@redeemid/emdash 0.0.9 → 0.0.11

package/src/privacy.ts

@@ -0,0 +1,148 @@
+/**
+ * Privacy requests: every export and erase of the member data RedeemID keeps,
+ * whether the member asked on the site, staff started it, or Shopify sent it.
+ *
+ * What RedeemID keeps about a member: the mirror record (customer id, email,
+ * name, tags and their dates, status, when they first signed in and last
+ * synced, preference save times) and their meter records. Preference answers
+ * live on the Shopify customer, and webhook deliveries keep only a topic and
+ * a time. Shopify stays the record of the customer: erasing here never
+ * erases Shopify data, though staff can ask Shopify to (requestShopifyErasure).
+ */
+
+import { admin, AdminError } from "./admin-api.js";
+import type { RedeemIDConfig } from "./config.js";
+import { emit } from "./events.js";
+import type { MemberRecord, MeterRecord, PrivacyRequest, Stores } from "./storage.js";
+
+export const EXPORT_VERSION = 1;
+
+export interface MemberExport {
+	format: "redeemid-member-export";
+	version: number;
+	exportedAt: string;
+	member: MemberRecord | null;
+	meter: MeterRecord[];
+	elsewhere: string[];
+}
+
+async function meterFor(s: Stores, userId: string | null): Promise<Array<{ id: string; data: MeterRecord }>> {
+	if (!userId) return [];
+	const out: Array<{ id: string; data: MeterRecord }> = [];
+	let cursor: string | undefined;
+	do {
+		const page = await s.meter.query({ where: { userId }, limit: 100, cursor });
+		out.push(...page.items);
+		cursor = page.cursor;
+	} while (cursor);
+	return out;
+}
+
+async function log(s: Stores, r: Omit<PrivacyRequest, "at"> & { at?: string }): Promise<string> {
+	const id = crypto.randomUUID();
+	await s.requests.put(id, { ...r, at: r.at ?? new Date().toISOString() });
+	return id;
+}
+
+/** Everything RedeemID keeps about one member. */
+export async function exportMember(s: Stores, customerId: string): Promise<MemberExport> {
+	const member = await s.members.get(customerId);
+	const meter = await meterFor(s, member?.userId ?? null);
+	return {
+		format: "redeemid-member-export",
+		version: EXPORT_VERSION,
+		exportedAt: new Date().toISOString(),
+		member,
+		meter: meter.map((m) => m.data),
+		elsewhere: [
+			"Orders, addresses, preference answers and the full customer record are kept by the store.",
+			"The site's own user account (email and name) is kept by the site's content system.",
+		],
+	};
+}
+
+/** Export and log it. */
+export async function exportRequest(s: Stores, customerId: string, source: PrivacyRequest["source"]): Promise<MemberExport> {
+	const data = await exportMember(s, customerId);
+	await log(s, { kind: "export", source, customerId, status: "done" });
+	return data;
+}
+
+/**
+ * Erase what RedeemID keeps about one member: the mirror record and their
+ * meter. The site user stays; if they sign in again they're linked again.
+ */
+export async function eraseMember(config: RedeemIDConfig | null, s: Stores, customerId: string, source: PrivacyRequest["source"], shopifyRequestId: string | null = null): Promise<boolean> {
+	const member = await s.members.get(customerId);
+	for (const m of await meterFor(s, member?.userId ?? null)) await s.meter.delete(m.id);
+	if (member) await s.members.delete(customerId);
