@redeemid/emdash 0.0.8 → 0.0.10

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.8, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
+**Status: 0.0.10, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -20,7 +20,12 @@ Shopify customer accounts, member levels and paywalls for [EmDash](https://githu
 - **The wall.** Readers kept out see why and what to do next: sign in, or join, with each level's own wall text. `<Notices>` shows the messages sign-in, Buy, Cart and Account send readers back with.
 - **Plan block.** Editors add a Shopify product to any page with the "Plan" block: title, price and a buy button.
 - **Shop.** `<Product>`, `<Collection>` and `<CartView>` (with the Product and Collection blocks) give the site product pages, collection grids and a cart page with quantities and discount codes. `<Contribution>` (and its block) takes pay-what-you-want amounts. Carts note the page each sale started on.
-- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels), a Status page (secrets, store discovery, the URLs to give Shopify, levels and rules) and a dashboard widget.
+- **Features.** Name perks members hold through levels or tags (ad-free, a supporter thank-you) and show them with `<Feature>` or `hasFeature()`.
+- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels; open a member to resync them or add and remove tags, which are written to Shopify), a bulk resync you start yourself, a Status page (secrets, store discovery, webhook subscriptions with a Register button, recent deliveries, levels and rules), an Access test and a dashboard widget.
+- **Member preferences.** Members see and change customer fields you define in Shopify, such as topics or a newsletter choice, with `<Preferences>` or its block. Answers are saved on the Shopify customer, ready for Flow, segments and email; the site keeps no copy.
+- **Protected files.** Put uploads in a media folder named in `files`, and every download checks the reader's levels, features or the entries that use the file. Copied links are no use to anyone else.
+- **Replacement text.** Put any string members and visitors see in your own words, one string at a time, with `text`.
+- **Outbound events.** Signed JSON POSTs to a URL of yours when a member signs in, their levels change, or they use the meter, for a CRM, an email tool or your own code.
 - **Keeps members out of EmDash's own APIs**, so the gate is the only way to read locked content.
 
 ## Install
@@ -76,6 +81,8 @@ Set these secrets in the environment (`.env` locally, `wrangler secret put` on W
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID` | Customer Account API | Client ID of the Headless storefront's Customer Account API client |
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET` | Customer Account API | Its client secret. Confidential clients only; leave unset for a public client. |
 | `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET` | Webhooks (Admin API app) | Client secret of the Shopify app that sends the webhooks. Shopify signs each webhook with it. |
+| `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` | Admin API (staff tools) | Client ID of that same app. Optional; with it, staff can resync members, edit tags in Shopify and register webhooks. |
+| `REDEEMID_EVENTS_SECRET` | None | Optional. Signs outbound events; set it with `events.url`. |
 | `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
 | `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
 
@@ -111,6 +118,124 @@ The meter lets a signed-in reader who can't read an entry open it anyway, `limit
 
 Drip holds a rule's entries back from members who pass it until they've held their level for `drip` days. A level starts when the customer first had its tag (for a `match: "all"` level, the last of its tags); with several levels the earliest counts, and with none known, the first sign-in. RedeemID notes when each tag first arrives from sign-in and webhooks, and forgets a tag when Shopify removes it. The wall shows the date the entry opens.
 
+### Features
+
+```ts
+features: [
+	{ slug: "ad-free", name: "Ad-free", levels: ["gold", "premium"] },
+	{ slug: "supporter", name: "Supporter", tags: ["supporter"] },
+],
+```
+
+A member holds a feature through any of its levels or tags; like levels, features come only from the mirrored tags. `<MemberCard>` lists them under the member's levels.
+
+```astro
+---
+import Feature from "@redeemid/emdash/components/Feature.astro";
+import { hasFeature } from "@redeemid/emdash/features";
+---
+<Feature slug="supporter"><p>Thanks for your support.</p><p slot="else">Become a supporter.</p></Feature>
+{!(await hasFeature(Astro, "ad-free")) && <aside class="ad">…</aside>}
+```
+
+### Preferences
+
+```ts
+preferences: [
+	{ key: "preferences.topics" },                  // members can change it
+	{ key: "preferences.level", access: "view" },   // members only see it
+],
+```
+
+Define each field in Shopify (**Settings → Custom data → Customers**). The definition sets its name, type and limits, such as allowed choices or a minimum and maximum. List the ones members get in `preferences`, in the order to show them. Reading and saving use the Admin API app (`REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID`, with `read_customers` and `write_customers`), always on the signed-in member's own customer. Fields in the `membership` namespace are never offered. Preferences never open content.
