@redeemid/emdash 0.0.8 → 0.0.9

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.8, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
+**Status: 0.0.9, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout, the staff tools and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -20,7 +20,9 @@ Shopify customer accounts, member levels and paywalls for [EmDash](https://githu
 - **The wall.** Readers kept out see why and what to do next: sign in, or join, with each level's own wall text. `<Notices>` shows the messages sign-in, Buy, Cart and Account send readers back with.
 - **Plan block.** Editors add a Shopify product to any page with the "Plan" block: title, price and a buy button.
 - **Shop.** `<Product>`, `<Collection>` and `<CartView>` (with the Product and Collection blocks) give the site product pages, collection grids and a cart page with quantities and discount codes. `<Contribution>` (and its block) takes pay-what-you-want amounts. Carts note the page each sale started on.
-- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels), a Status page (secrets, store discovery, the URLs to give Shopify, levels and rules) and a dashboard widget.
+- **Features.** Name perks members hold through levels or tags (ad-free, a supporter thank-you) and show them with `<Feature>` or `hasFeature()`.
+- **In the admin.** RedeemID shows under Plugins with a Members page (Shopify customers, tags, levels; open a member to resync them or add and remove tags, which are written to Shopify), a bulk resync you start yourself, a Status page (secrets, store discovery, webhook subscriptions with a Register button, recent deliveries, levels and rules), an Access test and a dashboard widget.
+- **Outbound events.** Signed JSON POSTs to a URL of yours when a member signs in, their levels change, or they use the meter, for a CRM, an email tool or your own code.
 - **Keeps members out of EmDash's own APIs**, so the gate is the only way to read locked content.
 
 ## Install
@@ -76,6 +78,8 @@ Set these secrets in the environment (`.env` locally, `wrangler secret put` on W
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID` | Customer Account API | Client ID of the Headless storefront's Customer Account API client |
 | `REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET` | Customer Account API | Its client secret. Confidential clients only; leave unset for a public client. |
 | `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET` | Webhooks (Admin API app) | Client secret of the Shopify app that sends the webhooks. Shopify signs each webhook with it. |
+| `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` | Admin API (staff tools) | Client ID of that same app. Optional; with it, staff can resync members, edit tags in Shopify and register webhooks. |
+| `REDEEMID_EVENTS_SECRET` | None | Optional. Signs outbound events; set it with `events.url`. |
 | `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
 | `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
 
@@ -111,6 +115,55 @@ The meter lets a signed-in reader who can't read an entry open it anyway, `limit
 
 Drip holds a rule's entries back from members who pass it until they've held their level for `drip` days. A level starts when the customer first had its tag (for a `match: "all"` level, the last of its tags); with several levels the earliest counts, and with none known, the first sign-in. RedeemID notes when each tag first arrives from sign-in and webhooks, and forgets a tag when Shopify removes it. The wall shows the date the entry opens.
 
+### Features
+
+```ts
+features: [
+	{ slug: "ad-free", name: "Ad-free", levels: ["gold", "premium"] },
+	{ slug: "supporter", name: "Supporter", tags: ["supporter"] },
+],
+```
+
+A member holds a feature through any of its levels or tags; like levels, features come only from the mirrored tags. `<MemberCard>` lists them under the member's levels.
+
+```astro
+---
+import Feature from "@redeemid/emdash/components/Feature.astro";
+import { hasFeature } from "@redeemid/emdash/features";
+---
+<Feature slug="supporter"><p>Thanks for your support.</p><p slot="else">Become a supporter.</p></Feature>
+{!(await hasFeature(Astro, "ad-free")) && <aside class="ad">…</aside>}
+```
+
+### Events
+
+```ts
+events: { url: "https://hooks.example.com/redeemid", only: ["member.signed_in", "member.levels_changed"] },
+```
+
+With `REDEEMID_EVENTS_SECRET` set, RedeemID POSTs `{ id, event, at, data }` to the URL. Headers: `X-RedeemID-Event`, `X-RedeemID-Delivery` (the `id`) and `X-RedeemID-Signature: sha256=<hex HMAC-SHA256 of the raw body with the secret>`. Check the signature before you trust a body. Sending waits at most 3 seconds and never breaks the page; a failed send is logged and dropped, not retried.
+
+| Event | `data` |
+| --- | --- |
+| `member.signed_in` | `customerId`, `levels`, `first` (first sign-in), `refresh` |
+| `member.levels_changed` | `customerId`, `levels`, `added`, `removed`, `source` (`sign-in`, the webhook topic, or a staff resync or tag edit) |
+| `meter.used` | `userId` (EmDash), `entry` (`collection:id`), `used`, `limit`, `period` (`2026-11`, or `2026-W45` by week) |
+| `meter.exhausted` | the same, sent with the last free read |
+
+No event carries an email address or a name: match people by the Shopify `customerId`. `only` limits which events are sent; leave it out for all of them.
+
+### Staff tools
+
+With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set, RedeemID gets an Admin API token for the webhook app with the client credentials grant (the app must belong to the same Shopify organization as the store, as Dev Dashboard apps do) and needs the `read_customers` and `write_customers` scopes. Then, in the admin:
+
+- **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
+- **Bulk resync.** Reads the 50 members synced longest ago from Shopify in one request. Run it again for the next 50. It never runs on its own.
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Recent deliveries.** The last webhooks the site took, with their topics and times.
+- **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
+
+Resync updates email, name and tags. Status stays with the enable and disable webhooks.
+
 ## Use it in templates
 
 EmDash has no content filter hook, so templates decide what to render. Render the entry body with `<Content>` instead of `<PortableText>`:

package/docs/shopify-setup.md

@@ -29,6 +29,8 @@ RedeemID keeps tags and status current from webhooks. Point these topics at `htt
 
 Subscribe them from a Shopify app on the store (for example a Dev Dashboard app). If the app already sends webhooks to another site, add this URL as extra subscriptions. `customers/merge` needs the `read_customer_merge` scope. Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
 
