@redeemid/emdash 0.0.8 → 0.0.10

package/src/preferences.ts

@@ -0,0 +1,298 @@
+/**
+ * Member preferences: customer metafields members may see or change, such as
+ * the topics they follow. Shopify defines each field (Settings → Custom data
+ * → Customers); `preferences` in the config picks which ones members get, and
+ * whether they may change them. Answers live on the Shopify customer, where
+ * Flow, segments and email can use them. The site keeps no copy.
+ *
+ * Reading and saving use the Admin API app (the staff tools' client ID), and
+ * always on the signed-in member's own customer. Preferences never open
+ * content: access still comes only from tags.
+ */
+
+import { admin, adminConfigured, AdminError } from "./admin-api.js";
+import type { PreferenceConfig, RedeemIDConfig } from "./config.js";
+import type { MemberRecord } from "./storage.js";
+
+/** Metafield types members can use, and the value each takes. */
+export const PREFERENCE_TYPES = [
+	"single_line_text_field",
+	"multi_line_text_field",
+	"list.single_line_text_field",
+	"boolean",
+	"number_integer",
+	"number_decimal",
+	"date",
+] as const;
+export type PreferenceType = (typeof PREFERENCE_TYPES)[number];
+export type PreferenceValue = string | string[] | boolean | number | null;
+
+export interface PreferenceField {
+	/** "namespace.key" */
+	key: string;
+	name: string;
+	description: string | null;
+	type: PreferenceType;
+	choices: string[] | null;
+	/** Length for text, value for numbers and dates. */
+	min: string | null;
+	max: string | null;
+	editable: boolean;
+	value: PreferenceValue;
+}
+
+export type Refusal = "unknown_field" | "read_only" | "invalid_type" | "invalid_choice" | "invalid_length" | "invalid_range";
+
+export class PreferenceError extends Error {
+	constructor(
+		message: string,
+		readonly fields: Record<string, Refusal> = {},
+	) {
+		super(message);
+	}
+}
+
+/** Saves allowed per member per minute. */
+export const SAVES_PER_MINUTE = 10;
+const DEFINITIONS_TTL_MS = 5 * 60 * 1000;
+/** RedeemID reads membership dates from this namespace, so members never get it. */
+const RESERVED_NAMESPACE = "membership";
+
+type Definition = Omit<PreferenceField, "editable" | "value">;
+let cache: { at: number; shop: string; defs: Definition[] } | null = null;
+
+export function resetPreferenceCache(): void {
+	cache = null;
+}
+
+/** Can preferences run at all? */
+export function preferencesConfigured(config: RedeemIDConfig | null): boolean {
+	return Boolean(config?.preferences?.length && adminConfigured());
+}
+
+function wanted(config: RedeemIDConfig): PreferenceConfig[] {
+	return (config.preferences ?? []).filter((p) => /^[\w-]+\.[\w-]+$/.test(p.key) && !p.key.startsWith(`${RESERVED_NAMESPACE}.`));
+}
+
+/** The customer metafield definitions Shopify has for the configured keys, cached for five minutes. */
+export async function definitions(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<Definition[]> {
+	const shop = config.shop ?? "";
+	if (cache && cache.shop === shop && Date.now() - cache.at < DEFINITIONS_TTL_MS) return cache.defs;
+	type Node = { namespace: string; key: string; name: string; description: string | null; type: { name: string }; validations: Array<{ name: string; value: string | null }> };
+	const data = await admin<{ metafieldDefinitions: { nodes: Node[] } }>(
+		config,
+		`query RedeemIDPreferenceDefinitions { metafieldDefinitions(ownerType: CUSTOMER, first: 250) { nodes { namespace key name description type { name } validations { name value } } } }`,
+		{},
+		fetcher,
+	);
+	const defs = data.metafieldDefinitions.nodes
+		.filter((n) => (PREFERENCE_TYPES as readonly string[]).includes(n.type.name))
+		.map((n) => {
+			const v = (name: string) => n.validations.find((x) => x.name === name)?.value ?? null;
+			let choices: string[] | null = null;
+			try {
+				const raw = v("choices");
+				const parsed = raw ? (JSON.parse(raw) as unknown) : null;
+				if (Array.isArray(parsed)) choices = parsed.map(String);
+			} catch {
+				choices = null;
+			}
+			return {
+				key: `${n.namespace}.${n.key}`,
+				name: n.name,
+				description: n.description || null,
+				type: n.type.name as PreferenceType,
+				choices,
+				// Length for text types, value for numbers and dates.
+				min: v("min") || null,