+
+`<Preferences>` (or the Preferences block) is a form with a control for each field. It works without JavaScript and comes back with the `preferences_saved`, `preferences_refused` or `preferences_unavailable` notice. Visitors see its `signed-out` slot.
+
+| Shopify type | Value |
+| --- | --- |
+| Single line text | A string; with choices, one of them |
+| Multi-line text | A string |
+| List of single line text | A list of strings; with choices, each one of them |
+| True or false | `true` or `false` |
+| Integer | A whole number |
+| Decimal | A number, as a string |
+| Date | `YYYY-MM-DD` |
+
+Every value is checked against the definition before it goes to Shopify; one refusal saves nothing, and an empty value clears the field. Scripts can use `/_emdash/api/auth/redeemid/preferences` too: `GET` returns `{ fields }` with values, `POST` with JSON `{ values: { "namespace.key": value } }` saves. A refused save answers `400` with `fields` mapping each key to `unknown_field`, `read_only`, `invalid_type`, `invalid_choice`, `invalid_length` or `invalid_range`. Saves are limited to 10 a minute per member (`429`). From your own code, `readPreferences()` and `savePreferences()` in `@redeemid/emdash/preferences` do the same.
+
+A save sends the `preferences.saved` event with the field names changed, never the answers.
+
+### Protected files
+
+```ts
+files: [
+	{ folder: "Gold downloads", levels: ["gold"] },
+	{ folder: "Member downloads", levels: [] },             // any signed-in member
+	{ folder: "Supporter extras", features: ["supporter"] },
+	{ folder: "Story files", entries: true },               // whoever can read an entry that uses it
+],
+```
+
+Upload files into a folder in the EmDash media library. Folder names match without regard to case. Every request for a file in a protected folder at `/_emdash/api/media/file/…` is checked before EmDash serves it:
+
+- **Allowed:** the file, sent with `Cache-Control: private, no-store`.
+- **Signed out:** a 401 page with a sign-in link that comes back to the file.
+- **Signed in without access:** a 403 page.
+
+A rule lets in members who hold any of its `levels` (an empty list means any signed-in member) or `features`. With `entries: true`, it also lets in whoever can read a published entry that uses the file: its rule, its drip, and the levels picked on its Paywall break or Members only parts. Staff can always download. Disabled members can't. If a file can't be checked, it isn't served.
+
+Limits:
+
+- Only EmDash's file route is checked. Don't give the storage bucket a public URL of its own.
+- Image services that fetch the file without the reader's cookies, such as a CDN image resizer, get refused, so keep protected images out of resized `<Image>` output.
+- Moving a file out of the folder makes it public again.
+
+### Replacement text
+
+```ts
+text: {
+	"Sign in": "Log in",
+	"This is for members. {signIn} to read on.": "Members only. {signIn} to keep reading.",
+	"This is for {level} members.": "{level} members only.",
+},
+```
+
+Each key is a string's original English; its value is the new text. Only the strings you name change. There is no find-and-replace across strings, so replacing "Sign in" leaves "Sign in to download this file." alone: to change a word everywhere, replace each string that uses it. `STRINGS` in `@redeemid/emdash/text` lists every string, grouped by where it shows (account, badge, cart, wall, meter, member card, notices, plan, preferences, product, files).
+
+Some strings have placeholders such as `{level}` or `{signIn}` (a link), filled in when the text shows. A replacement may use its original's placeholders, in any order or not at all, but no others. Text is plain: HTML in a replacement shows as typed. A replacement that uses another placeholder, or names a string RedeemID doesn't show, is ignored, so the original shows, and the Status page lists it with the reason.
+
+Props win over `text`: a `label` or `title` you pass, or Notices `messages`, is used as given. Staff screens in the admin aren't covered.