+For the staff tools (member resync, tag edits written to Shopify, the Register webhooks button), give the same app the `read_customers` and `write_customers` Admin API scopes and set its **client ID** as well. RedeemID uses the client credentials grant, which works when the app and the store are in the same Shopify organization.
+
 ## 3. The site
 
 Add the package and config as in the [README](../README.md#install), with `shop` set to the store's domain. A custom customer-account domain works as well as `*.myshopify.com`.
@@ -40,6 +42,8 @@ npx wrangler secret put REDEEMID_SHOPIFY_STORE_DOMAIN                   # e.g. m
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID     # Customer Account API client ID
 npx wrangler secret put REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET # confidential clients only
 npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET        # the webhook app's client secret
+npx wrangler secret put REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID            # optional; the webhook app's client ID, for the staff tools
+npx wrangler secret put REDEEMID_EVENTS_SECRET                          # optional; signs outbound events (events.url)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN       # Headless storefront's Storefront API private token (plans, checkout)
 npx wrangler secret put REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN        # optional; used only without the private token
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.8",
+	"version": "0.0.9",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -15,6 +15,8 @@
 		"./access": "./src/access.ts",
 		"./guard.ts": "./src/guard.ts",
 		"./storefront": "./src/storefront.ts",
+		"./features": "./src/features.ts",
+		"./events": "./src/events.ts",
 		"./plugin": "./src/plugin.ts",
 		"./blocks": "./src/blocks/index.ts",
 		"./components/*": "./src/components/*",

package/src/access.ts

@@ -469,7 +469,13 @@ export async function readEntry(
 		const used = consume(record.items, `${entry.collection}:${entry.id}`, meter.limit);
 		const info = { limit: meter.limit, period };
 		if (!used.allowed) return { ...verdict, meterLeft: 0, meter: info };
-		if (used.items !== record.items) await s.meter.put(key, { ...record, items: used.items });
+		if (used.items !== record.items) {
+			await s.meter.put(key, { ...record, items: used.items });
+			const { emit } = await import("./events.js");
+			const data = { userId: user.id, entry: `${entry.collection}:${entry.id}`, used: used.items.length, limit: meter.limit, period: record.period };
+			await emit(config, "meter.used", data);
+			if (used.left === 0) await emit(config, "meter.exhausted", data);
+		}
 		return { ...verdict, allowed: true, reason: "metered", meterLeft: used.left, meter: info };
 	} catch {
 		return verdict;