+	await log(s, { kind: "erase", source, customerId, status: "done", shopifyRequestId });
+	// Receivers of earlier events hold their own copies: tell them, by id only.
+	await emit(config, "member.erased", { customerId, source });
+	return Boolean(member);
+}
+
+/** shop/redact: erase every member and meter record. */
+export async function eraseAll(config: RedeemIDConfig | null, s: Stores): Promise<number> {
+	let n = 0;
+	for (;;) {
+		const page = await s.members.query({ limit: 100 });
+		if (page.items.length === 0) break;
+		for (const r of page.items) {
+			for (const m of await meterFor(s, r.data.userId)) await s.meter.delete(m.id);
+			await s.members.delete(r.id);
+			n++;
+		}
+	}
+	for (;;) {
+		const page = await s.meter.query({ limit: 100 });
+		if (page.items.length === 0) break;
+		for (const r of page.items) await s.meter.delete(r.id);
+	}
+	await log(s, { kind: "erase", source: "shopify", customerId: null, status: "done", note: `Shop redacted: ${n} members` });
+	return n;
+}
+
+/** customers/data_request: an open export request for staff to send to the store owner. */
+export async function shopifyDataRequest(s: Stores, customerId: string, shopifyRequestId: string | null): Promise<void> {
+	await log(s, { kind: "export", source: "shopify", customerId, status: "open", shopifyRequestId });
+}
+
+export async function closeRequest(s: Stores, id: string): Promise<PrivacyRequest | null> {
+	const r = await s.requests.get(id);
+	if (!r) return null;
+	const done = { ...r, status: "done" as const };
+	await s.requests.put(id, done);
+	return done;
+}
+
+export async function recentRequests(s: Stores, limit = 50): Promise<Array<{ id: string; data: PrivacyRequest }>> {
+	const { items } = await s.requests.query({ orderBy: { at: "desc" }, limit });
+	return items;
+}
+
+/**
+ * Ask Shopify to erase the customer's personal data across the store, orders
+ * included. Shopify waits before it does; cancelShopifyErasure withdraws it.
+ * Needs the write_customer_data_erasure scope.
+ */
+export async function requestShopifyErasure(config: RedeemIDConfig, s: Stores, customerId: string, fetcher: typeof fetch = fetch): Promise<void> {
+	await erasureMutation(config, "customerRequestDataErasure", customerId, fetcher);
+	await log(s, { kind: "erase", source: "staff", customerId, status: "open", note: "Asked Shopify to erase" });
+}
+
+export async function cancelShopifyErasure(config: RedeemIDConfig, s: Stores, customerId: string, fetcher: typeof fetch = fetch): Promise<void> {
+	await erasureMutation(config, "customerCancelDataErasure", customerId, fetcher);
+	await log(s, { kind: "erase", source: "staff", customerId, status: "done", note: "Cancelled the Shopify erasure" });
+}
+
+async function erasureMutation(config: RedeemIDConfig, name: "customerRequestDataErasure" | "customerCancelDataErasure", customerId: string, fetcher: typeof fetch): Promise<void> {
+	const data = await admin<Record<string, { userErrors: Array<{ message: string }> } | null>>(
+		config,
+		`mutation RedeemIDErasure($id: ID!) { ${name}(customerId: $id) { customerId userErrors { field message code } } }`,
+		{ id: `gid://shopify/Customer/${customerId}` },
+		fetcher,
+	);
+	const err = data[name]?.userErrors[0];
+	if (err) throw new AdminError(err.message);
+}