+
+### Events
+
+```ts
+events: { url: "https://hooks.example.com/redeemid", only: ["member.signed_in", "member.levels_changed"] },
+```
+
+With `REDEEMID_EVENTS_SECRET` set, RedeemID POSTs `{ id, event, at, data }` to the URL. Headers: `X-RedeemID-Event`, `X-RedeemID-Delivery` (the `id`) and `X-RedeemID-Signature: sha256=<hex HMAC-SHA256 of the raw body with the secret>`. Check the signature before you trust a body. Sending waits at most 3 seconds and never breaks the page; a failed send is logged and dropped, not retried.
+
+| Event | `data` |
+| --- | --- |
+| `member.signed_in` | `customerId`, `levels`, `first` (first sign-in), `refresh` |
+| `member.levels_changed` | `customerId`, `levels`, `added`, `removed`, `source` (`sign-in`, the webhook topic, or a staff resync or tag edit) |
+| `meter.used` | `userId` (EmDash), `entry` (`collection:id`), `used`, `limit`, `period` (`2026-11`, or `2026-W45` by week) |
+| `meter.exhausted` | the same, sent with the last free read |
+| `preferences.saved` | `customerId`, `fields` (the `namespace.key` names changed) |
+
+No event carries an email address or a name: match people by the Shopify `customerId`. `only` limits which events are sent; leave it out for all of them.
+
+### Staff tools
+
+With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set (it also runs member preferences), RedeemID gets an Admin API token for the webhook app with the client credentials grant (the app must belong to the same Shopify organization as the store, as Dev Dashboard apps do) and needs the `read_customers` and `write_customers` scopes. Then, in the admin:
+
+- **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
+- **Bulk resync.** Reads the 50 members synced longest ago from Shopify in one request. Run it again for the next 50. It never runs on its own.
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Recent deliveries.** The last webhooks the site took, with their topics and times.
+- **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
+
+Resync updates email, name and tags. Status stays with the enable and disable webhooks.
+
 ## Use it in templates
 
 EmDash has no content filter hook, so templates decide what to render. Render the entry body with `<Content>` instead of `<PortableText>`:

package/docs/shopify-setup.md

@@ -29,6 +29,8 @@ RedeemID keeps tags and status current from webhooks. Point these topics at `htt
 
 Subscribe them from a Shopify app on the store (for example a Dev Dashboard app). If the app already sends webhooks to another site, add this URL as extra subscriptions. `customers/merge` needs the `read_customer_merge` scope. Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
 
+For the staff tools (member resync, tag edits written to Shopify, the Register webhooks button) and member preferences, give the same app the `read_customers` and `write_customers` Admin API scopes and set its **client ID** as well. RedeemID uses the client credentials grant, which works when the app and the store are in the same Shopify organization.
+
 ## 3. The site
 
 Add the package and config as in the [README](../README.md#install), with `shop` set to the store's domain. A custom customer-account domain works as well as `*.myshopify.com`.
@@ -40,6 +42,8 @@ npx wrangler secret put REDEEMID_SHOPIFY_STORE_DOMAIN                   # e.g. m
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID     # Customer Account API client ID
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET # confidential clients only
 npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET        # the webhook app's client secret
+npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID            # optional; the webhook app's client ID, for the staff tools
+npx wrangler secret put REDEEMID_EVENTS_SECRET                          # optional; signs outbound events (events.url)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN       # Headless storefront's Storefront API private token (plans, checkout)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN        # optional; used only without the private token
 ```
@@ -53,4 +57,4 @@ The Workers free plan is enough: RedeemID is a native plugin and doesn't need sa
 3. Click **Sign in**, sign in with that customer's email, and you come back to the post, unlocked.
 4. Add or remove the tag in Shopify; the post opens or locks again once the webhook arrives.
 
-If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails. Cart changes return `cart_added`, `cart_updated`, `discount_applied` or `discount_not_applicable`. Refresh membership returns `refreshed` once it has read the member's tags again.
+If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails. Cart changes return `cart_added`, `cart_updated`, `discount_applied` or `discount_not_applicable`. Refresh membership returns `refreshed` once it has read the member's tags again. Preferences return `preferences_saved`, `preferences_refused` or `preferences_unavailable`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.8",
+	"version": "0.0.10",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -15,6 +15,10 @@
 		"./access": "./src/access.ts",
 		"./guard.ts": "./src/guard.ts",
 		"./storefront": "./src/storefront.ts",
+		"./features": "./src/features.ts",
+		"./events": "./src/events.ts",
+		"./preferences": "./src/preferences.ts",
+		"./text": "./src/text.ts",
 		"./plugin": "./src/plugin.ts",
 		"./blocks": "./src/blocks/index.ts",
 		"./components/*": "./src/components/*",

package/src/access.ts

@@ -277,11 +277,11 @@ export function passes(held: string[], required: string[][]): boolean {
  * The requirement in words, for badges and admin pages: "Gold + Silver",
  * "Silver or Gold", "Signed in". `null` gives `open`.