package/src/admin-api.ts

@@ -0,0 +1,191 @@
+/**
+ * Shopify Admin API, for staff tools only: resync a member, write tags to
+ * Shopify, register webhooks. The token comes from the client credentials
+ * grant of the Shopify app whose webhooks the site receives
+ * (REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID + _CLIENT_SECRET). Tokens last about
+ * a day; this keeps one per store in memory until shortly before expiry.
+ *
+ * Nothing here grants access: tag edits go to Shopify, and the mirror only
+ * changes from what Shopify answers.
+ */
+
+import { env, ENV, shopOrigin, type RedeemIDConfig } from "./config.js";
+import { USER_AGENT } from "./shopify.js";
+import { cleanTags, emptyMember, stampTags, type MemberRecord, type Stores } from "./storage.js";
+
+export const ADMIN_API_VERSION = "2026-10";
+
+/** Webhook topics RedeemID needs, as the Admin API names them. customers/redact is set in the app's config, not here. */
+export const WEBHOOK_TOPICS = [
+	"CUSTOMERS_CREATE",
+	"CUSTOMERS_UPDATE",
+	"CUSTOMERS_DELETE",
+	"CUSTOMERS_DISABLE",
+	"CUSTOMERS_ENABLE",
+	"CUSTOMERS_MERGE",
+	"CUSTOMER_TAGS_ADDED",
+	"CUSTOMER_TAGS_REMOVED",
+] as const;
+
+const MARGIN_MS = 5 * 60 * 1000;
+const tokens = new Map<string, { token: string; until: number; scope: string }>();
+
+export function adminConfigured(): boolean {
+	return Boolean(env(ENV.adminClientId) && env(ENV.webhookSecret));
+}
+
+export function resetAdminToken(): void {
+	tokens.clear();
+}
+
+export class AdminError extends Error {}
+
+async function token(config: RedeemIDConfig, fetcher: typeof fetch): Promise<{ token: string; scope: string }> {
+	const origin = shopOrigin(config);
+	const hit = tokens.get(origin);
+	if (hit && hit.until > Date.now()) return hit;
+	const clientId = env(ENV.adminClientId);
+	const secret = env(ENV.webhookSecret);
+	if (!clientId || !secret) throw new AdminError(`Set ${ENV.adminClientId} and ${ENV.webhookSecret} to use the staff tools.`);
+	const res = await fetcher(`${origin}/admin/oauth/access_token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": USER_AGENT },
+		body: new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: secret }).toString(),
+	});
+	const body = (await res.json().catch(() => ({}))) as { access_token?: string; expires_in?: number; scope?: string; error?: string };
+	if (!res.ok || !body.access_token) {
+		// shop_not_permitted: the app and the store are not in the same Shopify organization.
+		throw new AdminError(`Shopify refused the Admin API token (${body.error ?? res.status}).`);
+	}
+	const life = (body.expires_in && body.expires_in > 0 ? body.expires_in : 3600) * 1000;
+	const value = { token: body.access_token, until: Date.now() + Math.max(60_000, life - MARGIN_MS), scope: body.scope ?? "" };
+	tokens.set(origin, value);
+	return value;
+}
+
+/** The scopes the Admin API token carries, or an error message. */
+export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<string> {
+	return (await token(config, fetcher)).scope;
+}
+
+export async function admin<T>(config: RedeemIDConfig, query: string, variables: Record<string, unknown> = {}, fetcher: typeof fetch = fetch, retry = true): Promise<T> {
+	const t = await token(config, fetcher);
+	const res = await fetcher(`${shopOrigin(config)}/admin/api/${ADMIN_API_VERSION}/graphql.json`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": USER_AGENT, "X-Shopify-Access-Token": t.token },
+		body: JSON.stringify({ query, variables }),
+	});
+	if (res.status === 401 && retry) {
+		tokens.delete(shopOrigin(config));
+		return admin(config, query, variables, fetcher, false);
+	}
+	const body = (await res.json().catch(() => ({}))) as { data?: T; errors?: Array<{ message?: string }> };
+	if (!res.ok || !body.data) throw new AdminError(body.errors?.[0]?.message ?? `Admin API request failed (${res.status}).`);
+	return body.data;
+}
+
+const gid = (id: string) => `gid://shopify/Customer/${id}`;
+
+export interface AdminCustomer {
+	customerId: string;
+	email: string | null;
+	firstName: string | null;
+	lastName: string | null;
+	tags: string[];
+	updatedAt: number | null;
+}
+
+/** Up to 100 customers by numeric id. Customers Shopify no longer has are left out. */
+export async function customers(config: RedeemIDConfig, ids: string[], fetcher: typeof fetch = fetch): Promise<AdminCustomer[]> {
+	if (ids.length === 0) return [];
+	type Node = { id: string; firstName: string | null; lastName: string | null; tags: string[]; updatedAt: string; defaultEmailAddress: { emailAddress: string | null } | null } | null;
+	const data = await admin<{ nodes: Node[] }>(
+		config,
+		`query RedeemIDCustomers($ids: [ID!]!) { nodes(ids: $ids) { ... on Customer { id firstName lastName tags updatedAt defaultEmailAddress { emailAddress } } } }`,
+		{ ids: ids.slice(0, 100).map(gid) },
+		fetcher,
+	);
+	return data.nodes
+		.filter((n): n is NonNullable<Node> => Boolean(n?.id))
+		.map((n) => ({
+			customerId: n.id.replace(/^gid:\/\/shopify\/Customer\//, ""),
+			email: n.defaultEmailAddress?.emailAddress?.toLowerCase() ?? null,
+			firstName: n.firstName || null,
+			lastName: n.lastName || null,
+			tags: cleanTags(n.tags),
+			updatedAt: Number.isFinite(Date.parse(n.updatedAt)) ? Date.parse(n.updatedAt) : null,
+		}));
+}
+
+/**
+ * Read members from Shopify again and update the mirror: profile and tags.
+ * Status stays with the enable/disable webhooks. Members Shopify no longer
+ * has are reported in `missing` and left alone.
+ */
+export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], source = "resync", fetcher: typeof fetch = fetch): Promise<{ updated: MemberRecord[]; missing: string[] }> {
+	const found = await customers(config, ids, fetcher);
+	const updated: MemberRecord[] = [];
+	for (const c of found) {
+		const m = (await s.members.get(c.customerId)) ?? emptyMember(c.customerId);
+		m.email = c.email ?? m.email;
+		m.firstName = c.firstName ?? m.firstName;
+		m.lastName = c.lastName ?? m.lastName;
+		m.tags = c.tags;
+		m.profileUpdatedAt = c.updatedAt ?? m.profileUpdatedAt;
+		m.syncedAt = new Date().toISOString();
+		m.source = source;
+		await s.members.put(c.customerId, stampTags(m));
+		updated.push(m);
+	}
+	const seen = new Set(found.map((c) => c.customerId));
+	return { updated, missing: ids.filter((id) => !seen.has(id)) };
+}
+
+/** Add or remove tags on the Shopify customer. Shopify then sends the tag webhook; callers resync to show it now. */
+export async function editTags(config: RedeemIDConfig, customerId: string, change: "add" | "remove", tags: string[], fetcher: typeof fetch = fetch): Promise<void> {
+	const clean = cleanTags(tags);
+	if (clean.length === 0) return;
+	const m = change === "add" ? "tagsAdd" : "tagsRemove";
+	const data = await admin<Record<string, { userErrors: Array<{ message: string }> }>>(
+		config,
+		`mutation RedeemIDTags($id: ID!, $tags: [String!]!) { ${m}(id: $id, tags: $tags) { userErrors { field message } } }`,
+		{ id: gid(customerId), tags: clean },
+		fetcher,
+	);
+	const err = data[m]?.userErrors[0];
+	if (err) throw new AdminError(err.message);
+}
+
+export interface Subscription {
+	id: string;
+	topic: string;
+	uri: string;
+}
+
+export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<Subscription[]> {
+	type Node = { id: string; topic: string; uri?: string | null };
+	const data = await admin<{ webhookSubscriptions: { nodes: Node[] } }>(
+		config,
+		`query RedeemIDWebhooks { webhookSubscriptions(first: 100) { nodes { id topic uri } } }`,
+		{},
+		fetcher,
+	);
+	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
+}
+
+/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
+export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+	const have = await webhookSubscriptions(config, fetcher);
+	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	for (const topic of missing) {
+		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
+			config,
+			`mutation RedeemIDWebhook($topic: WebhookSubscriptionTopic!, $uri: String!) { webhookSubscriptionCreate(topic: $topic, webhookSubscription: { uri: $uri, format: JSON }) { userErrors { field message } } }`,
+			{ topic, uri },
+			fetcher,
+		);
+		const err = data.webhookSubscriptionCreate.userErrors[0];
+		if (err) throw new AdminError(`${topic}: ${err.message}`);
+	}
+	return [...missing];
+}

package/src/components/Feature.astro

@@ -0,0 +1,20 @@
+---
+/**
+ * Shows its default slot only to members who hold the feature (see config
+ * `features`), and the "else" slot to everyone else.
+ *
+ *   <Feature slug="supporter">
+ *     <p>Thanks for supporting us.</p>
+ *     <a slot="else" href="/support/">Support us</a>
+ *   </Feature>
+ */
+import { hasFeature } from "../features.js";
+
+interface Props {
+	slug: string;
+}
+
+const held = await hasFeature(Astro, Astro.props.slug);
+---
+
+{held ? <slot /> : <slot name="else" />}