package/src/routes/preferences.ts

@@ -0,0 +1,82 @@
+/**
+ * /_emdash/api/auth/redeemid/preferences: the signed-in member's preferences.
+ *
+ * GET answers JSON: { fields } with values, for the member's own customer.
+ * POST takes JSON { values: { "namespace.key": value } } and answers JSON,
+ * or a form (from <Preferences>) and goes back to `return` with the notice
+ * preferences_saved, preferences_refused or preferences_unavailable.
+ * The customer always comes from the session, never from the request.
+ * Refused JSON saves answer 400 with { fields: { key: reason } }; more than
+ * 10 saves a minute answer 429.
+ */
+
+import type { APIRoute } from "astro";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig } from "../config.js";
+import { emit } from "../events.js";
+import { allowSave, formValues, PreferenceError, preferenceFields, preferencesConfigured, readPreferences, savePreferences } from "../preferences.js";
+import { memberForUser, stores } from "../storage.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+const json = (status: number, body: unknown) =>
+	new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json", "Cache-Control": "private, no-store" } });
+
+async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
+	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
+	const config = readConfig(emdash?.config);
+	if (!config || !preferencesConfigured(config) || !emdash?.db) return { error: "unavailable" as const };
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return { error: "sign_in" as const, config };
+	const s = stores(emdash.db);
+	const member = await memberForUser(s, user.id);
+	if (!member) return { error: "sign_in" as const, config };
+	if (member.status === "disabled") return { error: "disabled" as const, config };
+	return { config, s, member };
+}
+
+export const GET: APIRoute = async ({ locals, session }) => {
+	const c = await context(locals, session);
+	if ("error" in c) return json(c.error === "unavailable" ? 404 : 401, { error: c.error });
+	try {
+		return json(200, { fields: await readPreferences(c.config, c.member.customerId) });
+	} catch (e) {
+		console.error("[redeemid] preferences not read:", (e as Error).message);
+		return json(502, { error: "unavailable" });
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, session, redirect }) => {
+	const isJson = (request.headers.get("content-type") ?? "").includes("application/json");
+	const form = isJson ? null : await request.formData().catch(() => null);
+	const returnTo = safeReturn(String(form?.get("return") ?? "/"));
+	const c = await context(locals, session);
+	if ("error" in c) {
+		if (isJson) return json(c.error === "unavailable" ? 404 : 401, { error: c.error });
+		return c.error === "sign_in" ? redirect(signInUrl(returnTo)) : fail(redirect, returnTo, "preferences_unavailable");
+	}
+
+	const slots = allowSave(c.member);
+	if (!slots) return isJson ? json(429, { error: "too_many_saves" }) : fail(redirect, returnTo, "preferences_unavailable");
+
+	let values: Record<string, unknown>;
+	try {
+		if (isJson) {
+			const body = (await request.json()) as { values?: unknown };
+			values = body.values && typeof body.values === "object" && !Array.isArray(body.values) ? (body.values as Record<string, unknown>) : {};
+		} else {
+			values = formValues(form ?? new FormData(), await preferenceFields(c.config));
+		}
+		await c.s.members.put(c.member.customerId, { ...c.member, prefSaves: slots });
+		const { fields, changed } = await savePreferences(c.config, c.member.customerId, values);
+		// Field names only, never the answers.
+		if (changed.length) await emit(c.config, "preferences.saved", { customerId: c.member.customerId, fields: changed });
+		return isJson ? json(200, { fields }) : fail(redirect, returnTo, "preferences_saved");
+	} catch (e) {
+		if (e instanceof PreferenceError) return isJson ? json(400, { error: "refused", fields: e.fields }) : fail(redirect, returnTo, "preferences_refused");
+		console.error("[redeemid] preferences not saved:", (e as Error).message);
+		return isJson ? json(502, { error: "unavailable" }) : fail(redirect, returnTo, "preferences_unavailable");
+	}
+};

