@base44/app-plugin-commerce 0.1.0

package/base44/functions/commerce/admin-reports/entry.ts

@@ -0,0 +1,283 @@
+/**
+ * commerce/admin-reports — on-demand report aggregation over orders.
+ * Fine to ~10k orders; larger stores should materialize stats
+ * (see skills/commerce/references/limits-and-performance.md).
+ *
+ * Actions: summary | sales | top-sellers | stock |
+ * orders-totals | products-totals | customers-totals | coupons-totals |
+ * reviews-totals | categories-totals | tags-totals | attributes-totals
+ */
+import { createClientFromRequest } from "npm:@base44/sdk";
+import { HttpError, requireAdmin } from "../../../shared/commerce/auth.ts";
+import { round2 } from "../../../shared/commerce/money.ts";
+import { getSettings } from "../../../shared/commerce/settings.ts";
+import { scanAll } from "../../../shared/commerce/scan.ts";
+
+const ok = (data: unknown, status = 200) => Response.json({ success: true, data }, { status });
+const fail = (status: number, error: string, code?: string) =>
+  Response.json({ success: false, error, code }, { status });
+
+Deno.serve(async (req) => {
+  try {
+    const base44 = createClientFromRequest(req);
+    await requireAdmin(base44);
+    const sr = base44.asServiceRole;
+    const { action, ...payload } = await req.json();
+
+    switch (action) {
+      case "summary": return ok(await summary(sr));
+      case "sales": return ok(await sales(sr, payload));
+      case "top-sellers": return ok(await topSellers(sr, payload));
+      case "stock": return ok(await stockReport(sr));
+      case "orders-totals": return ok(await ordersTotals(sr));
+      case "products-totals": return ok(await groupCount(sr.entities["commerce.Product"], "type"));
+      case "customers-totals": return ok(await customersTotals(sr));
+      case "coupons-totals": return ok(await groupCount(sr.entities["commerce.Coupon"], "discount_type"));
+      case "reviews-totals": return ok(await groupCount(sr.entities["commerce.ProductReview"], "status"));
+      case "categories-totals": return ok(await termTotals(sr.entities["commerce.ProductCategory"]));
+      case "tags-totals": return ok(await termTotals(sr.entities["commerce.ProductTag"]));
+      case "attributes-totals": return ok(await attributesTotals(sr));
+      default:
+        return fail(400, `Unknown action: ${action}`, "unknown_action");
+    }
+  } catch (e) {
+    if (e instanceof HttpError) return fail(e.status, e.message, e.code);
+    console.error("commerce/admin-reports error:", e);
+    return fail(500, (e as Error).message ?? "Internal error");
+  }
+});
+
+// ── shared aggregation ───────────────────────────────────────────────────────
+
+/** An order counts toward sales when it was paid (standard report semantics). */
+function isCounted(o: any): boolean {
+  return !!o.date_paid || ["processing", "completed"].includes(o.status);
+}
+
+function inRange(dateIso: string | undefined, min?: string, max?: string): boolean {
+  if (!dateIso) return false;
+  if (min && dateIso < min) return false;
+  if (max && dateIso > `${max}~`) return false; // '~' > any time suffix
+  return true;
+}
+
+function bucketKey(dateIso: string, interval: string): string {
+  const d = new Date(dateIso);
+  const y = d.getUTCFullYear();
+  const m = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const day = String(d.getUTCDate()).padStart(2, "0");
+  if (interval === "month") return `${y}-${m}`;
+  if (interval === "week") {
+    // bucket by the Monday of the week (UTC)
+    const monday = new Date(d);
+    const dow = (d.getUTCDay() + 6) % 7; // Mon=0
+    monday.setUTCDate(d.getUTCDate() - dow);
+    return `${monday.getUTCFullYear()}-${String(monday.getUTCMonth() + 1).padStart(2, "0")}-${String(monday.getUTCDate()).padStart(2, "0")}`;
+  }
+  return `${y}-${m}-${day}`; // day
+}
+
+interface SalesAgg {
+  gross_sales: number;
+  net_sales: number;
+  orders: number;
+  items: number;
+  tax: number;
+  shipping: number;
+  discount: number;
+  refunds: number;
+}
+