package/src/components/MemberCard.astro

@@ -10,6 +10,7 @@
  * membership reads it from the store again.
  */
 import { accountUrl, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { featuresFor } from "../features.js";
 import { siteConfig } from "../site-config.js";
 
 interface Props {
@@ -25,6 +26,8 @@ const m = v.member;
 const disabled = m?.status === "disabled";
 const { current, past } = m && !disabled ? membership(m, config?.levels) : { current: [], past: [] };
 const meter = v.signedIn ? await meterUsage(Astro) : null;
+const held = m ? featuresFor(m, config?.features, config?.levels) : [];
+const features = (config?.features ?? []).filter((f) => held.includes(f.slug));
 const date = (iso: string | null) => {
 	if (!iso) return null;
 	const t = Date.parse(iso);
@@ -60,6 +63,11 @@ const join = config?.join;
 					You don't have a membership yet.{join && <> <a href={join.href}>{join.label ?? "Become a member"}</a></>}
 				</p>
 			)}
+			{features.length > 0 && (
+				<p class="redeemid-member__features">
+					Includes: {features.map((f) => f.name).join(", ")}
+				</p>
+			)}
 			{past.length > 0 && (
 				<>
 					<h3 class="redeemid-member__subtitle">Before</h3>

package/src/config.ts

@@ -63,6 +63,21 @@ export interface RuleConfig {
  * free each month (or week). Guests get the wall; an entry counts once per
  * period, when its own page renders through <Content> with an `id`.
  */
+/** A perk members hold through any of its levels or Shopify tags. */
+export interface FeatureConfig {
+	slug: string;
+	name: string;
+	levels?: string[];
+	tags?: string[];
+}
+
+/** Where to send signed member events (see events.ts). The signing secret is REDEEMID_EVENTS_SECRET. */
+export interface EventsConfig {
+	url: string;
+	/** Send only these events. All of them when left out. */
+	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted">;
+}
+
 export interface MeterConfig {
 	/** Free entries per period. */
 	limit: number;
@@ -83,6 +98,8 @@ export interface RedeemIDConfig {
 	levels?: LevelConfig[];
 	rules?: RuleConfig[];
 	meter?: MeterConfig;
+	features?: FeatureConfig[];
+	events?: EventsConfig;
 	/** The wall's join link: where readers become members, e.g. { href: "/join/", label: "Become a member" }. */
 	join?: { href: string; label?: string };
 	/**
@@ -123,6 +140,10 @@ export const ENV = {
 	clientSecret: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET",
 	/** Client secret of the Shopify (Admin API) app whose webhooks the site receives. Shopify signs webhooks with it. */
 	webhookSecret: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET",
+	/** Client ID of that Shopify (Admin API) app. With the secret it lets staff tools call the Admin API (client credentials). */
+	adminClientId: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID",
+	/** Secret for signing the outbound events RedeemID sends to `events.url`. */
+	eventsSecret: "REDEEMID_EVENTS_SECRET",
 	/** Storefront API private token, for server-side plan and checkout calls. */
 	storefrontPrivateToken: "REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN",
 	/** Storefront API public token, used only when the private token isn't set. */

package/src/descriptor.ts

@@ -11,6 +11,7 @@ import { VERSION } from "./version.js";
 export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
 	{ path: "/status", label: "Status", icon: "pulse" },
+	{ path: "/test", label: "Access test", icon: "search" },
 ];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 

package/src/events.ts

@@ -0,0 +1,74 @@
+/**
+ * Outbound events: RedeemID POSTs JSON to `events.url` when something
+ * happens to a member, signed so the receiver can trust it.
+ *
+ *   events: { url: "https://hooks.example.com/redeemid" }   // + REDEEMID_EVENTS_SECRET
+ *
+ * Headers: X-RedeemID-Event (the name), X-RedeemID-Delivery (a fresh id) and
+ * X-RedeemID-Signature: sha256=<hex HMAC of the raw body>. Events:
+ * member.signed_in, member.levels_changed, meter.used, meter.exhausted.
+ * Sending never blocks or breaks the page: failures are logged and dropped.
+ * No event carries an email address or a name; match people by `customerId`.
+ */
+
+import { env, ENV, type RedeemIDConfig } from "./config.js";
+import { USER_AGENT } from "./shopify.js";
+
+export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted";
+
+const TIMEOUT_MS = 3000;
+
+export async function signBody(body: string, secret: string): Promise<string> {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body)));
+	return [...mac].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/** Send one event. Returns whether the receiver answered 2xx; never throws. */
+export async function emit(config: RedeemIDConfig | null, name: EventName, data: Record<string, unknown>, fetcher: typeof fetch = fetch): Promise<boolean> {
+	const url = config?.events?.url;
+	const secret = env(ENV.eventsSecret);
+	if (!url || !secret) return false;
+	if (config.events?.only && !config.events.only.includes(name)) return false;
+	const id = crypto.randomUUID();
+	const body = JSON.stringify({ id, event: name, at: new Date().toISOString(), data });
+	try {
+		const res = await fetcher(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"User-Agent": USER_AGENT,
+				"X-RedeemID-Event": name,
+				"X-RedeemID-Delivery": id,
+				"X-RedeemID-Signature": `sha256=${await signBody(body, secret)}`,
+			},
+			body,
+			signal: AbortSignal.timeout(TIMEOUT_MS),
+		});
+		return res.ok;
+	} catch (e) {
+		console.error("[redeemid] event not sent:", name, (e as Error).message);
+		return false;
+	}
+}
+
+/** Send member.levels_changed when a mirror write changed the member's levels. */
+export async function levelChange(
+	config: RedeemIDConfig | null,
+	beforeTags: string[] | null,
+	after: { customerId: string; tags: string[]; status: string },
+	source: string,
+	fetcher: typeof fetch = fetch,
+): Promise<void> {
+	if (!config?.events?.url) return;
+	const { levelsFor } = await import("./access.js");
+	const was = beforeTags ? levelsFor(beforeTags, config.levels) : [];
+	const now = after.status === "disabled" ? [] : levelsFor(after.tags, config.levels);
+	if (was.length === now.length && was.every((l) => now.includes(l))) return;
+	await emit(
+		config,
+		"member.levels_changed",
+		{ customerId: after.customerId, levels: now, added: now.filter((l) => !was.includes(l)), removed: was.filter((l) => !now.includes(l)), source },
+		fetcher,
+	);
+}