package/src/routes/privacy.ts

@@ -0,0 +1,59 @@
+/**
+ * /_emdash/api/auth/redeemid/privacy: the signed-in member's own data.
+ *
+ * GET downloads everything RedeemID keeps about them as JSON.
+ * POST with `confirm=yes` (from <YourData>) erases it, signs them out and
+ * goes back to `return` with the notice data_erased. The member always comes
+ * from the session, never from the request, and a POST from another origin
+ * is refused.
+ */
+
+import type { APIRoute } from "astro";
+import { getPublicOrigin } from "emdash/api/route-utils";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig } from "../config.js";
+import { eraseMember, exportRequest } from "../privacy.js";
+import { memberForUser, stores } from "../storage.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
+	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
+	if (!emdash?.db) return null;
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return null;
+	const s = stores(emdash.db);
+	const member = await memberForUser(s, user.id);
+	return member ? { s, member, config: readConfig(emdash.config), emdash } : null;
+}
+
+export const GET: APIRoute = async ({ locals, session, redirect, url }) => {
+	const c = await context(locals, session);
+	if (!c) return redirect(signInUrl(safeReturn(url.searchParams.get("return"))));
+	const data = await exportRequest(c.s, c.member.customerId, "member");
+	return new Response(JSON.stringify(data, null, 2), {
+		status: 200,
+		headers: {
+			"Content-Type": "application/json; charset=utf-8",
+			"Content-Disposition": 'attachment; filename="my-data.json"',
+			"Cache-Control": "private, no-store",
+		},
+	});
+};
+
+export const POST: APIRoute = async ({ request, locals, session, redirect, url }) => {
+	const form = await request.formData().catch(() => null);
+	const returnTo = safeReturn(String(form?.get("return") ?? "/"));
+	const emdashConfig = (locals as { emdash?: { config?: unknown } }).emdash?.config;
+	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);
+	const from = request.headers.get("origin");
+	if (from && from !== origin && from !== url.origin) return new Response("Forbidden", { status: 403 });
+	const c = await context(locals, session);
+	if (!c) return redirect(signInUrl(returnTo));
+	if (form?.get("confirm") !== "yes") return fail(redirect, returnTo, "erase_unconfirmed");
+	await eraseMember(c.config, c.s, c.member.customerId, "member");
+	session?.destroy();
+	return fail(redirect, returnTo, "data_erased");
+};

package/src/routes/webhook.ts

@@ -50,7 +50,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 	try {
 		const config = readConfig(emdash.config);
-		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic));
+		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config);
 		return new Response(outcome, { status: 200 });
 	} catch (e) {
 		console.error("[redeemid] webhook failed:", topic, (e as Error).message);

package/src/staff.ts

@@ -9,6 +9,7 @@ import { describe, levelsFor, membership, passes, requirement, termTree, type Te
 import type { RedeemIDConfig } from "./config.js";
 import { levelChange } from "./events.js";
 import { featuresFor } from "./features.js";
+import { recentRequests } from "./privacy.js";
 import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
@@ -80,6 +81,97 @@ export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Bl
 				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
 				: { type: "divider" },
 			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+			...privacySection(m.customerId),
+		],
+	};
+}
+
+/** Export and erase for one member, on their detail page. */
+function privacySection(customerId: string): unknown[] {
+	const erase = {
+		type: "button",
+		action_id: "member_erase",
+		label: "Erase site data",
+		style: "danger",
+		value: customerId,
+		confirm: {
+			title: "Erase this member's data on the site?",
+			text: "Removes their synced record and meter here. Their site user and everything in Shopify stay. If they sign in again they're linked again.",
+			confirm: "Erase",
+			deny: "Cancel",
+			style: "danger",
+		},
+	};
+	const shopify = adminConfigured()
+		? [
+				{
+					type: "button",
+					action_id: "member_shopify_erase",
+					label: "Also request erasure in Shopify",
+					style: "danger",
+					value: customerId,
+					confirm: {
+						title: "Ask Shopify to erase this customer?",
+						text: "Shopify erases the customer's personal data across the store, orders included, after a waiting period. Needs the write_customer_data_erasure scope.",
+						confirm: "Request erasure",
+						deny: "Cancel",
+						style: "danger",
+					},
+				},
+				{ type: "button", action_id: "member_shopify_cancel", label: "Cancel the Shopify erasure", style: "secondary", value: customerId },
+			]
+		: [];
+	return [
+		{ type: "header", text: "Privacy" },
+		{ type: "actions", elements: [{ type: "button", action_id: "member_export", label: "Export data", style: "secondary", value: customerId }, erase, ...shopify] },
+		{ type: "context", text: "Export shows everything RedeemID keeps about this member. Erasing removes it from the site; Shopify stays the record of the customer." },
+	];
+}
+
+/** The member's export, as JSON, under their detail page. */
+export function exportBlocks(detail: Blocks, data: unknown): Blocks {
+	return { ...detail, blocks: [...detail.blocks, { type: "header", text: "Export" }, { type: "code", language: "jsonc", code: JSON.stringify(data, null, 2) }] };
+}
+
+/** Every privacy request: what came in, from where, and what's still open. */
+export async function privacyPage(s: Stores, toast?: Blocks["toast"], extra: unknown[] = []): Promise<Blocks> {
+	const items = await recentRequests(s);
+	return {
+		toast,
+		blocks: [
+			{ type: "header", text: "Privacy requests" },
+			{ type: "context", text: "Exports and erasures of what RedeemID keeps, from members, staff and Shopify's compliance webhooks. Open requests need staff: send a Shopify data request's export to the store owner, then mark it done." },
+			items.length
+				? {
+						type: "table",
+						page_action_id: "privacy_requests",
+						columns: [
+							{ key: "at", label: "When", format: "relative_time" },
+							{ key: "kind", label: "Request" },
+							{ key: "source", label: "From" },
+							{ key: "customer", label: "Shopify customer" },
+							{ key: "status", label: "Status", format: "badge" },
+							{ key: "act", label: "", format: "element" },
+						],
+						rows: items.map(({ id, data: r }) => ({
+							at: r.at,
+							kind: r.kind === "export" ? "Export" : "Erase",
+							source: { member: "Member, on the site", staff: "Staff", shopify: "Shopify" }[r.source] + (r.shopifyRequestId ? ` (request ${r.shopifyRequestId})` : "") + (r.note ? `: ${r.note}` : ""),
+							customer: r.customerId ?? "All",
+							status: r.status === "open" ? "Open" : "Done",
+							act:
+								r.status === "open"
+									? {
+											type: "button",
+											action_id: "privacy_done",
+											label: r.kind === "export" && r.customerId ? "Export and mark done" : "Mark done",
+											value: id,
+										}
+									: null,
+						})),
+					}
+				: { type: "context", text: "No requests yet." },
+			...extra,
 		],
 	};
 }

