section>

package/src/components/Collection.astro

@@ -0,0 +1,55 @@
+---
+/**
+ * A Shopify collection as a grid of product cards: image, title, lowest
+ * price. Each card links to `productHref` with `{handle}` filled in, so the
+ * site can give every product its own page with <Product>.
+ *
+ *   <Collection handle="shop" productHref="/shop/{handle}/" />
+ */
+import { siteConfig } from "../site-config.js";
+import { collection as loadCollection, money, type Collection } from "../storefront.js";
+
+interface Props {
+	handle: string;
+	/** How many products, 1 to 50. */
+	limit?: number;
+	/** Link for each product; `{handle}` is replaced. Leave out for cards without links. */
+	productHref?: string;
+	/** Show the collection's title and description above the grid. */
+	showTitle?: boolean;
+}
+
+const { handle, limit = 12, productHref, showTitle = false } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+let c: Collection | null = null;
+if (config) {
+	try {
+		c = await loadCollection(config, handle, limit);
+	} catch {
+		c = null;
+	}
+}
+const href = (h: string) => productHref?.replaceAll("{handle}", encodeURIComponent(h));
+---
+
+{c && c.products.length > 0 ? (
+	<section class="redeemid-collection" data-redeemid-collection={c.handle}>
+		{showTitle && (
+			<>
+				<h2 class="redeemid-collection__title">{c.title}</h2>
+				{c.description && <p class="redeemid-collection__description">{c.description}</p>}
+			</>
+		)}
+		<ul class="redeemid-collection__grid">
+			{c.products.map((p) => (
+				<li class="redeemid-collection__item" data-redeemid-product={p.handle}>
+					{p.image && <img src={p.image.url} alt={p.image.altText ?? ""} loading="lazy" />}
+					<h3>{href(p.handle) ? <a href={href(p.handle)}>{p.title}</a> : p.title}</h3>
+					<p class="redeemid-collection__price">{p.availableForSale ? (p.price ? `From ${money(p.price)}` : "") : "Sold out"}</p>
+				</li>
+			))}
+		</ul>
+	</section>
+) : (
+	<slot />
+)}