@blamejs/blamejs-shop 0.2.27 → 0.2.28

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.28 (2026-05-29) — **Sales reports and printable receipts in the admin console.** The admin console gains a Reports screen and printable order documents. Reports aggregates a sales and revenue summary over a date range you choose — order count, gross and net revenue, refunds, average order value, an order-status funnel, a by-day revenue table, and top products — with a CSV export of the daily series. Every order detail page now offers a printable receipt and a printable packing slip (print-optimized, carrying your shop name and contact), so you can pull a revenue report or print an order without querying the database directly. **Added:** *Reports screen* — `/admin/reports` aggregates a sales/revenue summary over a selectable date range: order count, gross and net revenue, refunds and refund rate, average order value, an order-status funnel, a by-day revenue table, and top products. The daily series exports to CSV. The screen reads only — it never writes. · *Printable receipts and packing slips* — `GET /admin/orders/:id/receipt` and `GET /admin/orders/:id/packing-slip` render self-contained, print-optimized order documents (lines, totals, ship-to, tracking barcode) with your shop name and contact in the masthead. Both are linked from a Documents panel on the admin order detail screen.
+
 - v0.2.27 (2026-05-29) — **Upload product images directly from the admin console.** The admin product media manager can now take an image file uploaded straight from your device, in addition to attaching one by URL. On the product detail screen, pick a PNG, JPEG, WebP, GIF, AVIF, or SVG and it streams to object storage and attaches to the product (or a specific variant) in one step. Every upload is validated by both its declared content type and its actual magic bytes — a mismatched or disguised file is refused — and capped at 10 MiB. The upload surface is only present when object storage is configured, so a store without it sees no change. **Added:** *Direct image-file upload in the admin product media manager* — A file picker on the admin product detail screen accepts a local image (`multipart/form-data`) alongside the existing attach-by-URL field. The file is content-type- and magic-byte-validated (png/jpeg/webp/gif/avif/svg), size-capped at 10 MiB, streamed to the object-storage bridge, and attached to the product or variant. JSON API: `POST /admin/products/:id/media/upload-file` and `POST /admin/media/upload-file`. The routes mount only when the object-storage bridge is configured.
 
 - v0.2.26 (2026-05-29) — **Update the vendored blamejs runtime to v0.13.44.** The bundled blamejs runtime moves from v0.13.0 to v0.13.44, carrying a run of upstream security and reliability fixes through the crypto, storage, and middleware layers the shop is built on, with no API or configuration changes. Highlights: DNSSEC validation now bounds the work spent on colliding keys and signatures (KeyTrap / NSEC3 resource-exhaustion defense); a sealed database column that fails to unseal now returns null instead of risking forged or cross-row ciphertext; the encrypted database gains a temporary-storage free-space guard and a shutdown watchdog that preserves the final flush on exit; S/MIME chain verification binds the leaf certificate to the verifying signer key; archive extraction refuses Windows reserved and alternate-data-stream path names; and the replay-nonce store is memory-capped and fails closed under flood. **Changed:** *Database reliability under low temporary storage* — The encrypted database now refuses growth-writes with a clear error when its temporary storage drops below a safety headroom (rather than risking corruption), and a shutdown watchdog preserves the final database flush if a shutdown phase hangs. Both harden the container restart path. **Security:** *Bundled blamejs runtime updated to v0.13.44* — Pulls in the upstream security fixes accumulated since v0.13.0: DNSSEC KeyTrap / NSEC3 work caps, sealed-column null-on-unseal-failure (no forged or cross-row ciphertext), S/MIME leaf-to-signer binding, archive-extraction rejection of Windows reserved / alternate-data-stream names, static-file sibling-prefix path containment, and a memory-capped, fail-closed replay-nonce store. No API or configuration changes are required.