package/src/storage.ts

@@ -37,6 +37,8 @@ export interface MemberRecord {
 	linkedAt?: string | null;
 	/** Tags Shopify has removed, with when each was held (newest last, at most 50). */
 	pastTags?: PastTag[];
+	/** When the member last saved preferences (ms), newest last, at most 10: the rate limit. */
+	prefSaves?: number[];
 }
 
 /** A tag the customer held from `from` (when known) until `to`. */
@@ -77,16 +79,31 @@ export interface DeliveryRecord {
 	receivedAt: string;
 }
 
+/** One privacy request: an export or erase, and where it came from. Names no one but the customer id. */
+export interface PrivacyRequest {
+	kind: "export" | "erase";
+	/** member: on the site; staff: in the admin; shopify: a compliance webhook. */
+	source: "member" | "staff" | "shopify";
+	customerId: string | null;
+	at: string;
+	/** open: staff still need to act (a Shopify data request, or a Shopify erasure that's pending). */
+	status: "open" | "done";
+	shopifyRequestId?: string | null;
+	note?: string;
+}
+
 export const STORAGE_CONFIG = {
 	members: { indexes: ["email", "userId", "syncedAt"] },
 	deliveries: { indexes: ["receivedAt"] },
 	meter: { indexes: ["userId"] },
+	requests: { indexes: ["at", "customerId", "status"] },
 };
 
 export interface Stores {
 	members: StorageCollection<MemberRecord>;
 	deliveries: StorageCollection<DeliveryRecord>;
 	meter: StorageCollection<MeterRecord>;
+	requests: StorageCollection<PrivacyRequest>;
 }
 