+const emptyAgg = (): SalesAgg => ({
+  gross_sales: 0, net_sales: 0, orders: 0, items: 0, tax: 0, shipping: 0, discount: 0, refunds: 0,
+});
+
+function addOrder(agg: SalesAgg, o: any): void {
+  agg.gross_sales = round2(agg.gross_sales + (o.total ?? 0));
+  agg.orders += 1;
+  agg.items += (o.line_items ?? []).reduce((a: number, l: any) => a + (l.quantity ?? 0), 0);
+  agg.tax = round2(agg.tax + (o.total_tax ?? 0));
+  agg.shipping = round2(agg.shipping + (o.shipping_total ?? 0));
+  agg.discount = round2(agg.discount + (o.discount_total ?? 0));
+}
+
+function finalizeNet(agg: SalesAgg): void {
+  // net = gross − refunds − tax − shipping
+  agg.net_sales = round2(agg.gross_sales - agg.refunds - agg.tax - agg.shipping);
+}
+
+async function salesAggregation(sr: any, dateMin?: string, dateMax?: string, interval?: string): Promise<{ totals: SalesAgg; series: Array<{ period: string } & SalesAgg> }> {
+  const orders = (await scanAll(sr.entities["commerce.Order"])).filter(
+    (o) => isCounted(o) && inRange(o.created_date, dateMin, dateMax),
+  );
+  // refunds counted by refund date (intended behavior)
+  const refunds = (await scanAll(sr.entities["commerce.OrderRefund"])).filter(
+    (r) => inRange(r.created_date, dateMin, dateMax),
+  );
+
+  const totals = emptyAgg();
+  const buckets = new Map<string, SalesAgg>();
+  const bucketOf = (dateIso: string) => {
+    const key = bucketKey(dateIso, interval ?? "day");
+    if (!buckets.has(key)) buckets.set(key, emptyAgg());
+    return buckets.get(key)!;
+  };
+
+  for (const o of orders) {
+    addOrder(totals, o);
+    if (interval) addOrder(bucketOf(o.created_date), o);
+  }
+  for (const r of refunds) {
+    totals.refunds = round2(totals.refunds + (r.amount ?? 0));
+    if (interval) {
+      const b = bucketOf(r.created_date);
+      b.refunds = round2(b.refunds + (r.amount ?? 0));
+    }
+  }
+  finalizeNet(totals);
+  const series = [...buckets.entries()]
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([period, agg]) => {
+      finalizeNet(agg);
+      return { period, ...agg };
+    });
+  return { totals, series };
+}
+
+// ── actions ──────────────────────────────────────────────────────────────────
+
+async function summary(sr: any): Promise<any> {
+  const now = new Date();
+  const today = now.toISOString().slice(0, 10);
+  const monthStart = `${now.toISOString().slice(0, 7)}-01`;
+
+  const [todayAgg, monthAgg, statusAgg, stock, top] = await Promise.all([
+    salesAggregation(sr, today, today),
+    salesAggregation(sr, monthStart, today),
+    ordersTotals(sr),
+    stockReport(sr),
+    topSellers(sr, { date_min: monthStart, date_max: today, limit: 1 }),
+  ]);
+
+  return {
+    sales_today: todayAgg.totals,
+    sales_month: monthAgg.totals,
+    orders_by_status: statusAgg,
+    low_stock_count: stock.low_stock.length,
+    out_of_stock_count: stock.out_of_stock.length,
+    top_seller: top.rows[0] ?? null,
+  };
+}
+
+async function sales(sr: any, payload: any): Promise<any> {
+  const { date_min, date_max, interval = "day" } = payload;
+  return await salesAggregation(sr, date_min, date_max, interval);
+}
+
+async function topSellers(sr: any, payload: any): Promise<any> {
+  const { date_min, date_max, limit = 10 } = payload;
+  const orders = (await scanAll(sr.entities["commerce.Order"])).filter(
+    (o) => isCounted(o) && inRange(o.created_date, date_min, date_max),
+  );
+  const byProduct = new Map<string, { product_id: string; quantity: number; net_revenue: number }>();
+  for (const o of orders) {
+    for (const l of o.line_items ?? []) {
+      if (!l.product_id) continue;
+      const cur = byProduct.get(l.product_id) ?? { product_id: l.product_id, quantity: 0, net_revenue: 0 };
+      cur.quantity += l.quantity ?? 0;
+      cur.net_revenue = round2(cur.net_revenue + (l.total ?? 0));
+      byProduct.set(l.product_id, cur);
+    }
+  }
+  const top = [...byProduct.values()]
+    .sort((a, b) => b.quantity - a.quantity)
+    .slice(0, Number(limit));