  */
-export function describe(required: Requirement, levels: LevelConfig[] = [], open = "Free"): string {
+export function describe(required: Requirement, levels: LevelConfig[] = [], open = "Free", signedIn = "Signed in"): string {
 	if (required === null) return open;
 	const name = (slug: string) => levels.find((l) => l.slug === slug)?.name ?? slug;
 	const parts = reduce(required).filter((c) => c.length > 0).map((c) => c.map(name).join(" or "));
-	return parts.length ? parts.join(" + ") : "Signed in";
+	return parts.length ? parts.join(" + ") : signedIn;
 }
 
 /**
@@ -469,7 +469,13 @@ export async function readEntry(
 		const used = consume(record.items, `${entry.collection}:${entry.id}`, meter.limit);
 		const info = { limit: meter.limit, period };
 		if (!used.allowed) return { ...verdict, meterLeft: 0, meter: info };
-		if (used.items !== record.items) await s.meter.put(key, { ...record, items: used.items });
+		if (used.items !== record.items) {
+			await s.meter.put(key, { ...record, items: used.items });
+			const { emit } = await import("./events.js");
+			const data = { userId: user.id, entry: `${entry.collection}:${entry.id}`, used: used.items.length, limit: meter.limit, period: record.period };
+			await emit(config, "meter.used", data);
+			if (used.left === 0) await emit(config, "meter.exhausted", data);
+		}
 		return { ...verdict, allowed: true, reason: "metered", meterLeft: used.left, meter: info };
 	} catch {
 		return verdict;

package/src/admin-api.ts

@@ -0,0 +1,191 @@
+/**
+ * Shopify Admin API, for staff tools only: resync a member, write tags to
+ * Shopify, register webhooks. The token comes from the client credentials
+ * grant of the Shopify app whose webhooks the site receives
+ * (REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID + _CLIENT_SECRET). Tokens last about
+ * a day; this keeps one per store in memory until shortly before expiry.
+ *
+ * Nothing here grants access: tag edits go to Shopify, and the mirror only
+ * changes from what Shopify answers.
+ */
+
+import { env, ENV, shopOrigin, type RedeemIDConfig } from "./config.js";
+import { USER_AGENT } from "./shopify.js";
+import { cleanTags, emptyMember, stampTags, type MemberRecord, type Stores } from "./storage.js";
+
+export const ADMIN_API_VERSION = "2026-10";
+
+/** Webhook topics RedeemID needs, as the Admin API names them. customers/redact is set in the app's config, not here. */
+export const WEBHOOK_TOPICS = [
+	"CUSTOMERS_CREATE",
+	"CUSTOMERS_UPDATE",
+	"CUSTOMERS_DELETE",
+	"CUSTOMERS_DISABLE",
+	"CUSTOMERS_ENABLE",
+	"CUSTOMERS_MERGE",
+	"CUSTOMER_TAGS_ADDED",
+	"CUSTOMER_TAGS_REMOVED",
+] as const;
+
+const MARGIN_MS = 5 * 60 * 1000;
+const tokens = new Map<string, { token: string; until: number; scope: string }>();
+
+export function adminConfigured(): boolean {
+	return Boolean(env(ENV.adminClientId) && env(ENV.webhookSecret));
+}
+
+export function resetAdminToken(): void {
+	tokens.clear();
+}
+
+export class AdminError extends Error {}
+
+async function token(config: RedeemIDConfig, fetcher: typeof fetch): Promise<{ token: string; scope: string }> {
+	const origin = shopOrigin(config);
+	const hit = tokens.get(origin);
+	if (hit && hit.until > Date.now()) return hit;
+	const clientId = env(ENV.adminClientId);
+	const secret = env(ENV.webhookSecret);
+	if (!clientId || !secret) throw new AdminError(`Set ${ENV.adminClientId} and ${ENV.webhookSecret} to use the staff tools.`);
+	const res = await fetcher(`${origin}/admin/oauth/access_token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": USER_AGENT },
+		body: new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: secret }).toString(),
+	});
+	const body = (await res.json().catch(() => ({}))) as { access_token?: string; expires_in?: number; scope?: string; error?: string };
+	if (!res.ok || !body.access_token) {
+		// shop_not_permitted: the app and the store are not in the same Shopify organization.