 export function stores(db: unknown): Stores {

package/src/text.ts

@@ -0,0 +1,185 @@
+/**
+ * Replacement text: give any string members and visitors see new words, one
+ * string at a time. Config `text` maps a string's original English to its
+ * replacement:
+ *
+ *   text: {
+ *     "Sign in": "Log in",
+ *     "This is for {level} members.": "{level} members only.",
+ *   }
+ *
+ * Only the strings named change: there is no find-and-replace across
+ * strings, so nothing changes that nobody looked at. STRINGS lists every
+ * original. Some have placeholders such as `{level}`, filled in when the
+ * text shows; a replacement may use its original's placeholders, in any
+ * order or not at all, but no others. A replacement that breaks this, or
+ * names a string RedeemID doesn't show, is ignored (the original shows) and
+ * listed on the Status page. Text is plain: HTML in a replacement shows as
+ * typed. Explicit component props (`label`, `title`, Notices `messages`) win
+ * over `text`.
+ */
+
+import type { RedeemIDConfig } from "./config.js";
+
+/** Every string RedeemID shows members and visitors, by where it shows. */
+export const STRINGS = {
+	account: ["Signed in", "Account", "Sign out", "Sign in"],
+	badge: ["Free", "Signed in", " (locked)"],
+	cart: [
+		"Cart",
+		"Your cart is empty.",
+		"Your cart isn't available right now. Try again in a few minutes.",
+		"{price} each · {total}",
+		"Quantity",
+		"Update",
+		"Remove",
+		"Discount code",
+		"Apply",
+		"{code} doesn't apply to this cart.",
+		"Subtotal",
+		"Total",
+		"Taxes and shipping are worked out at checkout.",
+		"Checkout",
+	],
+	collection: ["From {price}", "Sold out"],
+	contribution: ["Give", "Another amount ({currency})", "Quantity ({price} each)"],
+	meter: ["This is your last free read this week.", "This is your last free read this month.", "You have 1 free read left this week.", "You have 1 free read left this month.", "You have {count} free reads left this week.", "You have {count} free reads left this month."],
+	wall: [
+		"Become a member",
+		"This is for members. {signIn} to read on.",
+		"Sign in",
+		"Not a member yet? {join}.",
+		"You've used your free reads this week.",
+		"You've used your free reads this month.",
+		"This opens for you on {date}.",
+		"This opens for you after you've been a member a little longer.",
+		"This is for {level} members.",
+		"Your membership doesn't include this yet.",
+		"Your account is turned off. Contact the store for help.",
+		"This is for members.",
+		"Or buy just this for {price}.",
+		"Buy just this",
+	],
+	member: [
+		"Your membership",
+		"Your account is turned off. Contact the store for help.",
+		"since {date}",
+		"You don't have a membership yet.",
+		"Become a member",
+		"Includes: {features}",
+		"Before",
+		"{from} to {to}",
+		"until {to}",
+		"Free reads this week: {used} of {limit} used.",
+		"Free reads this month: {used} of {limit} used.",
+		"Orders and details",
+		"Refresh membership",
+		"Sign out",
+		"Just bought a plan? It can take a minute to show here. Refresh membership checks again.",
+		"{signIn} to see your membership.",
+		"Sign in",
+	],
+	notices: [
+		"Sign-in isn't set up on this site yet.",
+		"Sign-in isn't available right now. Try again in a few minutes.",
+		"That sign-in took too long. Try again.",
+		"This account can't sign in here. Use a different email.",
+		"This site isn't ready for sign-in yet.",
+		"Your account needs an email address to sign in.",
+		"Sign-in didn't finish. Try again.",
+		"That plan isn't available right now.",
+		"Checkout didn't open. Try again.",
+		"Your cart is empty.",
+		"Added to your cart.",
+		"Your cart is updated.",
+		"Discount applied.",
+		"That discount code doesn't apply to this cart.",
+		"Your membership is up to date.",
+		"Your preferences are saved.",
+		"Some answers weren't saved. Check them and try again.",
+		"Your preferences can't be saved right now. Try again in a few minutes.",