package/src/features.ts

@@ -0,0 +1,39 @@
+/**
+ * Features: named perks a member holds through their levels or their
+ * Shopify tags (an ad-free site, a supporter thank-you, early access).
+ * Like levels they come only from the mirrored tags; nothing here grants
+ * them otherwise.
+ *
+ *   features: [
+ *     { slug: "ad-free", name: "Ad-free", levels: ["gold", "premium"] },
+ *     { slug: "supporter", name: "Supporter", tags: ["supporter"] },
+ *   ]
+ */
+
+import { levelsFor, viewer, type AstroLike } from "./access.js";
+import type { FeatureConfig, LevelConfig } from "./config.js";
+import { siteConfig } from "./site-config.js";
+import type { MemberRecord } from "./storage.js";
+
+/** The feature slugs a member holds: from any of the feature's levels or tags. */
+export function featuresFor(member: Pick<MemberRecord, "tags" | "status"> | null, features: FeatureConfig[] = [], levels: LevelConfig[] = []): string[] {
+	if (!member || member.status === "disabled") return [];
+	const held = levelsFor(member.tags, levels);
+	const tags = new Set(member.tags.map((t) => t.toLowerCase()));
+	return features
+		.filter((f) => (f.levels ?? []).some((l) => held.includes(l)) || (f.tags ?? []).some((t) => tags.has(t.toLowerCase())))
+		.map((f) => f.slug);
+}
+
+/** Does the visitor hold this feature? */
+export async function hasFeature(astro: AstroLike, slug: string): Promise<boolean> {
+	return (await viewerFeatures(astro)).includes(slug);
+}
+
+/** The visitor's features. */
+export async function viewerFeatures(astro: AstroLike): Promise<string[]> {
+	const config = siteConfig((astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config?.features?.length) return [];
+	const v = await viewer(astro);
+	return featuresFor(v.member, config.features, config.levels);
+}

package/src/plugin.ts

@@ -33,6 +33,8 @@ import { discover } from "./shopify.js";
 import { stores, type MemberRecord } from "./storage.js";
 import { PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
+import { adminConfigured } from "./admin-api.js";
+import { accessTest, bulkResync, BULK_BATCH, deliveriesSection, memberDetail, registerWebhooks, resyncOne, tagEdit, webhooksSection } from "./staff.js";
 
 import {
 	COLLECTION_BLOCK,
@@ -154,11 +156,13 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 		routes: {
 			admin: {
 				handler: async (ctx: RouteContext) => {
-					const i = (ctx.input ?? {}) as { type?: string; page?: string };
-					if (i.type !== "page_load") return { blocks: [] };
+					const i = (ctx.input ?? {}) as { type?: string; page?: string; action_id?: string; value?: unknown; values?: Record<string, unknown>; block_id?: string };
 					try {
+						if (i.type === "block_action" || i.type === "form_submit") return await action(config, ctx.request, i);
+						if (i.type !== "page_load") return { blocks: [] };
 						if (i.page === "/") return await membersPage(config);
 						if (i.page === "/status") return await statusPage(config, ctx.request);
+						if (i.page === "/test") return await accessTest(config);
 						if (i.page === "widget:status") return await statusWidget(config);
 					} catch (e) {
 						return { blocks: [{ type: "banner", variant: "error", title: "RedeemID couldn't load this page", description: (e as Error).message }] };
@@ -172,6 +176,75 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 
 export default createPlugin;
 
+// ---------------------------------------------------------------- actions
+
+const webhookUri = (request: Request) => `${new URL(request.url).origin}/_emdash/api/auth/redeemid/webhook`;
+
+async function action(
+	config: RedeemIDConfig,
+	request: Request,
+	i: { action_id?: string; value?: unknown; values?: Record<string, unknown>; block_id?: string },
+) {
+	const s = await memberStores();
+	const fail = (e: unknown) => ({ type: "error" as const, message: (e as Error).message });
+	switch (i.action_id) {
+		case "members_back":
+			return membersPage(config);
+		case "member_open": {
+			const m = await s.members.get(String(i.value ?? ""));
+			return m ? memberDetail(config, m) : { ...(await membersPage(config)), toast: { type: "error", message: "That member is gone." } };
+		}
+		case "member_resync": {
+			const id = String(i.value ?? "");
+			try {
+				const m = await resyncOne(config, s, id, "staff resync");
+				const now = m ?? (await s.members.get(id));
+				if (!now) return membersPage(config);
+				return memberDetail(config, now, m ? { type: "success", message: "Read again from Shopify." } : { type: "error", message: "Shopify no longer has this customer." });
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
+		case "member_tag_add":
+		case "member_tag_remove": {
+			const add = i.action_id === "member_tag_add";
+			const v = (i.value ?? {}) as { customerId?: string; tag?: string };
+			const id = add ? String(i.block_id ?? "").replace(/^tags:/, "") : String(v.customerId ?? "");
+			try {
+				const m = await tagEdit(config, s, id, add ? "add" : "remove", add ? i.values?.tags : [v.tag]);
+				const now = m ?? (await s.members.get(id));
+				return now ? memberDetail(config, now, { type: "success", message: add ? "Tags added in Shopify." : "Tag removed in Shopify." }) : membersPage(config);
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
+		case "members_resync": {
+			try {
+				const r = await bulkResync(config, s);
+				return {
+					...(await membersPage(config)),
+					toast: { type: "success", message: `Read ${r.done} members again (${r.changed} changed${r.missing ? `, ${r.missing} no longer in Shopify` : ""}).` },
+				};
+			} catch (e) {
+				return { ...(await membersPage(config)), toast: fail(e) };
+			}
+		}
+		case "webhooks_register": {
+			try {
+				const added = await registerWebhooks(config, webhookUri(request));
+				return { ...(await statusPage(config, request)), toast: { type: "success", message: added.length ? `Registered ${added.length} webhooks.` : "Nothing was missing." } };
+			} catch (e) {
+				return { ...(await statusPage(config, request)), toast: fail(e) };
+			}
+		}
+		case "access_test":
+			return accessTest(config, i.values);
+	}
+	return { blocks: [] };
+}
+
 // ---------------------------------------------------------------- pages
 