package/lib/admin.js

@@ -371,10 +371,16 @@ function mount(router, deps) {
   var returns       = deps.returns       || null;   // RMA moderation endpoints disabled when absent
   var customers     = deps.customers     || null;   // read-only customers console disabled when absent
   var orderTracking = deps.orderTracking || null;   // shipment/tracking panel disabled when absent
+  var salesReports  = deps.salesReports  || null;   // /admin/reports degrades to an unconfigured notice when absent
+  var printReceipts = deps.printReceipts || null;   // order receipt document disabled when absent
+  var packingSlips  = deps.packingSlips  || null;   // order packing-slip document disabled when absent
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
+  // `reports` is always present in the nav (read-only sales summary needs no
+  // extra dep); its route mounts unconditionally and renders an unconfigured
+  // notice when the salesReports primitive isn't wired.
   var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
@@ -1379,6 +1385,10 @@ function mount(router, deps) {
         // Shipment/tracking panel only renders when the tracking primitive
         // is wired; the carrier + status enums drive its form selects.
         can_track:   !!orderTracking,
+        // Printable-document links — shown only when the render primitive is
+        // wired (its route is mounted only then).
+        can_receipt:      !!printReceipts,
+        can_packing_slip: !!packingSlips,
         shipments:   shipments,
         carriers:    orderTracking ? orderTracking.CARRIERS : null,
         statuses:    orderTracking ? orderTracking.STATUSES : null,
@@ -3160,6 +3170,288 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- reporting ------------------------------------------------------
+  //
+  // A sales/revenue report over a selectable date range: order count,
+  // gross/net revenue, refunds, AOV, top products, broken down by day and
+  // by status. Aggregated from the salesReports primitive (pure read-only
+  // SQL over orders/order_lines). The route mounts unconditionally so the
+  // always-present "Reports" nav link never points at a missing route; when
+  // the salesReports primitive isn't wired it renders an unconfigured
+  // notice. CSV export of the by-day series is exposed via `?format=csv`.
+  //
+  // Date range: `from`/`to` are epoch-ms query params (defaults to the last
+  // 30 days). A malformed range re-renders the page with a 400 + the
+  // validator's message rather than crashing — the report is config/entry
+  // tier, so a bad operator-typed range surfaces as a correction, not a 500.
+
+  // Parse a "YYYY-MM-DD" calendar-date param to the epoch-ms at UTC
+  // midnight. Returns null when the param is absent; throws TypeError on a
+  // malformed value so the config/entry-tier 400 path catches it. The
+  // browser date <input> submits this shape; the JSON API can use either
+  // this or the raw epoch-ms `from`/`to`.
+  function _parseDateParam(str, label) {
+    if (str == null || str === "") return null;
+    if (typeof str !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(str)) {
+      throw new TypeError("admin: " + label + " must be a YYYY-MM-DD date");
+    }
+    var ms = Date.parse(str + "T00:00:00Z");
+    if (!isFinite(ms)) throw new TypeError("admin: " + label + " is not a valid date");
+    return ms;
+  }
+
+  // Resolve the report window from the query string. Returns
+  // `{ from, to }` (epoch-ms) or throws TypeError on a malformed value.
+  // Accepts either the raw epoch-ms `from`/`to` pair (machine clients) or
+  // the calendar-date `from-date`/`to-date` pair (the browser date inputs);
+  // the epoch-ms form wins when both are present. Defaults: to = now,
+  // from = now - 30d. The salesReports primitive re-validates (from < to,
+  // span ≤ 1y), so this only coerces the shape.
+  function _reportWindow(url) {
+    var from = _parseEpochMs(url && url.searchParams.get("from"), "from");
+    var to   = _parseEpochMs(url && url.searchParams.get("to"),   "to");
+    if (from == null) from = _parseDateParam(url && url.searchParams.get("from-date"), "from");
+    // `to-date` is the inclusive end day — advance to the next UTC midnight
+    // so the window covers the whole selected day (salesReports treats `to`
+    // as exclusive: `updated_at < to`).