+		throw new AdminError(`Shopify refused the Admin API token (${body.error ?? res.status}).`);
+	}
+	const life = (body.expires_in && body.expires_in > 0 ? body.expires_in : 3600) * 1000;
+	const value = { token: body.access_token, until: Date.now() + Math.max(60_000, life - MARGIN_MS), scope: body.scope ?? "" };
+	tokens.set(origin, value);
+	return value;
+}
+
+/** The scopes the Admin API token carries, or an error message. */
+export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<string> {
+	return (await token(config, fetcher)).scope;
+}
+
+export async function admin<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown> = {}, fetcher: typeof fetch = fetch, retry = true): Promise<T> {
+	const t = await token(config, fetcher);
+	const res = await fetcher(`${shopOrigin(config)}/admin/api/${ADMIN_API_VERSION}/graphql.json`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": USER_AGENT, "X-Shopify-Access-Token": t.token },
+		body: JSON.stringify({ query, variables }),
+	});
+	if (res.status === 401 && retry) {
+		tokens.delete(shopOrigin(config));
+		return admin(config, query, variables, fetcher, false);
+	}
+	const body = (await res.json().catch(() => ({}))) as { data?: T; errors?: Array<{ message?: string }> };
+	if (!res.ok || !body.data) throw new AdminError(body.errors?.[0]?.message ?? `Admin API request failed (${res.status}).`);
+	return body.data;
+}
+
+const gid = (id: string) => `gid://shopify/Customer/${id}`;
+
+export interface AdminCustomer {
+	customerId: string;
+	email: string | null;
+	firstName: string | null;
+	lastName: string | null;
+	tags: string[];
+	updatedAt: number | null;
+}
+
+/** Up to 100 customers by numeric id. Customers Shopify no longer has are left out. */
+export async function customers(config: RedeemIDConfig, ids: string[], fetcher: typeof fetch = fetch): Promise<AdminCustomer[]> {
+	if (ids.length === 0) return [];
+	type Node = { id: string; firstName: string | null; lastName: string | null; tags: string[]; updatedAt: string; defaultEmailAddress: { emailAddress: string | null } | null } | null;
+	const data = await admin<{ nodes: Node[] }>(
+		config,
+		`query RedeemIDCustomers($ids: [ID!]!) { nodes(ids: $ids) { ... on Customer { id firstName lastName tags updatedAt defaultEmailAddress { emailAddress } } } }`,
+		{ ids: ids.slice(0, 100).map(gid) },
+		fetcher,
+	);
+	return data.nodes
+		.filter((n): n is NonNullable<Node> => Boolean(n?.id))
+		.map((n) => ({
+			customerId: n.id.replace(/^gid:\/\/shopify\/Customer\//, ""),
+			email: n.defaultEmailAddress?.emailAddress?.toLowerCase() ?? null,
+			firstName: n.firstName || null,
+			lastName: n.lastName || null,
+			tags: cleanTags(n.tags),
+			updatedAt: Number.isFinite(Date.parse(n.updatedAt)) ? Date.parse(n.updatedAt) : null,
+		}));
+}
+
+/**
+ * Read members from Shopify again and update the mirror: profile and tags.
+ * Status stays with the enable/disable webhooks. Members Shopify no longer
+ * has are reported in `missing` and left alone.