+  for (const row of top as any[]) {
+    try {
+      const p = await sr.entities["commerce.Product"].get(row.product_id);
+      row.name = p?.name ?? "(deleted product)";
+      row.sku = p?.sku ?? "";
+    } catch { row.name = "(deleted product)"; }
+  }
+  return { rows: top };
+}
+
+async function stockReport(sr: any): Promise<any> {
+  const settings = await getSettings(sr, "inventory");
+  const defaultLow = Number(settings.inventory?.low_stock_threshold ?? 2);
+  const outThreshold = Number(settings.inventory?.out_of_stock_threshold ?? 0);
+
+  const products = await scanAll(sr.entities["commerce.Product"]);
+  const variations = await scanAll(sr.entities["commerce.ProductVariation"]);
+
+  const low: any[] = [];
+  const out: any[] = [];
+  const consider = (rec: any, name: string, isVariation: boolean, parent?: any) => {
+    const managed = isVariation ? (rec.manage_stock === "yes") : !!rec.manage_stock;
+    const entry = {
+      id: rec.id, product_id: isVariation ? rec.product_id : rec.id,
+      name, sku: rec.sku ?? "", stock_quantity: rec.stock_quantity ?? null,
+      is_variation: isVariation,
+    };
+    if (managed) {
+      const qty = Number(rec.stock_quantity ?? 0);
+      const lowAt = Number(rec.low_stock_amount ?? parent?.low_stock_amount ?? defaultLow);
+      if (qty <= outThreshold) out.push(entry);
+      else if (qty <= lowAt) low.push(entry);
+    } else if (rec.stock_status === "outofstock") {
+      out.push(entry);
+    }
+  };
+
+  const byId = new Map(products.map((p) => [p.id, p]));
+  for (const p of products) consider(p, p.name, false);
+  for (const v of variations) {
+    const parent = byId.get(v.product_id);
+    const label = `${parent?.name ?? "?"} — ${(v.attributes ?? []).map((a: any) => a.option).join(" / ")}`;
+    consider(v, label, true, parent);
+  }
+  return { low_stock: low, out_of_stock: out };
+}
+
+async function ordersTotals(sr: any): Promise<Record<string, number>> {
+  const orders = await scanAll(sr.entities["commerce.Order"], null, "-created_date", { fields: ["id", "status"] });
+  const counts: Record<string, number> = {};
+  for (const o of orders) counts[o.status] = (counts[o.status] ?? 0) + 1;
+  return counts;
+}
+
+async function customersTotals(sr: any): Promise<any> {
+  const customers = await scanAll(sr.entities["commerce.Customer"], null, "-created_date", { fields: ["id", "is_guest", "is_paying_customer"] });
+  return {
+    total: customers.length,
+    guests: customers.filter((c) => c.is_guest).length,
+    registered: customers.filter((c) => !c.is_guest).length,
+    paying: customers.filter((c) => c.is_paying_customer).length,
+  };
+}
+
+async function groupCount(entityApi: any, field: string): Promise<any> {
+  const rows = await scanAll(entityApi, null, "-created_date", { fields: ["id", field] });
+  const counts: Record<string, number> = {};
+  for (const r of rows) {
+    const key = r[field] ?? "unknown";
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return { total: rows.length, by: counts };
+}
+
+async function termTotals(entityApi: any): Promise<any> {
+  const rows = await scanAll(entityApi, null, "-created_date", { fields: ["id", "name", "count"] });
+  return { total: rows.length, terms: rows.map((r) => ({ id: r.id, name: r.name, count: r.count ?? 0 })) };
+}
+
+async function attributesTotals(sr: any): Promise<any> {
+  const attrs = await scanAll(sr.entities["commerce.ProductAttribute"]);
+  const terms = await scanAll(sr.entities["commerce.ProductAttributeTerm"], null, "-created_date", { fields: ["id", "attribute_id"] });
+  const byAttr: Record<string, number> = {};
+  for (const t of terms) byAttr[t.attribute_id] = (byAttr[t.attribute_id] ?? 0) + 1;
+  return {
+    total: attrs.length,
+    attributes: attrs.map((a) => ({ id: a.id, name: a.name, terms: byAttr[a.id] ?? 0 })),
+  };
+}

package/base44/functions/commerce/admin-reviews/entry.ts

@@ -0,0 +1,66 @@
+/**
+ * commerce/admin-reviews — review moderation; keeps product rating aggregates in sync.