+				max: v("max") || null,
+			};
+		});
+	cache = { at: Date.now(), shop, defs };
+	return defs;
+}
+
+/** Turn a stored metafield value into what members see. */
+export function decode(type: PreferenceType, raw: string | null | undefined): PreferenceValue {
+	if (raw == null || raw === "") return type.startsWith("list.") ? [] : null;
+	switch (type) {
+		case "list.single_line_text_field":
+			try {
+				const v = JSON.parse(raw) as unknown;
+				return Array.isArray(v) ? v.map(String) : [];
+			} catch {
+				return [];
+			}
+		case "boolean":
+			return raw === "true";
+		case "number_integer":
+			return Number.parseInt(raw, 10);
+		default:
+			return raw;
+	}
+}
+
+const isEmpty = (v: unknown) => v === null || v === undefined || v === "" || (Array.isArray(v) && v.length === 0);
+
+/**
+ * Check one value against its definition. Returns the metafield value to
+ * save, null to clear the field, or a refusal.
+ */
+export function encode(def: Definition, input: unknown): { value: string | null } | { refused: Refusal } {
+	if (isEmpty(input)) return { value: null };
+	const len = (s: string) => {
+		if (def.min !== null && s.length < Number(def.min)) return false;
+		if (def.max !== null && s.length > Number(def.max)) return false;
+		return true;
+	};
+	const choice = (s: string) => !def.choices || def.choices.includes(s);
+	switch (def.type) {
+		case "single_line_text_field":
+		case "multi_line_text_field": {
+			if (typeof input !== "string") return { refused: "invalid_type" };
+			const s = def.type === "single_line_text_field" ? input.trim() : input;
+			if (def.type === "single_line_text_field" && /[\r\n]/.test(s)) return { refused: "invalid_type" };
+			if (!choice(s)) return { refused: "invalid_choice" };
+			if (!len(s)) return { refused: "invalid_length" };
+			return { value: s };
+		}
+		case "list.single_line_text_field": {
+			const list = typeof input === "string" ? [input] : input;
+			if (!Array.isArray(list) || list.some((x) => typeof x !== "string")) return { refused: "invalid_type" };
+			const items = [...new Set((list as string[]).map((x) => x.trim()).filter(Boolean))];
+			if (items.some((x) => /[\r\n]/.test(x))) return { refused: "invalid_type" };
+			if (!items.every(choice)) return { refused: "invalid_choice" };
+			if (!items.every(len)) return { refused: "invalid_length" };
+			return { value: items.length ? JSON.stringify(items) : null };
+		}
+		case "boolean": {
+			const b = input === true || input === "true" || input === "on" ? true : input === false || input === "false" ? false : null;
+			if (b === null) return { refused: "invalid_type" };
+			return { value: String(b) };
+		}
+		case "number_integer":
+		case "number_decimal": {
+			const s = typeof input === "number" ? String(input) : typeof input === "string" ? input.trim() : "";
+			const ok = def.type === "number_integer" ? /^-?\d+$/.test(s) : /^-?\d+(\.\d+)?$/.test(s);
+			if (!ok) return { refused: "invalid_type" };
+			const n = Number(s);
+			if ((def.min !== null && n < Number(def.min)) || (def.max !== null && n > Number(def.max))) return { refused: "invalid_range" };
+			return { value: s };
+		}
+		case "date": {
+			const s = typeof input === "string" ? input.trim() : "";
+			if (!/^\d{4}-\d{2}-\d{2}$/.test(s) || Number.isNaN(Date.parse(`${s}T00:00:00Z`))) return { refused: "invalid_type" };
+			if ((def.min !== null && s < def.min.slice(0, 10)) || (def.max !== null && s > def.max.slice(0, 10))) return { refused: "invalid_range" };
+			return { value: s };
+		}
+	}
+}
+
+/** The fields members can use, in config order, with their access. Without values. */
+export async function preferenceFields(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<Array<Omit<PreferenceField, "value">>> {
+	const defs = await definitions(config, fetcher);
+	return wanted(config).flatMap((p) => {
+		const def = defs.find((d) => d.key === p.key);
+		return def ? [{ ...def, editable: p.access !== "view" }] : [];
+	});
+}
+
+const gid = (id: string) => `gid://shopify/Customer/${id}`;
+
+/** The member's fields with their current values, read from Shopify. */
+export async function readPreferences(config: RedeemIDConfig, customerId: string, fetcher: typeof fetch = fetch): Promise<PreferenceField[]> {
+	const fields = await preferenceFields(config, fetcher);