 async function memberStores() {
@@ -210,6 +283,25 @@ async function membersPage(config: RedeemIDConfig) {
 				type: "context",
 				text: "Shopify customers who have signed in or that Shopify has sent. Levels come only from their Shopify tags; change tags in Shopify (or with Flow) and access follows.",
 			},
+			adminConfigured()
+				? {
+						type: "actions",
+						elements: [
+							{
+								type: "button",
+								action_id: "members_resync",
+								label: `Resync ${BULK_BATCH} from Shopify`,
+								style: "secondary",
+								confirm: {
+									title: "Read members again from Shopify?",
+									text: `Reads the ${BULK_BATCH} members synced longest ago from Shopify and updates their tags. Click again for the next ${BULK_BATCH}.`,
+									confirm: "Resync",
+									deny: "Cancel",
+								},
+							},
+						],
+					}
+				: { type: "context", text: "Set the Admin API app's client ID (REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID) to resync members and edit their tags from here." },
 			{
 				type: "stats",
 				items: [
@@ -230,6 +322,7 @@ async function membersPage(config: RedeemIDConfig) {
 							{ key: "tags", label: "Shopify tags" },
 							{ key: "status", label: "Account" },
 							{ key: "synced", label: "Last synced", format: "relative_time" },
+							{ key: "open", label: "", format: "element" },
 						],
 						rows: members
 							.sort((a, b) => b.syncedAt.localeCompare(a.syncedAt))
@@ -240,6 +333,7 @@ async function membersPage(config: RedeemIDConfig) {
 								tags: m.tags.join(", ") || "—",
 								status: m.status === "enabled" ? "On" : "Off",
 								synced: m.syncedAt,
+								open: { type: "button", action_id: "member_open", label: "Open", value: m.customerId },
 							})),
 					},
 		],
@@ -277,6 +371,10 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	const levels = config.levels ?? [];
 	const rules = config.rules ?? [];
 	const delivery = await lastDelivery().catch(() => null);
+	const webhooks = await webhooksSection(config, webhookUri(request));
+	const deliveries = await memberStores()
+		.then((s) => deliveriesSection(s))
+		.catch(() => [{ type: "context", text: "Couldn't read deliveries." }]);
 	return {
 		blocks: [
 			{ type: "header", text: "Status" },
@@ -290,11 +388,18 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 					{ label: "Store discovery", value: c.discovery },
 					{ label: "Customer Account API client ID", value: yes(c.clientId) },
 					{ label: "Webhook signing secret", value: yes(c.webhookSecret) },
+					{ label: "Admin API app client ID (staff tools)", value: yes(Boolean(env(ENV.adminClientId))) },
+					{ label: "Events", value: config.events?.url ? `${config.events.url}${env(ENV.eventsSecret) ? "" : " (REDEEMID_EVENTS_SECRET missing)"}` : "Off" },
 					{ label: "Storefront API access", value: c.storefront },
 					{ label: "Last webhook", value: delivery ?? "None received yet" },
 				],
 			},
 			{ type: "divider" },
+			{ type: "header", text: "Webhooks" },
+			...webhooks,
+			{ type: "header", text: "Recent deliveries" },
+			...deliveries,
+			{ type: "divider" },
 			{ type: "header", text: "Shopify settings" },
 			{
 				type: "fields",

package/src/routes/callback.ts

@@ -16,6 +16,8 @@ import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
+import { emit, levelChange } from "../events.js";
+import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
@@ -86,7 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
 
 		const s = stores(emdash.db);
-		const member = (await s.members.get(who.customerId)) ?? emptyMember(who.customerId);
+		const found = await s.members.get(who.customerId);
+		const member = found ?? emptyMember(who.customerId);
 		const now = new Date().toISOString();
 		await s.members.put(
 			who.customerId,
@@ -106,6 +109,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			),
 		);
 
+		const levels = levelsFor(who.tags, config.levels);
+		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
+		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
+
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);

package/src/routes/webhook.ts

@@ -8,7 +8,8 @@
 
 import type { APIRoute } from "astro";
 
-import { env, ENV } from "../config.js";
+import { env, ENV, readConfig } from "../config.js";
+import { levelChange } from "../events.js";
 import { stores } from "../storage.js";
 import { apply, kindOf, verifyHmac } from "../webhooks.js";
 
@@ -17,7 +18,7 @@ export const prerender = false;
 const MAX_BYTES = 1024 * 1024;
 
 export const POST: APIRoute = async ({ request, locals }) => {
-	const emdash = (locals as { emdash?: { db?: unknown } }).emdash;
+	const emdash = (locals as { emdash?: { db?: unknown; config?: unknown } }).emdash;
 	const secret = env(ENV.webhookSecret);
 	if (!emdash?.db || !secret) return new Response("Not configured", { status: 503 });
 