+ *
+ * Actions: set-status | update | delete
+ */
+import { createClientFromRequest } from "npm:@base44/sdk";
+import { HttpError, requireAdmin } from "../../../shared/commerce/auth.ts";
+import { recalcProductRating } from "../../../shared/commerce/reviews.ts";
+
+const ok = (data: unknown, status = 200) => Response.json({ success: true, data }, { status });
+const fail = (status: number, error: string, code?: string) =>
+  Response.json({ success: false, error, code }, { status });
+
+const STATUSES = ["approved", "hold", "spam", "trash"];
+
+Deno.serve(async (req) => {
+  try {
+    const base44 = createClientFromRequest(req);
+    await requireAdmin(base44);
+    const sr = base44.asServiceRole;
+    const { action, ...payload } = await req.json();
+
+    const getReview = async (id: string) => {
+      const review = await sr.entities["commerce.ProductReview"].get(id);
+      if (!review) throw new HttpError(404, "Review not found", "not_found");
+      return review;
+    };
+
+    switch (action) {
+      case "set-status": {
+        if (!STATUSES.includes(payload.status)) {
+          throw new HttpError(400, `Invalid review status: ${payload.status}`, "invalid_status");
+        }
+        const review = await getReview(payload.id);
+        await sr.entities["commerce.ProductReview"].update(review.id, { status: payload.status });
+        const aggregates = await recalcProductRating(sr, review.product_id);
+        return ok({ review: { ...review, status: payload.status }, aggregates });
+      }
+      case "update": {
+        const review = await getReview(payload.id);
+        const patch: Record<string, any> = {};
+        for (const k of ["review", "rating", "reviewer", "reviewer_email", "status"]) {
+          if (payload[k] !== undefined) patch[k] = payload[k];
+        }
+        if (patch.rating != null && (patch.rating < 0 || patch.rating > 5)) {
+          throw new HttpError(400, "Rating must be between 0 and 5.", "invalid_rating");
+        }
+        await sr.entities["commerce.ProductReview"].update(review.id, patch);
+        const aggregates = await recalcProductRating(sr, review.product_id);
+        return ok({ review: { ...review, ...patch }, aggregates });
+      }
+      case "delete": {
+        const review = await getReview(payload.id);
+        await sr.entities["commerce.ProductReview"].delete(review.id);
+        const aggregates = await recalcProductRating(sr, review.product_id);
+        return ok({ deleted: review.id, aggregates });
+      }
+      default:
+        return fail(400, `Unknown action: ${action}`, "unknown_action");
+    }
+  } catch (e) {
+    if (e instanceof HttpError) return fail(e.status, e.message, e.code);
+    console.error("commerce/admin-reviews error:", e);
+    return fail(500, (e as Error).message ?? "Internal error");
+  }
+});

package/base44/functions/commerce/admin-tools/entry.ts

@@ -0,0 +1,261 @@
+/**
+ * commerce/admin-tools — maintenance and diagnostics (mini "system status").
+ *
+ * Actions: status | payment-connector-status | admin-email-recipients |
+ * recount-terms | recount-coupon-usage | recalculate-customer-stats-all |
+ * prune-webhook-deliveries | clear-abandoned-carts |
+ * regenerate-download-permissions
+ */
+import { createClientFromRequest } from "npm:@base44/sdk";
+import { HttpError, requireAdmin } from "../../../shared/commerce/auth.ts";
+import { getSettings } from "../../../shared/commerce/settings.ts";
+import { adminUserEmails } from "../../../shared/commerce/emails.ts";
+import { onlinePaymentStatus } from "../../../shared/commerce/payments.ts";
+import { round2 } from "../../../shared/commerce/money.ts";
+import { grantDownloadPermissions, revokeDownloadPermissions } from "../../../shared/commerce/orders.ts";
+import { scanAll } from "../../../shared/commerce/scan.ts";
+
+const ok = (data: unknown, status = 200) => Response.json({ success: true, data }, { status });
+const fail = (status: number, error: string, code?: string) =>
+  Response.json({ success: false, error, code }, { status });
+
+Deno.serve(async (req) => {
+  try {
+    const base44 = createClientFromRequest(req);
+    await requireAdmin(base44);