+	if (fields.length === 0) return [];
+	type Node = { namespace: string; key: string; value: string };
+	const data = await admin<{ customer: { metafields: { nodes: Node[] } } | null }>(
+		config,
+		`query RedeemIDPreferences($id: ID!, $keys: [String!]) { customer(id: $id) { metafields(first: 100, keys: $keys) { nodes { namespace key value } } } }`,
+		{ id: gid(customerId), keys: fields.map((f) => f.key) },
+		fetcher,
+	);
+	if (!data.customer) throw new AdminError("Shopify has no such customer.");
+	const values = new Map(data.customer.metafields.nodes.map((n) => [`${n.namespace}.${n.key}`, n.value]));
+	return fields.map((f) => ({ ...f, value: decode(f.type, values.get(f.key)) }));
+}
+
+/** Room for one more save this minute? Records it when there is. */
+export function allowSave(member: Pick<MemberRecord, "prefSaves">, now = Date.now()): number[] | null {
+	const recent = (member.prefSaves ?? []).filter((t) => now - t < 60_000);
+	if (recent.length >= SAVES_PER_MINUTE) return null;
+	return [...recent, now];
+}
+
+/**
+ * Save some of the member's fields to their Shopify customer, then read them
+ * back. Every value is checked first; one refusal saves nothing. Keys left
+ * out are left alone; an empty value clears the field.
+ */
+export async function savePreferences(
+	config: RedeemIDConfig,
+	customerId: string,
+	values: Record<string, unknown>,
+	fetcher: typeof fetch = fetch,
+): Promise<{ fields: PreferenceField[]; changed: string[] }> {
+	const fields = await preferenceFields(config, fetcher);
+	const refused: Record<string, Refusal> = {};
+	const set: Array<{ namespace: string; key: string; type: string; value: string }> = [];
+	const clear: Array<{ namespace: string; key: string }> = [];
+	for (const [key, input] of Object.entries(values)) {
+		const f = fields.find((x) => x.key === key);
+		if (!f) {
+			refused[key] = "unknown_field";
+			continue;
+		}
+		if (!f.editable) {
+			refused[key] = "read_only";
+			continue;
+		}
+		const out = encode(f, input);
+		if ("refused" in out) {
+			refused[key] = out.refused;
+			continue;
+		}
+		const [namespace = "", k = ""] = key.split(".");
+		if (out.value === null) clear.push({ namespace, key: k });
+		else set.push({ namespace, key: k, type: f.type, value: out.value });
+	}
+	if (Object.keys(refused).length) throw new PreferenceError("Some answers weren't saved.", refused);
+
+	const ownerId = gid(customerId);
+	if (set.length) {
+		const data = await admin<{ metafieldsSet: { userErrors: Array<{ field?: string[] | null; message: string }> } }>(
+			config,
+			`mutation RedeemIDSavePreferences($metafields: [MetafieldsSetInput!]!) { metafieldsSet(metafields: $metafields) { userErrors { field message } } }`,
+			{ metafields: set.map((m) => ({ ownerId, ...m })) },
+			fetcher,
+		);
+		const err = data.metafieldsSet.userErrors[0];
+		if (err) throw new AdminError(err.message);
+	}
+	if (clear.length) {
+		const data = await admin<{ metafieldsDelete: { userErrors: Array<{ message: string }> } }>(
+			config,
+			`mutation RedeemIDClearPreferences($metafields: [MetafieldIdentifierInput!]!) { metafieldsDelete(metafields: $metafields) { userErrors { field message } } }`,
+			{ metafields: clear.map((m) => ({ ownerId, ...m })) },
+			fetcher,
+		);
+		const err = data.metafieldsDelete.userErrors[0];
+		if (err) throw new AdminError(err.message);
+	}
+	const changed = [...set, ...clear].map((m) => `${m.namespace}.${m.key}`);
+	return { fields: await readPreferences(config, customerId, fetcher), changed };
+}
+
+/** Read a posted form into values: `pref:<key>` fields, with `present:<key>` marking checkboxes and lists that may be empty. */
+export function formValues(form: FormData, fields: Array<Pick<PreferenceField, "key" | "type" | "editable">>): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const f of fields) {
+		if (!f.editable || !form.has(`present:${f.key}`)) continue;
+		const all = form.getAll(`pref:${f.key}`).map(String);
+		// A list without choices comes from a textarea: one answer per line.
+		if (f.type === "list.single_line_text_field") out[f.key] = all.flatMap((v) => v.split(/\r?\n/));
+		else if (f.type === "boolean") out[f.key] = all.includes("true");
+		else out[f.key] = all[0] ?? "";
+	}
+	return out;
+}