@@ -48,7 +49,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 
 	try {
-		const outcome = await apply(s, topic, payload);
+		const config = readConfig(emdash.config);
+		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic));
 		return new Response(outcome, { status: 200 });
 	} catch (e) {
 		console.error("[redeemid] webhook failed:", topic, (e as Error).message);

package/src/staff.ts

@@ -0,0 +1,220 @@
+/**
+ * Staff tools in the admin (Block Kit): member detail with Resync and tag
+ * edits written to Shopify, a paced manual bulk resync, webhook
+ * registration and health, recent deliveries and the access test.
+ */
+
+import { adminConfigured, adminScopes, editTags, registerWebhooks, resync, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
+import { describe, levelsFor, membership, passes, requirement, termTree, type Terms } from "./access.js";
+import type { RedeemIDConfig } from "./config.js";
+import { levelChange } from "./events.js";
+import { featuresFor } from "./features.js";
+import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
+
+/** Members resynced per click; well inside Shopify's query cost limits. */
+export const BULK_BATCH = 50;
+
+type Blocks = { blocks: unknown[]; toast?: { message: string; type: "success" | "error" | "info" } };
+
+const date = (iso: string | null | undefined) => (iso ? iso.slice(0, 10) : "—");
+
+export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Blocks["toast"]): Blocks {
+	const levels = config.levels ?? [];
+	const { current, past } = membership(m, levels);
+	const features = featuresFor(m, config.features, levels);
+	const featureNames = (config.features ?? []).filter((f) => features.includes(f.slug)).map((f) => f.name);
+	const name = [m.firstName, m.lastName].filter(Boolean).join(" ") || m.email || `Customer ${m.customerId}`;
+	return {
+		toast,
+		blocks: [
+			{ type: "actions", elements: [{ type: "button", action_id: "members_back", label: "← All members", style: "secondary" }] },
+			{ type: "header", text: name },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Email", value: m.email ?? "—" },
+					{ label: "Shopify customer", value: m.customerId },
+					{ label: "Account", value: m.status === "enabled" ? "On" : "Turned off in Shopify" },
+					{ label: "Signed in here", value: m.userId ? `Yes, first on ${date(m.linkedAt)}` : "Not yet" },
+					{ label: "Levels", value: current.map((l) => `${l.name} (since ${date(l.since)})`).join(", ") || "—" },
+					{ label: "Levels before", value: past.map((l) => `${l.name} (${date(l.from)} to ${date(l.to)})`).join(", ") || "—" },
+					{ label: "Features", value: featureNames.join(", ") || "—" },
+					{ label: "Last synced", value: `${m.syncedAt} (${m.source || "unknown"})` },
+				],
+			},
+			{ type: "header", text: "Shopify tags" },
+			m.tags.length
+				? {
+						type: "table",
+						page_action_id: "member_tags",
+						columns: [
+							{ key: "tag", label: "Tag" },
+							{ key: "since", label: "Since" },
+							{ key: "remove", label: "", format: "element" },
+						],
+						rows: m.tags.map((t) => ({
+							tag: t,
+							since: date(m.tagsSince?.[t.toLowerCase()]),
+							remove: adminConfigured()
+								? {
+										type: "button",
+										action_id: "member_tag_remove",
+										label: "Remove in Shopify",
+										style: "danger",
+										value: { customerId: m.customerId, tag: t },
+										confirm: { title: "Remove this tag in Shopify?", text: `Removes "${t}" from the customer in Shopify. Access follows.`, confirm: "Remove", deny: "Cancel", style: "danger" },
+									}
+								: null,
+						})),
+					}
+				: { type: "context", text: "No tags." },
+			adminConfigured()
+				? {
+						type: "form",
+						block_id: `tags:${m.customerId}`,
+						fields: [{ type: "text_input", action_id: "tags", label: "Add tags in Shopify (comma separated)", placeholder: "gold-member" }],
+						submit: { label: "Add in Shopify", action_id: "member_tag_add" },
+					}
+				: { type: "context", text: "Set the Admin API app's client ID to edit tags and resync from here." },
+			adminConfigured()
+				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
+				: { type: "divider" },
+			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+		],
+	};
+}
+
+/** Resync the members synced longest ago, one batch per click. */
+export async function bulkResync(config: RedeemIDConfig, s: Stores): Promise<{ done: number; missing: number; changed: number }> {
+	const page = await s.members.query({ orderBy: { syncedAt: "asc" }, limit: BULK_BATCH });
+	const ids = page.items.map((r) => r.data.customerId);
+	const before = new Map(page.items.map((r) => [r.data.customerId, [...r.data.tags]]));
+	const { updated, missing } = await resync(config, s, ids, "bulk resync");
+	let changed = 0;
+	for (const m of updated) {
+		const was = before.get(m.customerId) ?? [];
+		if (was.join("\n") !== m.tags.join("\n")) changed++;
+		await levelChange(config, was, m, "bulk resync");
+	}
+	return { done: updated.length, missing: missing.length, changed };
+}
+
+export async function resyncOne(config: RedeemIDConfig, s: Stores, customerId: string, source: string): Promise<MemberRecord | null> {
+	const before = await s.members.get(customerId);
+	const { updated } = await resync(config, s, [customerId], source);
+	const m = updated[0] ?? null;
+	if (m) await levelChange(config, before?.tags ?? null, m, source);
+	return m;
+}
+
+export async function tagEdit(config: RedeemIDConfig, s: Stores, customerId: string, change: "add" | "remove", raw: unknown): Promise<MemberRecord | null> {
+	const id = numericId(customerId);
+	if (!id) return null;
+	await editTags(config, id, change, cleanTags(raw));
+	return resyncOne(config, s, id, change === "add" ? "staff added tags" : "staff removed tags");
+}
+
+/** Webhooks: what Shopify sends to this site, and what's missing. */
+export async function webhooksSection(config: RedeemIDConfig, uri: string): Promise<unknown[]> {
+	if (!adminConfigured()) {
+		return [{ type: "context", text: "Set the Admin API app's client ID to check and register webhooks from here. Until then, add them in the app's settings." }];
+	}
+	try {
+		const [subs, scope] = await Promise.all([webhookSubscriptions(config), adminScopes(config)]);
+		const rows = WEBHOOK_TOPICS.map((t) => {
+			const here = subs.find((s) => s.topic === t && s.uri === uri);
+			const elsewhere = subs.find((s) => s.topic === t && s.uri !== uri);
+			return { topic: t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags"), state: here ? "Registered" : elsewhere ? `Goes to ${elsewhere.uri}` : "Missing" };
+		});
+		const missing = rows.filter((r) => r.state !== "Registered").length;
+		return [
+			{ type: "fields", fields: [{ label: "Admin API", value: `Connected (${scope || "no scopes reported"})` }, { label: "Webhook address", value: uri }] },
+			{ type: "table", page_action_id: "webhooks", columns: [{ key: "topic", label: "Topic" }, { key: "state", label: "Sends here", format: "badge" }], rows },
+			missing
+				? { type: "actions", elements: [{ type: "button", action_id: "webhooks_register", label: `Register ${missing} missing`, style: "primary", value: uri }] }
+				: { type: "context", text: "Every topic RedeemID needs is sent here. customers/redact is set in the app's compliance settings." },
+		];
+	} catch (e) {
+		return [{ type: "banner", variant: "alert", title: "Couldn't read webhooks from Shopify", description: (e as Error).message }];
+	}
+}
+
+export async function deliveriesSection(s: Stores): Promise<unknown[]> {
+	const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 20 });
+	return items.length
+		? [
+				{
+					type: "table",
+					page_action_id: "deliveries",
+					columns: [
+						{ key: "topic", label: "Topic", format: "code" },
+						{ key: "at", label: "Received", format: "relative_time" },
+						{ key: "id", label: "Delivery" },
+					],
+					rows: items.map((r) => ({ topic: r.data.topic, at: r.data.receivedAt, id: r.id })),
+				},
+			]
+		: [{ type: "context", text: "No webhooks received yet." }];
+}
+
+export { registerWebhooks };
+
+/** "category:pro, tag:weekend" → { category: ["pro"], tag: ["weekend"] } */
+export function parseTerms(raw: string): Terms {
+	const terms: Record<string, string[]> = {};
+	for (const part of raw.split(",")) {
+		const [tax, term] = part.split(":").map((x) => x.trim());
+		if (tax && term) (terms[tax] ??= []).push(term);
+	}
+	return terms;
+}
+
+/** The access test: what an entry needs, and whether a reader with these tags passes. */
+export async function accessTest(config: RedeemIDConfig, values: Record<string, unknown> = {}): Promise<Blocks> {
+	const collection = String(values.collection ?? "").trim();
+	const termsRaw = String(values.terms ?? "").trim();
+	const tags = cleanTags(String(values.tags ?? ""));
+	const signedIn = values.signed_in !== false;
+	const levels = config.levels ?? [];
+	const form = {
+		type: "form",
+		block_id: "access_test",
+		fields: [
+			{ type: "text_input", action_id: "collection", label: "Collection", placeholder: "posts", initial_value: collection },
+			{ type: "text_input", action_id: "terms", label: "Terms (taxonomy:slug, comma separated)", placeholder: "category:investigations, tag:free-to-read", initial_value: termsRaw },
+			{ type: "text_input", action_id: "tags", label: "Reader's Shopify tags (comma separated)", placeholder: "gold-member", initial_value: tags.join(", ") },
+			{ type: "toggle", action_id: "signed_in", label: "Signed in", initial_value: signedIn },
+		],
+		submit: { label: "Test", action_id: "access_test" },
+	};
+	const out: unknown[] = [
+		{ type: "header", text: "Access test" },
+		{ type: "context", text: "Check what an entry needs under the rules, and whether a reader with some Shopify tags may read it. Nothing is saved." },
+		form,
+	];
+	if (collection) {
+		const terms = parseTerms(termsRaw);
+		const tree = await termTree(config.rules, collection, terms);
+		const required = requirement(config.rules, collection, terms, { combine: config.combine, tree });
+		const held = levelsFor(tags, levels);
+		const ok = required === null || (signedIn && passes(held, required));
+		out.push(
+			{ type: "divider" },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Needs", value: describe(required, levels) },
+					{ label: "Reader's levels", value: levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ") || "None" },
+					{ label: "Result", value: ok ? "Can read" : signedIn ? "Locked: asked to upgrade" : "Locked: asked to sign in" },
+				],
+			},
+			{
+				type: "banner",
+				variant: ok ? "default" : "alert",
+				title: ok ? "This reader can read it" : "This reader is kept out",
+				description: "A Paywall break with levels picked, a Members only part, drip and the meter can still change what a page shows.",
+			},
+		);
+	}
+	return { blocks: out };
+}