+    if (to == null) {
+      var toDate = _parseDateParam(url && url.searchParams.get("to-date"), "to");
+      if (toDate != null) to = toDate + b.constants.TIME.days(1);
+    }
+    var now  = Date.now();
+    return {
+      to:   to   == null ? now : to,
+      from: from == null ? (now - b.constants.TIME.days(30)) : from,
+    };
+  }
+
+  // Aggregate the report payload from the salesReports primitive. Composes
+  // the by-day revenue series, AOV, refund rate, the status funnel, and the
+  // top products into one object the HTML + CSV + JSON surfaces all read.
+  async function _buildReport(win) {
+    var byDay  = await salesReports.revenueByDay({ from: win.from, to: win.to });
+    var aov    = await salesReports.aov({ from: win.from, to: win.to });
+    var refund = await salesReports.refundRate({ from: win.from, to: win.to });
+    var funnel = await salesReports.funnel({ from: win.from, to: win.to });
+    var top    = await salesReports.topProducts({ from: win.from, to: win.to, limit: 10 });
+
+    // Headline totals from the by-day series — gross/net/refunds summed
+    // across every currency bucket in the window. The per-currency split
+    // stays on the by-day rows for the operator who needs it; the headline
+    // is the single-number summary a dashboard leads with.
+    var orderCount = 0, gross = 0, net = 0, refunds = 0;
+    var currency = (aov && aov.currency) || "USD";
+    for (var i = 0; i < byDay.length; i += 1) {
+      var row = byDay[i];
+      orderCount += row.order_count;
+      gross      += row.gross_revenue_minor;
+      net        += row.net_revenue_minor;
+      refunds    += row.refund_total_minor;
+    }
+    return {
+      from:                win.from,
+      to:                  win.to,
+      currency:            currency,
+      order_count:         orderCount,
+      gross_revenue_minor: gross,
+      net_revenue_minor:   net,
+      refund_total_minor:  refunds,
+      aov_minor:           (aov && aov.aov_minor) || 0,
+      refund_rate_bps:     (refund && refund.refund_rate_bps) || 0,
+      by_day:              byDay,
+      by_status:           funnel,
+      top_products:        (top && top.rows) || [],
+    };
+  }
+
+  // CSV body for the by-day revenue series. Composes `b.csv.stringify`
+  // (RFC 4180) — the cell values are integer aggregates + ISO date buckets
+  // + 3-letter currency codes, all framework-internal (never raw
+  // operator/customer prose), so the RFC-4180 quoting is sufficient here;
+  // there is no untrusted free-text column that would require b.guardCsv's
+  // formula-injection defenses.
+  function _reportCsv(report) {
+    var rows = report.by_day.map(function (r) {
+      return {
+        date:                r.bucket_start,
+        currency:            r.currency,
+        order_count:         r.order_count,
+        gross_revenue_minor: r.gross_revenue_minor,
+        net_revenue_minor:   r.net_revenue_minor,
+        refund_total_minor:  r.refund_total_minor,
+      };
+    });
+    return b.csv.stringify(rows, {
+      columns: ["date", "currency", "order_count", "gross_revenue_minor", "net_revenue_minor", "refund_total_minor"],
+      header:  true,
+      eol:     "\n",
+    });
+  }
+
+  router.get("/admin/reports", _pageOrApi(true,
+    R(async function (req, res) {
+      if (!salesReports) return _problem(res, 503, "reporting-unconfigured", "the salesReports primitive is not wired");
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      // A malformed from/to surfaces as a 400 problem (config/entry tier).