package/src/routes/callback.ts

@@ -16,6 +16,8 @@ import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
+import { emit, levelChange } from "../events.js";
+import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
@@ -86,7 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
 
 		const s = stores(emdash.db);
-		const member = (await s.members.get(who.customerId)) ?? emptyMember(who.customerId);
+		const found = await s.members.get(who.customerId);
+		const member = found ?? emptyMember(who.customerId);
 		const now = new Date().toISOString();
 		await s.members.put(
 			who.customerId,
@@ -106,6 +109,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			),
 		);
 
+		const levels = levelsFor(who.tags, config.levels);
+		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
+		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
+
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);

package/src/routes/preferences.ts

@@ -0,0 +1,82 @@
+/**
+ * /_emdash/api/auth/redeemid/preferences: the signed-in member's preferences.
+ *
+ * GET answers JSON: { fields } with values, for the member's own customer.
+ * POST takes JSON { values: { "namespace.key": value } } and answers JSON,
+ * or a form (from <Preferences>) and goes back to `return` with the notice
+ * preferences_saved, preferences_refused or preferences_unavailable.
+ * The customer always comes from the session, never from the request.
+ * Refused JSON saves answer 400 with { fields: { key: reason } }; more than
+ * 10 saves a minute answer 429.
+ */
+
+import type { APIRoute } from "astro";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig } from "../config.js";
+import { emit } from "../events.js";
+import { allowSave, formValues, PreferenceError, preferenceFields, preferencesConfigured, readPreferences, savePreferences } from "../preferences.js";
+import { memberForUser, stores } from "../storage.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+const json = (status: number, body: unknown) =>
+	new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json", "Cache-Control": "private, no-store" } });
+
+async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
+	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
+	const config = readConfig(emdash?.config);
+	if (!config || !preferencesConfigured(config) || !emdash?.db) return { error: "unavailable" as const };
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return { error: "sign_in" as const, config };
+	const s = stores(emdash.db);
+	const member = await memberForUser(s, user.id);
+	if (!member) return { error: "sign_in" as const, config };
+	if (member.status === "disabled") return { error: "disabled" as const, config };
+	return { config, s, member };
+}
+
+export const GET: APIRoute = async ({ locals, session }) => {
+	const c = await context(locals, session);
+	if ("error" in c) return json(c.error === "unavailable" ? 404 : 401, { error: c.error });
+	try {
+		return json(200, { fields: await readPreferences(c.config, c.member.customerId) });
+	} catch (e) {
+		console.error("[redeemid] preferences not read:", (e as Error).message);
+		return json(502, { error: "unavailable" });
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, session, redirect }) => {
+	const isJson = (request.headers.get("content-type") ?? "").includes("application/json");
+	const form = isJson ? null : await request.formData().catch(() => null);
+	const returnTo = safeReturn(String(form?.get("return") ?? "/"));
+	const c = await context(locals, session);
+	if ("error" in c) {
+		if (isJson) return json(c.error === "unavailable" ? 404 : 401, { error: c.error });
+		return c.error === "sign_in" ? redirect(signInUrl(returnTo)) : fail(redirect, returnTo, "preferences_unavailable");
+	}
+
+	const slots = allowSave(c.member);
+	if (!slots) return isJson ? json(429, { error: "too_many_saves" }) : fail(redirect, returnTo, "preferences_unavailable");
+
+	let values: Record<string, unknown>;
+	try {
+		if (isJson) {
+			const body = (await request.json()) as { values?: unknown };
+			values = body.values && typeof body.values === "object" && !Array.isArray(body.values) ? (body.values as Record<string, unknown>) : {};
+		} else {
+			values = formValues(form ?? new FormData(), await preferenceFields(c.config));
+		}
+		await c.s.members.put(c.member.customerId, { ...c.member, prefSaves: slots });
+		const { fields, changed } = await savePreferences(c.config, c.member.customerId, values);
+		// Field names only, never the answers.
+		if (changed.length) await emit(c.config, "preferences.saved", { customerId: c.member.customerId, fields: changed });
+		return isJson ? json(200, { fields }) : fail(redirect, returnTo, "preferences_saved");
+	} catch (e) {
+		if (e instanceof PreferenceError) return isJson ? json(400, { error: "refused", fields: e.fields }) : fail(redirect, returnTo, "preferences_refused");
+		console.error("[redeemid] preferences not saved:", (e as Error).message);
+		return isJson ? json(502, { error: "unavailable" }) : fail(redirect, returnTo, "preferences_unavailable");
+	}
+};