+    const sr = base44.asServiceRole;
+    const { action, ...payload } = await req.json();
+
+    switch (action) {
+      case "status": return ok(await status(sr));
+      case "payment-connector-status": return ok(await paymentConnectorStatus(sr, payload));
+      case "admin-email-recipients": return ok(await adminEmailRecipients(sr));
+      case "recount-terms": return ok(await recountTerms(sr));
+      case "recount-coupon-usage": return ok(await recountCouponUsage(sr));
+      case "recalculate-customer-stats-all": return ok(await recalcAllCustomerStats(sr));
+      case "prune-webhook-deliveries": return ok(await pruneDeliveries(sr, payload));
+      case "clear-abandoned-carts": return ok(await clearCarts(sr, payload));
+      case "regenerate-download-permissions": return ok(await regenPermissions(sr, payload));
+      default:
+        return fail(400, `Unknown action: ${action}`, "unknown_action");
+    }
+  } catch (e) {
+    if (e instanceof HttpError) return fail(e.status, e.message, e.code);
+    console.error("commerce/admin-tools error:", e);
+    return fail(500, (e as Error).message ?? "Internal error");
+  }
+});
+
+/**
+ * Where admin notifications actually go right now, so Settings → Emails can
+ * name the effective recipients instead of describing the rule. `source` is
+ * "settings" when admin_recipients is filled in, else "admin_users" for the
+ * runtime fallback (which the client can't resolve itself — listing users needs
+ * service role).
+ */
+async function adminEmailRecipients(
+  sr: any,
+): Promise<{ recipients: string[]; source: string; admin_users: string[] }> {
+  const settings = await getSettings(sr, "emails");
+  const configured = (settings.emails?.admin_recipients ?? [])
+    .map((r: any) => String(r ?? "").trim())
+    .filter(Boolean);
+  // admin_users is returned either way: the UI shows it as the fallback even
+  // while explicit recipients are set.
+  const adminUsers = await adminUserEmails(sr);
+  return {
+    recipients: configured.length ? configured : adminUsers,
+    source: configured.length ? "settings" : "admin_users",
+    admin_users: adminUsers,
+  };
+}
+
+/**
+ * Is a gateway's Base44 connector actually connected?
+ *
+ * The admin UI calls this instead of hardcoding a "not wired" notice, so the
+ * warning disappears on its own once the connector is connected. Connectors are
+ * service-role only, which is why this needs a round trip rather than a client
+ * check. Any failure (SDK without `connectors`, connector never set up) is
+ * reported as `connected: false` — the conservative answer.
+ */
+/**
+ * Is an online payment provider usable right now? Delegates to the payment
+ * utility, so this answers for whichever provider is wired — the admin UI shows
+ * "no payment provider connected" rather than naming one.
+ */
+async function paymentConnectorStatus(sr: any, _payload: any): Promise<any> {
+  const status = await onlinePaymentStatus(sr);
+  return {
+    ...status,
+    connector: status.provider, // kept for callers written against the old shape
+  };
+}
+
+/** Entity counts (capped at 1000 — shown as "1000+"), settings sanity, seeded flag. */
+async function status(sr: any): Promise<any> {
+  const entities = [
+    "commerce.Product", "commerce.ProductVariation", "commerce.ProductCategory", "commerce.ProductTag", "commerce.ProductAttribute",
+    "commerce.Order", "commerce.OrderRefund", "commerce.Coupon", "commerce.Customer", "commerce.ProductReview",
+    "commerce.TaxRate", "commerce.ShippingZone", "commerce.PaymentGateway", "commerce.Webhook", "commerce.Cart",
+  ];
+  const counts: Record<string, string | number> = {};
+  for (const name of entities) {
+    try {
+      const page = (await sr.entities[name].list(undefined, 1000)) ?? [];
+      counts[name] = page.length >= 1000 ? "1000+" : page.length;
+    } catch (e) {
+      counts[name] = `error: ${(e as Error).message}`;
+    }
+  }
+  const settings = await getSettings(sr);
+  const groups = Object.keys(settings);
+  return {
+    template_version: "1.0.0",
+    seeded: groups.includes("general"),
+    settings_groups: groups,
+    counts,
+    checks: {