+ */
+export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], source = "resync", fetcher: typeof fetch = fetch): Promise<{ updated: MemberRecord[]; missing: string[] }> {
+	const found = await customers(config, ids, fetcher);
+	const updated: MemberRecord[] = [];
+	for (const c of found) {
+		const m = (await s.members.get(c.customerId)) ?? emptyMember(c.customerId);
+		m.email = c.email ?? m.email;
+		m.firstName = c.firstName ?? m.firstName;
+		m.lastName = c.lastName ?? m.lastName;
+		m.tags = c.tags;
+		m.profileUpdatedAt = c.updatedAt ?? m.profileUpdatedAt;
+		m.syncedAt = new Date().toISOString();
+		m.source = source;
+		await s.members.put(c.customerId, stampTags(m));
+		updated.push(m);
+	}
+	const seen = new Set(found.map((c) => c.customerId));
+	return { updated, missing: ids.filter((id) => !seen.has(id)) };
+}
+
+/** Add or remove tags on the Shopify customer. Shopify then sends the tag webhook; callers resync to show it now. */
+export async function editTags(config: RedeemIDConfig, customerId: string, change: "add" | "remove", tags: string[], fetcher: typeof fetch = fetch): Promise<void> {
+	const clean = cleanTags(tags);
+	if (clean.length === 0) return;
+	const m = change === "add" ? "tagsAdd" : "tagsRemove";
+	const data = await admin<Record<string, { userErrors: Array<{ message: string }> }>>(
+		config,
+		`mutation RedeemIDTags($id: ID!, $tags: [String!]!) { ${m}(id: $id, tags: $tags) { userErrors { field message } } }`,
+		{ id: gid(customerId), tags: clean },
+		fetcher,
+	);
+	const err = data[m]?.userErrors[0];
+	if (err) throw new AdminError(err.message);
+}
+
+export interface Subscription {
+	id: string;
+	topic: string;
+	uri: string;
+}
+
+export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<Subscription[]> {
+	type Node = { id: string; topic: string; uri?: string | null };
+	const data = await admin<{ webhookSubscriptions: { nodes: Node[] } }>(
+		config,
+		`query RedeemIDWebhooks { webhookSubscriptions(first: 100) { nodes { id topic uri } } }`,
+		{},
+		fetcher,
+	);
+	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
+}
+
+/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
+export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+	const have = await webhookSubscriptions(config, fetcher);
+	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	for (const topic of missing) {
+		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
+			config,
+			`mutation RedeemIDWebhook($topic: WebhookSubscriptionTopic!, $uri: String!) { webhookSubscriptionCreate(topic: $topic, webhookSubscription: { uri: $uri, format: JSON }) { userErrors { field message } } }`,
+			{ topic, uri },
+			fetcher,
+		);
+		const err = data.webhookSubscriptionCreate.userErrors[0];
+		if (err) throw new AdminError(`${topic}: ${err.message}`);
+	}
+	return [...missing];
+}

package/src/blocks/ContributionBlock.astro

@@ -18,7 +18,7 @@ const amounts = (node.amounts ?? "")
 	<Contribution
 		handle={handle}
 		title={node.title?.trim() || undefined}
-		label={node.label?.trim() || "Give"}
+		label={node.label?.trim() || undefined}
 		amounts={amounts.length ? amounts : undefined}
 	/>
 )}

package/src/blocks/PlanBlock.astro

@@ -10,4 +10,4 @@ const { node } = Astro.props;
 const handle = (node.handle ?? "").trim();
 ---
 
-{handle && <Plan handle={handle} title={node.title?.trim() || undefined} label={node.label?.trim() || "Join"} levels={Array.isArray(node.levels) ? node.levels : []} />}
+{handle && <Plan handle={handle} title={node.title?.trim() || undefined} label={node.label?.trim() || undefined} levels={Array.isArray(node.levels) ? node.levels : []} />}

package/src/blocks/PreferencesBlock.astro

@@ -0,0 +1,12 @@
+---
+/** The "Preferences" block: the signed-in member's preferences form. */
+import Preferences from "../components/Preferences.astro";
+
+interface Props {
+	node: { title?: string; label?: string };
+}
+
+const { node } = Astro.props;
+---
+
+<Preferences title={node.title?.trim() || undefined} label={node.label?.trim() || undefined} />

package/src/blocks/index.ts

@@ -6,6 +6,7 @@ import Marker from "./PaywallBreak.astro";
 import CollectionBlock from "./CollectionBlock.astro";
 import ContributionBlock from "./ContributionBlock.astro";
 import PlanBlock from "./PlanBlock.astro";