package/src/storage.ts

@@ -78,7 +78,7 @@ export interface DeliveryRecord {
 }
 
 export const STORAGE_CONFIG = {
-	members: { indexes: ["email", "userId"] },
+	members: { indexes: ["email", "userId", "syncedAt"] },
 	deliveries: { indexes: ["receivedAt"] },
 	meter: { indexes: ["userId"] },
 };

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.8";
+export const VERSION = "0.0.9";

package/src/webhooks.ts

@@ -88,7 +88,13 @@ export type Outcome = "processed" | "skipped" | "stale" | "ignored";
  * Apply one webhook to the mirror. Throws on storage errors so the caller can
  * answer 500 and let Shopify retry.
  */
-export async function apply(s: Stores, topic: string, payload: Record<string, unknown>): Promise<Outcome> {
+export async function apply(
+	s: Stores,
+	topic: string,
+	payload: Record<string, unknown>,
+	/** Called after a member is written, with their tags before (null when new). */
+	onWrite?: (beforeTags: string[] | null, after: MemberRecord) => Promise<void> | void,
+): Promise<Outcome> {
 	const kind = kindOf(topic);
 	if (!kind || kind === "ignored") return "ignored";
 
@@ -128,7 +134,9 @@ export async function apply(s: Stores, topic: string, payload: Record<string, un
 		return "processed";
 	}
 
-	const current: MemberRecord = (await s.members.get(id)) ?? emptyMember(id);
+	const existing = await s.members.get(id);
+	const beforeTags = existing ? [...existing.tags] : null;
+	const current: MemberRecord = existing ?? emptyMember(id);
 	const updatedAt = time(payload.updated_at);
 
 	if (kind === "profile") {
@@ -157,5 +165,6 @@ export async function apply(s: Stores, topic: string, payload: Record<string, un
 	current.syncedAt = new Date().toISOString();
 	current.source = topic;
 	await s.members.put(id, stampTags(current));
+	await onWrite?.(beforeTags, current);
 	return "processed";
 }