package/src/routes/webhook.ts

@@ -8,7 +8,8 @@
 
 import type { APIRoute } from "astro";
 
-import { env, ENV } from "../config.js";
+import { env, ENV, readConfig } from "../config.js";
+import { levelChange } from "../events.js";
 import { stores } from "../storage.js";
 import { apply, kindOf, verifyHmac } from "../webhooks.js";
 
@@ -17,7 +18,7 @@ export const prerender = false;
 const MAX_BYTES = 1024 * 1024;
 
 export const POST: APIRoute = async ({ request, locals }) => {
-	const emdash = (locals as { emdash?: { db?: unknown } }).emdash;
+	const emdash = (locals as { emdash?: { db?: unknown; config?: unknown } }).emdash;
 	const secret = env(ENV.webhookSecret);
 	if (!emdash?.db || !secret) return new Response("Not configured", { status: 503 });
 
@@ -48,7 +49,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 
 	try {
-		const outcome = await apply(s, topic, payload);
+		const config = readConfig(emdash.config);
+		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic));
 		return new Response(outcome, { status: 200 });
 	} catch (e) {
 		console.error("[redeemid] webhook failed:", topic, (e as Error).message);

package/src/staff.ts

@@ -0,0 +1,220 @@
+/**
+ * Staff tools in the admin (Block Kit): member detail with Resync and tag
+ * edits written to Shopify, a paced manual bulk resync, webhook
+ * registration and health, recent deliveries and the access test.
+ */
+
+import { adminConfigured, adminScopes, editTags, registerWebhooks, resync, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
+import { describe, levelsFor, membership, passes, requirement, termTree, type Terms } from "./access.js";
+import type { RedeemIDConfig } from "./config.js";
+import { levelChange } from "./events.js";
+import { featuresFor } from "./features.js";
+import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
+
+/** Members resynced per click; well inside Shopify's query cost limits. */
+export const BULK_BATCH = 50;
+
+type Blocks = { blocks: unknown[]; toast?: { message: string; type: "success" | "error" | "info" } };
+
+const date = (iso: string | null | undefined) => (iso ? iso.slice(0, 10) : "—");
+
+export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Blocks["toast"]): Blocks {
+	const levels = config.levels ?? [];
+	const { current, past } = membership(m, levels);
+	const features = featuresFor(m, config.features, levels);
+	const featureNames = (config.features ?? []).filter((f) => features.includes(f.slug)).map((f) => f.name);
+	const name = [m.firstName, m.lastName].filter(Boolean).join(" ") || m.email || `Customer ${m.customerId}`;
+	return {
+		toast,
+		blocks: [
+			{ type: "actions", elements: [{ type: "button", action_id: "members_back", label: "← All members", style: "secondary" }] },
+			{ type: "header", text: name },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Email", value: m.email ?? "—" },
+					{ label: "Shopify customer", value: m.customerId },
+					{ label: "Account", value: m.status === "enabled" ? "On" : "Turned off in Shopify" },
+					{ label: "Signed in here", value: m.userId ? `Yes, first on ${date(m.linkedAt)}` : "Not yet" },
+					{ label: "Levels", value: current.map((l) => `${l.name} (since ${date(l.since)})`).join(", ") || "—" },
+					{ label: "Levels before", value: past.map((l) => `${l.name} (${date(l.from)} to ${date(l.to)})`).join(", ") || "—" },
+					{ label: "Features", value: featureNames.join(", ") || "—" },
+					{ label: "Last synced", value: `${m.syncedAt} (${m.source || "unknown"})` },
+				],
+			},
+			{ type: "header", text: "Shopify tags" },
+			m.tags.length
+				? {
+						type: "table",
+						page_action_id: "member_tags",
+						columns: [
+							{ key: "tag", label: "Tag" },
+							{ key: "since", label: "Since" },
+							{ key: "remove", label: "", format: "element" },
+						],
+						rows: m.tags.map((t) => ({
+							tag: t,