+import PreferencesBlock from "./PreferencesBlock.astro";
 import ProductBlock from "./ProductBlock.astro";
 
 export const blockComponents = {
@@ -16,4 +17,5 @@ export const blockComponents = {
 	"redeemid-product": ProductBlock,
 	"redeemid-collection": CollectionBlock,
 	"redeemid-contribution": ContributionBlock,
+	"redeemid-preferences": PreferencesBlock,
 };

package/src/blocks-names.ts

@@ -4,6 +4,7 @@ export const PLAN_BLOCK = "redeemid-plan";
 export const PRODUCT_BLOCK = "redeemid-product";
 export const COLLECTION_BLOCK = "redeemid-collection";
 export const CONTRIBUTION_BLOCK = "redeemid-contribution";
+export const PREFERENCES_BLOCK = "redeemid-preferences";
 /** Starts a members-only part of the body; it runs to the next end block. */
 export const MEMBERS_BLOCK = "redeemid-members";
 export const MEMBERS_END_BLOCK = "redeemid-members-end";

package/src/components/AccessBadge.astro

@@ -12,6 +12,7 @@
 import { canRead, describe, entryRequirement, type Terms } from "../access.js";
 import { splitAtPaywall } from "../blocks-names.js";
 import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
 
 interface Props {
 	collection: string;
@@ -22,13 +23,13 @@ interface Props {
 	class?: string;
 }
 
-const { collection, terms, content, free = "Free", class: className } = Astro.props;
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { collection, terms, content, free = text(config, "Free"), class: className } = Astro.props;
 const split = splitAtPaywall(content);
 const required = split.paywall && split.levels.length
 	? [split.levels]
 	: await entryRequirement(config, collection, terms);
-const label = describe(required, config?.levels, free);
+const label = describe(required, config?.levels, free, text(config, "Signed in"));
 const locked = required !== null && !(await canRead(Astro, { collection, terms }, { required })).allowed;
 const slugs = required?.flat().join(" ") || (required ? "signed-in" : "free");
 ---
@@ -40,6 +41,6 @@ const slugs = required?.flat().join(" ") || (required ? "signed-in" : "free");
 	>
 		{locked && <span class="redeemid-badge__lock" aria-hidden="true">🔒&#xFE0E; </span>}
 		{label}
-		{locked && <span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap"> (locked)</span>}
+		{locked && <span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap">{text(config, " (locked)")}</span>}
 	</span>
 )}

package/src/components/Account.astro

@@ -4,6 +4,7 @@
  */
 import { siteConfig } from "../site-config.js";
 import { accountUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { text } from "../text.js";
 
 const v = await viewer(Astro);
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
@@ -14,14 +15,14 @@ const names = (config?.levels ?? []).filter((l) => v.levels.includes(l.slug)).ma
 <div class="redeemid-account" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
 	{v.signedIn ? (
 		<>
-			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? "Signed in"}</span>
+			<span class="redeemid-account__who">{v.member?.firstName ?? v.member?.email ?? text(config, "Signed in")}</span>
 			{names.length > 0 && <span class="redeemid-account__levels">{names.join(", ")}</span>}
-			<a class="redeemid-account__link" href={accountUrl(here)}>Account</a>
+			<a class="redeemid-account__link" href={accountUrl(here)}>{text(config, "Account")}</a>
 			<form method="post" action={signOutUrl(here)}>
-				<button type="submit">Sign out</button>
+				<button type="submit">{text(config, "Sign out")}</button>
 			</form>
 		</>
 	) : (
-		<a href={signInUrl(here)}>{config?.label ?? "Sign in"}</a>
+		<a href={signInUrl(here)}>{config?.label ?? text(config, "Sign in")}</a>
 	)}
 </div>

package/src/components/Cart.astro

@@ -5,12 +5,15 @@
  */
 import { cartUrl } from "../access.js";
 import { readCart } from "../cart.js";
+import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
 
 interface Props {
 	label?: string;
 }
 
-const { label = "Cart" } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { label = text(config, "Cart") } = Astro.props;
 const ref = await readCart(Astro.session);
 const count = ref?.count ?? 0;
 const here = Astro.url.pathname + Astro.url.search;

package/src/components/CartView.astro

@@ -11,6 +11,7 @@ import { cartUrl } from "../access.js";
 import { readCart, saveCart } from "../cart.js";