+      var win;
+      try { win = _reportWindow(url); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      var report;
+      try { report = await _buildReport(win); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (url && url.searchParams.get("format") === "csv") {
+        res.status(200);
+        if (res.setHeader) {
+          res.setHeader("content-type", "text/csv; charset=utf-8");
+          res.setHeader("content-disposition", "attachment; filename=\"sales-report.csv\"");
+        }
+        var csv = _reportCsv(report);
+        if (res.end) res.end(csv); else res.send(csv);
+        return;
+      }
+      _json(res, 200, report);
+    }),
+    async function (req, res) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      if (!salesReports) {
+        return _sendHtml(res, 200, renderAdminReports({
+          shop_name: deps.shop_name, nav_available: navAvailable, report: null,
+          notice: "Reporting isn't configured on this deployment.",
+        }));
+      }
+      var win, notice = null;
+      try { win = _reportWindow(url); }
+      catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        // Bad range → re-render with the default window + a correction
+        // notice (config/entry tier: the operator fixes the typo).
+        win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        notice = e.message.replace(/^admin:\s*/, "");
+      }
+      // CSV download from the browser surface too (a link, not a fetch).
+      if (url && url.searchParams.get("format") === "csv") {
+        var report0;
+        try { report0 = await _buildReport(win); }
+        catch (e2) { if (!(e2 instanceof TypeError)) throw e2; report0 = null; }
+        if (report0) {
+          res.status(200);
+          if (res.setHeader) {
+            res.setHeader("content-type", "text/csv; charset=utf-8");
+            res.setHeader("content-disposition", "attachment; filename=\"sales-report.csv\"");
+          }
+          var csv0 = _reportCsv(report0);
+          if (res.end) res.end(csv0); else res.send(csv0);
+          return;
+        }
+      }
+      var report;
+      try { report = await _buildReport(win); }
+      catch (e3) {
+        if (!(e3 instanceof TypeError)) throw e3;
+        win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        notice = e3.message.replace(/^salesReports:\s*/, "");
+        report = await _buildReport(win);
+      }
+      _sendHtml(res, 200, renderAdminReports({
+        shop_name: deps.shop_name, nav_available: navAvailable, report: report, notice: notice,
+      }));
+    },
+  ));
+
+  // ---- printable order documents --------------------------------------
+  //
+  // Operator-facing receipt + packing slip for an order. These are the
+  // warehouse/fulfilment paper trail (the customer's own order page is a
+  // separate storefront surface — untouched here). Each renders clean,
+  // self-contained, print-optimized HTML the operator prints or pipes to a
+  // PDF. Mounted only when the corresponding render primitive is wired.
+  //
+  // Failure modes: a malformed order id (TypeError from the primitive's id
+  // reader) → 404; a missing order → 404. Only TypeError is swallowed to a
+  // 404 — any other error propagates to the 500 path.
+
+  // The receipt + packing-slip render primitives emit a self-contained
+  // document driven purely by the order; the shop's own name + contact live
+  // in shop_config, so we read them here and inject a small masthead at the
+  // top of the document `<body>`. Both renderers emit a literal "<body>\n"
+  // marker; the header slots in right after it. When config is unwired or
+  // the keys are unset, the document renders without a masthead (the order
+  // data alone is still a complete, valid document).
+  async function _shopMastheadHtml() {
+    if (!deps.config) return "";
+    var name = null, contact = null;
+    try {
+      name = await deps.config.get("shop.name", deps.shop_name || null);
+      // The setup wizard persists the operator's contact under
+      // "shop.contact_email"; fall back to the conventional
+      // "shop.support_email" key the config module documents.
+      contact = await deps.config.get("shop.contact_email", null);
+      if (contact == null) contact = await deps.config.get("shop.support_email", null);
+    } catch (_e) {
+      // Config read failure must not break the print document — degrade to
+      // no masthead rather than 500-ing the operator's print job.
+      return "";
+    }
+    if (!name && !contact) return "";
+    var parts = "";
+    if (name)    parts += "<strong>" + _htmlEscape(String(name)) + "</strong>";
+    if (contact) parts += (name ? "<br>" : "") + _htmlEscape(String(contact));
+    // Inline style is acceptable here: this document is served standalone
+    // (not under the admin console's strict style-src CSP) and is built for
+    // printing, where an external stylesheet round-trip is undesirable.