+		"Your data on this site is deleted, and you're signed out.",
+		"Tick the box to confirm, then try again.",
+		"Your account page isn't available right now. Try again in a few minutes.",
+	],
+	privacy: [
+		"Your data",
+		"Download my data",
+		"Deleting removes what this site keeps about you and signs you out. Your store account and orders stay; ask the store to delete those.",
+		"I understand",
+		"Delete my data",
+	],
+	plan: ["Join", "You're on this plan.", "Not available right now."],
+	preferences: ["Your preferences", "Save preferences", "Your preferences can't be loaded right now. Try again in a few minutes.", "Not set", "Yes", "No", "One per line."],
+	product: ["Add to cart", "Buy now", "Option", "{option} ({price})", "{option} ({price}) sold out", "Quantity", "Sold out."],
+	files: ["File not available", "Sign in to download this file.", "Sign in", "Your membership doesn't include this file."],
+} as const;
+
+const ALL = new Set<string>(Object.values(STRINGS).flat());
+
+const PLACEHOLDER = /\{(\w+)\}/g;
+
+export function placeholders(s: string): string[] {
+	return [...s.matchAll(PLACEHOLDER)].map((m) => m[1] as string);
+}
+
+/** Why a replacement can't be used, or null when it can. */
+export function textProblem(original: string, replacement: unknown): string | null {
+	if (!ALL.has(original)) return "RedeemID doesn't show this string";
+	if (typeof replacement !== "string") return "The replacement isn't text";
+	const allowed = new Set(placeholders(original));
+	const extra = placeholders(replacement).filter((p) => !allowed.has(p));
+	if (extra.length) return `Uses ${[...new Set(extra)].map((p) => `{${p}}`).join(", ")}, which the original doesn't have`;
+	return null;
+}
+
+const checked = new WeakMap<object, { ok: Map<string, string>; problems: Array<{ original: string; problem: string }> }>();
+
+function table(config: RedeemIDConfig | null | undefined) {
+	const map = config?.text;
+	if (!map || typeof map !== "object") return null;
+	let t = checked.get(map);
+	if (!t) {
+		t = { ok: new Map(), problems: [] };
+		for (const [original, replacement] of Object.entries(map)) {
+			const problem = textProblem(original, replacement);
+			if (problem) t.problems.push({ original, problem });
+			else t.ok.set(original, replacement as string);
+		}
+		if (t.problems.length) console.warn(`[redeemid] ${t.problems.length} text replacement(s) ignored; see Status.`);
+		checked.set(map, t);
+	}
+	return t;
+}
+
+/** Replacements that are ignored, and why. */
+export function textProblems(config: RedeemIDConfig | null | undefined): Array<{ original: string; problem: string }> {
+	return table(config)?.problems ?? [];
+}
+
+/** The text for one string, with plain placeholders filled in. */
+export function text(config: RedeemIDConfig | null | undefined, original: string, vars: Record<string, string | number> = {}): string {
+	const template = table(config)?.ok.get(original) ?? original;
+	return template.replace(PLACEHOLDER, (whole, name: string) => (name in vars ? String(vars[name]) : whole));
+}
+
+/**
+ * The text for a string whose placeholders are elements (a link inside a
+ * sentence): the parts to render, in order.
+ *
+ *   {textParts(config, "This is for members. {signIn} to read on.", { signIn: <a href={u}>Sign in</a> })}
+ */
+export function textParts(config: RedeemIDConfig | null | undefined, original: string, slots: Record<string, unknown>): unknown[] {
+	const template = table(config)?.ok.get(original) ?? original;
+	const out: unknown[] = [];
+	let last = 0;
+	for (const m of template.matchAll(PLACEHOLDER)) {
+		const name = m[1] as string;
+		if (!(name in slots)) continue;
+		if (m.index > last) out.push(template.slice(last, m.index));
+		out.push(slots[name]);
+		last = m.index + m[0].length;
+	}
+	if (last < template.length) out.push(template.slice(last));
+	return out;
+}

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.9";
+export const VERSION = "0.0.11";