 import { siteConfig } from "../site-config.js";
 import { cartDetails, money, type CartDetails } from "../storefront.js";
+import { text } from "../text.js";
 
 interface Props {
 	/** Link for each line's product; `{handle}` is replaced. */
@@ -19,8 +20,8 @@ interface Props {
 	empty?: string;
 }
 
-const { productHref, empty = "Your cart is empty." } = Astro.props;
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { productHref, empty = text(config, "Your cart is empty.") } = Astro.props;
 const ref = await readCart(Astro.session);
 let cart: CartDetails | null = null;
 let failed = false;
@@ -43,7 +44,7 @@ const code = cart?.discountCodes[0];
 
 <section class="redeemid-cartview" data-redeemid-cart-count={cart?.totalQuantity ?? 0}>
 	{failed ? (
-		<p>Your cart isn't available right now. Try again in a few minutes.</p>
+		<p>{text(config, "Your cart isn't available right now. Try again in a few minutes.")}</p>
 	) : !cart || cart.lines.length === 0 ? (
 		<p class="redeemid-cartview__empty">{empty}</p>
 	) : (
@@ -57,20 +58,20 @@ const code = cart?.discountCodes[0];
 								{href(l.productHandle) ? <a href={href(l.productHandle)}>{l.productTitle}</a> : l.productTitle}
 								{l.variantTitle && l.variantTitle !== "Default Title" && <span> · {l.variantTitle}</span>}
 							</p>
-							<p class="redeemid-cartview__price">{money(l.price)} each · {money(l.total)}</p>
+							<p class="redeemid-cartview__price">{text(config, "{price} each · {total}", { price: money(l.price), total: money(l.total) })}</p>
 							<form method="post" action={action} class="redeemid-cartview__quantity">
 								<input type="hidden" name="action" value="update" />
 								<input type="hidden" name="line" value={l.id} />
 								<input type="hidden" name="return" value={here} />
-								<label for={`q-${l.id}`}>Quantity</label>
+								<label for={`q-${l.id}`}>{text(config, "Quantity")}</label>
 								<input id={`q-${l.id}`} name="quantity" type="number" min="0" max="1000" value={l.quantity} inputmode="numeric" />
-								<button type="submit">Update</button>
+								<button type="submit">{text(config, "Update")}</button>
 							</form>
 							<form method="post" action={action}>
 								<input type="hidden" name="action" value="remove" />
 								<input type="hidden" name="line" value={l.id} />
 								<input type="hidden" name="return" value={here} />
-								<button type="submit" class="redeemid-cartview__remove">Remove<span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap"> {l.productTitle}</span></button>
+								<button type="submit" class="redeemid-cartview__remove">{text(config, "Remove")}<span style="position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap"> {l.productTitle}</span></button>
 							</form>
 						</div>
 					</li>
@@ -79,19 +80,19 @@ const code = cart?.discountCodes[0];
 			<form method="post" action={action} class="redeemid-cartview__discount">
 				<input type="hidden" name="action" value="discount" />
 				<input type="hidden" name="return" value={here} />
-				<label for="redeemid-discount">Discount code</label>
+				<label for="redeemid-discount">{text(config, "Discount code")}</label>
 				<input id="redeemid-discount" name="code" type="text" value={code?.code ?? ""} autocomplete="off" />
-				<button type="submit">Apply</button>
-				{code && !code.applicable && <p class="redeemid-cartview__code-note">{code.code} doesn't apply to this cart.</p>}
+				<button type="submit">{text(config, "Apply")}</button>
+				{code && !code.applicable && <p class="redeemid-cartview__code-note">{text(config, "{code} doesn't apply to this cart.", { code: code.code })}</p>}
 			</form>
 			<dl class="redeemid-cartview__totals">
-				<dt>Subtotal</dt>
+				<dt>{text(config, "Subtotal")}</dt>
 				<dd>{money(cart.subtotal)}</dd>
-				<dt>Total</dt>
+				<dt>{text(config, "Total")}</dt>
 				<dd>{money(cart.total)}</dd>
 			</dl>
-			<p class="redeemid-cartview__note">Taxes and shipping are worked out at checkout.</p>
-			<a class="redeemid-cartview__checkout" href={cartUrl(here)}>Checkout</a>
+			<p class="redeemid-cartview__note">{text(config, "Taxes and shipping are worked out at checkout.")}</p>
+			<a class="redeemid-cartview__checkout" href={cartUrl(here)}>{text(config, "Checkout")}</a>
 		</>
 	)}
 </section>