+    return "<div style=\"margin-bottom:8mm;font-size:11pt;\">" + parts + "</div>\n";
+  }
+
+  function _injectMasthead(html, masthead) {
+    if (!masthead) return html;
+    var marker = "<body>\n";
+    var at = html.indexOf(marker);
+    if (at === -1) return html;                                  // renderer changed shape — emit the doc unaltered
+    return html.slice(0, at + marker.length) + masthead + html.slice(at + marker.length);
+  }
+
+  if (printReceipts) {
+    router.get("/admin/orders/:id/receipt", async function (req, res) {
+      if (!_htmlAuthed(req, expectedToken)) {
+        if (req.method === "GET" || !req.method) return _sendHtml(res, 200, renderAdminLogin({ shop_name: deps.shop_name }));
+        return _problem(res, 401, "unauthorized");
+      }
+      var html;
+      try {
+        html = await printReceipts.htmlPdf({ order_id: req.params.id });
+      } catch (e) {
+        if (e instanceof TypeError) {
+          return _sendHtml(res, 404, renderAdminOrders({
+            shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
+          }));
+        }
+        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+      }
+      _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
+    });
+  }
+
+  if (packingSlips) {
+    router.get("/admin/orders/:id/packing-slip", async function (req, res) {
+      if (!_htmlAuthed(req, expectedToken)) {
+        if (req.method === "GET" || !req.method) return _sendHtml(res, 200, renderAdminLogin({ shop_name: deps.shop_name }));
+        return _problem(res, 401, "unauthorized");
+      }
+      var html;
+      try {
+        html = await packingSlips.renderHtml({ order_id: req.params.id });
+      } catch (e) {
+        if (e instanceof TypeError) {
+          return _sendHtml(res, 404, renderAdminOrders({
+            shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
+          }));
+        }
+        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+      }
+      _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
+    });
+  }
+
   // ---- analytics ------------------------------------------------------
 
   var analytics = deps.analytics || null;
@@ -4505,6 +4797,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "products",     href: "/admin/products",     label: "Products" },
   { key: "inventory",    href: "/admin/inventory",    label: "Inventory" },
   { key: "orders",       href: "/admin/orders",       label: "Orders" },
+  { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "returns",      href: "/admin/returns",      label: "Returns",      requires: "returns" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
@@ -4793,6 +5086,123 @@ function renderAdminOrders(opts) {
   return _renderAdminShell(opts.shop_name, "Orders", body, "orders", opts.nav_available);
 }
 
+// epoch-ms → "YYYY-MM-DD" for a date <input>'s value. Mirrors `_fmtDate`'s
+// guard so a bad value never throws inside the template.
+function _dateInputValue(v) {
+  var n = typeof v === "number" ? v : Date.parse(v);
+  if (!isFinite(n)) return "";
+  return new Date(n).toISOString().slice(0, 10);
+}
+
+// Sales/revenue report screen. Renders the headline totals (orders,
+// gross/net revenue, refunds, AOV, refund rate), the order-status funnel,
+// a by-day revenue table, and the top products — all for the selected
+// date range. A date-range form lets the operator retune the window; a CSV
+// link exports the by-day series. `opts.report` is null when reporting
+// isn't configured (renders the notice only).
+function renderAdminReports(opts) {
+  opts = opts || {};
+  var report = opts.report;
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  if (!report) {
+    var emptyBody = "<section><h2>Reports</h2>" + notice +
+      "<p class=\"empty\">No sales report available.</p></section>";
+    return _renderAdminShell(opts.shop_name, "Reports", emptyBody, "reports", opts.nav_available);
+  }
+
+  var fromVal = _dateInputValue(report.from);
+  // The window's `to` is exclusive (next UTC midnight after the operator's
+  // chosen end day); render the inclusive end day back into the date input
+  // by stepping one day back.
+  var toVal   = _dateInputValue(report.to - b.constants.TIME.days(1));
+
+  // Date-range form (GET so the window lives in the URL — bookmarkable +
+  // shareable). The browser submits calendar-date params; the CSV link
+  // carries the same window as raw epoch-ms.