+      has_payment_gateways: (counts.PaymentGateway as number) > 0,
+      has_default_zone: (counts.ShippingZone as number) > 0,
+      taxes_enabled: settings.general?.enable_taxes ?? null,
+    },
+  };
+}
+
+/** Rebuild category/tag/shipping-class/attribute-term `count` fields from products. */
+async function recountTerms(sr: any): Promise<any> {
+  const products = await scanAll(sr.entities["commerce.Product"]);
+  const catCounts: Record<string, number> = {};
+  const tagCounts: Record<string, number> = {};
+  const classCounts: Record<string, number> = {};
+  const termCounts: Record<string, number> = {}; // `${attribute_id}::${option}`
+
+  for (const p of products) {
+    for (const c of p.category_ids ?? []) catCounts[c] = (catCounts[c] ?? 0) + 1;
+    for (const t of p.tag_ids ?? []) tagCounts[t] = (tagCounts[t] ?? 0) + 1;
+    if (p.shipping_class_id) classCounts[p.shipping_class_id] = (classCounts[p.shipping_class_id] ?? 0) + 1;
+    for (const a of p.attributes ?? []) {
+      if (!a.attribute_id) continue;
+      for (const opt of a.options ?? []) {
+        const key = `${a.attribute_id}::${String(opt).toLowerCase()}`;
+        termCounts[key] = (termCounts[key] ?? 0) + 1;
+      }
+    }
+  }
+
+  const updateCounts = async (entity: string, expected: Record<string, number>) => {
+    let updated = 0;
+    for (const rec of await scanAll(sr.entities[entity])) {
+      const want = expected[rec.id] ?? 0;
+      if ((rec.count ?? 0) !== want) {
+        await sr.entities[entity].update(rec.id, { count: want });
+        updated++;
+      }
+    }
+    return updated;
+  };
+
+  const categories = await updateCounts("commerce.ProductCategory", catCounts);
+  const tags = await updateCounts("commerce.ProductTag", tagCounts);
+  const classes = await updateCounts("commerce.ShippingClass", classCounts);
+
+  let terms = 0;
+  for (const term of await scanAll(sr.entities["commerce.ProductAttributeTerm"])) {
+    const want = termCounts[`${term.attribute_id}::${String(term.name).toLowerCase()}`] ?? 0;
+    if ((term.count ?? 0) !== want) {
+      await sr.entities["commerce.ProductAttributeTerm"].update(term.id, { count: want });
+      terms++;
+    }
+  }
+  return { updated: { categories, tags, shipping_classes: classes, attribute_terms: terms } };
+}
+
+/** Rebuild coupon usage_count/used_by from orders where usage was counted. */
+async function recountCouponUsage(sr: any): Promise<any> {
+  const orders = await scanAll(sr.entities["commerce.Order"], { coupon_usages_counted: true });
+  const usage: Record<string, string[]> = {};
+  for (const o of orders) {
+    const email = (o.billing?.email ?? "").toLowerCase();
+    for (const cl of o.coupon_lines ?? []) {
+      const code = (cl.code ?? "").toLowerCase();
+      if (!code) continue;
+      (usage[code] ??= []).push(email);
+    }
+  }
+  let updated = 0;
+  for (const coupon of await scanAll(sr.entities["commerce.Coupon"])) {
+    const uses = usage[coupon.code] ?? [];
+    if ((coupon.usage_count ?? 0) !== uses.length) {
+      await sr.entities["commerce.Coupon"].update(coupon.id, { usage_count: uses.length, used_by: uses });
+      updated++;
+    }
+  }
+  return { coupons_updated: updated };
+}
+
+async function recalcAllCustomerStats(sr: any): Promise<any> {
+  const customers = await scanAll(sr.entities["commerce.Customer"]);
+  const orders = await scanAll(sr.entities["commerce.Order"]);
+  const byCustomer = new Map<string, any[]>();
+  for (const o of orders) {
+    if (!o.customer_id) continue;
+    (byCustomer.get(o.customer_id) ?? byCustomer.set(o.customer_id, []).get(o.customer_id))!.push(o);
+  }
+
+  let updated = 0;
+  for (const c of customers) {
+    const own = byCustomer.get(c.id) ?? [];
+    const counted = own.filter((o) => !["cancelled", "failed"].includes(o.status));
+    const paid = own.filter((o) => o.date_paid || ["processing", "completed"].includes(o.status));
+    const totalSpent = round2(paid.reduce((a, o) => a + (o.total ?? 0) - (o.total_refunded ?? 0), 0));
+    const patch = {
+      orders_count: counted.length,
+      total_spent: totalSpent,
+      is_paying_customer: totalSpent > 0,