+							since: date(m.tagsSince?.[t.toLowerCase()]),
+							remove: adminConfigured()
+								? {
+										type: "button",
+										action_id: "member_tag_remove",
+										label: "Remove in Shopify",
+										style: "danger",
+										value: { customerId: m.customerId, tag: t },
+										confirm: { title: "Remove this tag in Shopify?", text: `Removes "${t}" from the customer in Shopify. Access follows.`, confirm: "Remove", deny: "Cancel", style: "danger" },
+									}
+								: null,
+						})),
+					}
+				: { type: "context", text: "No tags." },
+			adminConfigured()
+				? {
+						type: "form",
+						block_id: `tags:${m.customerId}`,
+						fields: [{ type: "text_input", action_id: "tags", label: "Add tags in Shopify (comma separated)", placeholder: "gold-member" }],
+						submit: { label: "Add in Shopify", action_id: "member_tag_add" },
+					}
+				: { type: "context", text: "Set the Admin API app's client ID to edit tags and resync from here." },
+			adminConfigured()
+				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
+				: { type: "divider" },
+			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+		],
+	};
+}
+
+/** Resync the members synced longest ago, one batch per click. */
+export async function bulkResync(config: RedeemIDConfig, s: Stores): Promise<{ done: number; missing: number; changed: number }> {
+	const page = await s.members.query({ orderBy: { syncedAt: "asc" }, limit: BULK_BATCH });
+	const ids = page.items.map((r) => r.data.customerId);
+	const before = new Map(page.items.map((r) => [r.data.customerId, [...r.data.tags]]));
+	const { updated, missing } = await resync(config, s, ids, "bulk resync");
+	let changed = 0;
+	for (const m of updated) {
+		const was = before.get(m.customerId) ?? [];
+		if (was.join("\n") !== m.tags.join("\n")) changed++;
+		await levelChange(config, was, m, "bulk resync");
+	}
+	return { done: updated.length, missing: missing.length, changed };
+}
+
+export async function resyncOne(config: RedeemIDConfig, s: Stores, customerId: string, source: string): Promise<MemberRecord | null> {
+	const before = await s.members.get(customerId);
+	const { updated } = await resync(config, s, [customerId], source);
+	const m = updated[0] ?? null;
+	if (m) await levelChange(config, before?.tags ?? null, m, source);
+	return m;
+}
+
+export async function tagEdit(config: RedeemIDConfig, s: Stores, customerId: string, change: "add" | "remove", raw: unknown): Promise<MemberRecord | null> {
+	const id = numericId(customerId);
+	if (!id) return null;
+	await editTags(config, id, change, cleanTags(raw));
+	return resyncOne(config, s, id, change === "add" ? "staff added tags" : "staff removed tags");
+}
+
+/** Webhooks: what Shopify sends to this site, and what's missing. */
+export async function webhooksSection(config: RedeemIDConfig, uri: string): Promise<unknown[]> {
+	if (!adminConfigured()) {
+		return [{ type: "context", text: "Set the Admin API app's client ID to check and register webhooks from here. Until then, add them in the app's settings." }];
+	}
+	try {
+		const [subs, scope] = await Promise.all([webhookSubscriptions(config), adminScopes(config)]);
+		const rows = WEBHOOK_TOPICS.map((t) => {
+			const here = subs.find((s) => s.topic === t && s.uri === uri);
+			const elsewhere = subs.find((s) => s.topic === t && s.uri !== uri);
+			return { topic: t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags"), state: here ? "Registered" : elsewhere ? `Goes to ${elsewhere.uri}` : "Missing" };
+		});
+		const missing = rows.filter((r) => r.state !== "Registered").length;
+		return [
+			{ type: "fields", fields: [{ label: "Admin API", value: `Connected (${scope || "no scopes reported"})` }, { label: "Webhook address", value: uri }] },
+			{ type: "table", page_action_id: "webhooks", columns: [{ key: "topic", label: "Topic" }, { key: "state", label: "Sends here", format: "badge" }], rows },
+			missing
+				? { type: "actions", elements: [{ type: "button", action_id: "webhooks_register", label: `Register ${missing} missing`, style: "primary", value: uri }] }
+				: { type: "context", text: "Every topic RedeemID needs is sent here. customers/redact is set in the app's compliance settings." },
+		];
+	} catch (e) {
+		return [{ type: "banner", variant: "alert", title: "Couldn't read webhooks from Shopify", description: (e as Error).message }];
+	}
+}
+
+export async function deliveriesSection(s: Stores): Promise<unknown[]> {
+	const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 20 });
+	return items.length
+		? [
+				{
+					type: "table",
+					page_action_id: "deliveries",
+					columns: [
+						{ key: "topic", label: "Topic", format: "code" },
+						{ key: "at", label: "Received", format: "relative_time" },
+						{ key: "id", label: "Delivery" },
+					],
+					rows: items.map((r) => ({ topic: r.data.topic, at: r.data.receivedAt, id: r.id })),
+				},
+			]
+		: [{ type: "context", text: "No webhooks received yet." }];
+}
+
+export { registerWebhooks };
+
+/** "category:pro, tag:weekend" → { category: ["pro"], tag: ["weekend"] } */
+export function parseTerms(raw: string): Terms {
+	const terms: Record<string, string[]> = {};
+	for (const part of raw.split(",")) {
+		const [tax, term] = part.split(":").map((x) => x.trim());
+		if (tax && term) (terms[tax] ??= []).push(term);
+	}
+	return terms;
+}
+
+/** The access test: what an entry needs, and whether a reader with these tags passes. */
+export async function accessTest(config: RedeemIDConfig, values: Record<string, unknown> = {}): Promise<Blocks> {
+	const collection = String(values.collection ?? "").trim();
+	const termsRaw = String(values.terms ?? "").trim();
+	const tags = cleanTags(String(values.tags ?? ""));
+	const signedIn = values.signed_in !== false;
+	const levels = config.levels ?? [];
+	const form = {
+		type: "form",
+		block_id: "access_test",
+		fields: [
+			{ type: "text_input", action_id: "collection", label: "Collection", placeholder: "posts", initial_value: collection },
+			{ type: "text_input", action_id: "terms", label: "Terms (taxonomy:slug, comma separated)", placeholder: "category:investigations, tag:free-to-read", initial_value: termsRaw },
+			{ type: "text_input", action_id: "tags", label: "Reader's Shopify tags (comma separated)", placeholder: "gold-member", initial_value: tags.join(", ") },
+			{ type: "toggle", action_id: "signed_in", label: "Signed in", initial_value: signedIn },
+		],
+		submit: { label: "Test", action_id: "access_test" },
+	};
+	const out: unknown[] = [
+		{ type: "header", text: "Access test" },
+		{ type: "context", text: "Check what an entry needs under the rules, and whether a reader with some Shopify tags may read it. Nothing is saved." },
+		form,
+	];
+	if (collection) {
+		const terms = parseTerms(termsRaw);
+		const tree = await termTree(config.rules, collection, terms);
+		const required = requirement(config.rules, collection, terms, { combine: config.combine, tree });
+		const held = levelsFor(tags, levels);
+		const ok = required === null || (signedIn && passes(held, required));
+		out.push(
+			{ type: "divider" },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Needs", value: describe(required, levels) },
+					{ label: "Reader's levels", value: levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ") || "None" },
+					{ label: "Result", value: ok ? "Can read" : signedIn ? "Locked: asked to upgrade" : "Locked: asked to sign in" },
+				],
+			},
+			{
+				type: "banner",
+				variant: ok ? "default" : "alert",
+				title: ok ? "This reader can read it" : "This reader is kept out",
+				description: "A Paywall break with levels picked, a Members only part, drip and the meter can still change what a page shows.",
+			},
+		);
+	}
+	return { blocks: out };
+}