+    };
+    if (patch.orders_count !== (c.orders_count ?? 0) || patch.total_spent !== (c.total_spent ?? 0)) {
+      await sr.entities["commerce.Customer"].update(c.id, patch);
+      updated++;
+    }
+  }
+  return { customers_updated: updated };
+}
+
+async function pruneDeliveries(sr: any, payload: any): Promise<any> {
+  const keepDays = Number(payload.keep_days ?? 30);
+  const cutoff = new Date(Date.now() - keepDays * 86_400_000).toISOString();
+  const deliveries = await scanAll(sr.entities["commerce.WebhookDelivery"], null, "created_date");
+  let deleted = 0;
+  for (const d of deliveries) {
+    if (d.created_date < cutoff) {
+      await sr.entities["commerce.WebhookDelivery"].delete(d.id);
+      deleted++;
+    }
+  }
+  return { deleted, cutoff };
+}
+
+async function clearCarts(sr: any, payload: any): Promise<any> {
+  const olderThanDays = Number(payload.older_than_days ?? 30);
+  const cutoff = new Date(Date.now() - olderThanDays * 86_400_000).toISOString();
+  const carts = await scanAll(sr.entities["commerce.Cart"], null, "created_date");
+  let deleted = 0;
+  for (const cart of carts) {
+    const stale = (cart.updated_date ?? cart.created_date) < cutoff;
+    if (stale || cart.status === "converted") {
+      await sr.entities["commerce.Cart"].delete(cart.id);
+      deleted++;
+    }
+  }
+  return { deleted, cutoff };
+}
+
+async function regenPermissions(sr: any, payload: any): Promise<any> {
+  const order = await sr.entities["commerce.Order"].get(payload.order_id);
+  if (!order) throw new HttpError(404, "Order not found", "not_found");
+  await revokeDownloadPermissions(sr, order);
+  const granted = await grantDownloadPermissions(sr, order);
+  await sr.entities["commerce.Order"].update(order.id, { download_permissions_granted: granted > 0 });
+  return { granted };
+}

package/base44/functions/commerce/admin-webhooks/entry.ts

@@ -0,0 +1,52 @@
+/**
+ * commerce/admin-webhooks — test pings and redelivery for webhook endpoints.
+ * (Webhook CRUD itself is direct entity access — admin-only RLS.)
+ *
+ * Actions: test | redeliver
+ */
+import { createClientFromRequest } from "npm:@base44/sdk";
+import { HttpError, requireAdmin } from "../../../shared/commerce/auth.ts";
+import { deliverOne } from "../../../shared/commerce/webhooks.ts";
+
+const ok = (data: unknown, status = 200) => Response.json({ success: true, data }, { status });
+const fail = (status: number, error: string, code?: string) =>
+  Response.json({ success: false, error, code }, { status });
+
+Deno.serve(async (req) => {
+  try {
+    const base44 = createClientFromRequest(req);
+    await requireAdmin(base44);
+    const sr = base44.asServiceRole;
+    const { action, ...payload } = await req.json();
+
+    switch (action) {
+      case "test": {
+        const hook = await sr.entities["commerce.Webhook"].get(payload.webhook_id);
+        if (!hook) throw new HttpError(404, "Webhook not found", "not_found");
+        const result = await deliverOne(sr, hook, hook.topic, {
+          webhook_id: hook.id,
+          topic: hook.topic,
+          test: true,
+          timestamp: new Date().toISOString(),
+        });
+        return ok(result);
+      }
+      case "redeliver": {
+        const delivery = await sr.entities["commerce.WebhookDelivery"].get(payload.delivery_id);
+        if (!delivery) throw new HttpError(404, "Delivery not found", "not_found");
+        const hook = await sr.entities["commerce.Webhook"].get(delivery.webhook_id);
+        if (!hook) throw new HttpError(404, "Webhook no longer exists", "not_found");
+        let body: unknown = {};
+        try { body = JSON.parse(delivery.request_body || "{}"); } catch { body = { raw: delivery.request_body }; }
+        const result = await deliverOne(sr, hook, delivery.topic || hook.topic, body);
+        return ok(result);
+      }
+      default:
+        return fail(400, `Unknown action: ${action}`, "unknown_action");
+    }
+  } catch (e) {
+    if (e instanceof HttpError) return fail(e.status, e.message, e.code);
+    console.error("commerce/admin-webhooks error:", e);
+    return fail(500, (e as Error).message ?? "Internal error");
+  }
+});