+  var csvHref = "/admin/reports?format=csv" +
+    "&from=" + encodeURIComponent(String(report.from)) +
+    "&to="   + encodeURIComponent(String(report.to));
+  var rangeForm =
+    "<form method=\"get\" action=\"/admin/reports\" class=\"order-filters\">" +
+      "<label class=\"form-field\"><span>From</span><input type=\"date\" name=\"from-date\" value=\"" + _htmlEscape(fromVal) + "\"></label>" +
+      "<label class=\"form-field\"><span>To</span><input type=\"date\" name=\"to-date\" value=\"" + _htmlEscape(toVal) + "\"></label>" +
+      "<button class=\"btn\" type=\"submit\">Apply</button>" +
+      "<a class=\"btn btn--ghost\" href=\"" + _htmlEscape(csvHref) + "\">Export CSV</a>" +
+    "</form>";
+
+  // Headline stat cards. Money formats through the same pricing helper the
+  // dashboard + order pages use, in the report's headline currency.
+  var cur = report.currency;
+  var statsBlock =
+    "<section><h2>Summary</h2><div class=\"stat-grid\">" +
+      _statCard("Orders", String(report.order_count)) +
+      _statCard("Gross revenue", pricing.format(report.gross_revenue_minor, cur)) +
+      _statCard("Net revenue", pricing.format(report.net_revenue_minor, cur)) +
+      _statCard("Refunds", pricing.format(report.refund_total_minor, cur)) +
+      _statCard("Avg order value", pricing.format(report.aov_minor, cur)) +
+      _statCard("Refund rate", (report.refund_rate_bps / 100).toFixed(2) + "%") +
+    "</div></section>";
+
+  // Order-status funnel — each milestone counts orders that reached at
+  // least that stage within the window.
+  var f = report.by_status || {};
+  var funnelRows = [
+    ["Checkout started", f.checkout_started],
+    ["Payment intent created", f.payment_intent_created],
+    ["Paid", f.paid],
+    ["Fulfilled", f.fulfilled],
+    ["Refunded", f.refunded],
+  ].map(function (pair) {
+    return "<tr><td>" + _htmlEscape(pair[0]) + "</td><td class=\"num\">" + _htmlEscape(String(pair[1] == null ? 0 : pair[1])) + "</td></tr>";
+  }).join("");
+  var funnelBlock =
+    "<section><h2>Order status</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">Stage</th><th scope=\"col\" class=\"num\">Orders</th></tr></thead><tbody>" + funnelRows + "</tbody></table>" +
+    "</div></section>";
+
+  // Top products by gross revenue across the window.
+  var top = report.top_products || [];
+  var topRows = top.length
+    ? top.map(function (r) {
+        return "<tr><td>" + _htmlEscape(r.sku) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(r.units_sold)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.gross_revenue_minor, r.currency)) + "</td></tr>";
+      }).join("")
+    : "<tr><td colspan=\"3\" class=\"empty\">No sales in this window.</td></tr>";
+  var topBlock =
+    "<section><h2>Top products</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">SKU</th><th scope=\"col\" class=\"num\">Units</th><th scope=\"col\" class=\"num\">Revenue</th></tr></thead><tbody>" + topRows + "</tbody></table>" +
+    "</div></section>";
+
+  // By-day revenue series — one row per (day, currency) bucket.
+  var byDay = report.by_day || [];
+  var dayRows = byDay.length
+    ? byDay.map(function (r) {
+        return "<tr>" +
+          "<td>" + _htmlEscape(r.bucket_start) + "</td>" +
+          "<td>" + _htmlEscape(r.currency) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(r.order_count)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.gross_revenue_minor, r.currency)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.net_revenue_minor, r.currency)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.refund_total_minor, r.currency)) + "</td>" +
+          "</tr>";
+      }).join("")
+    : "<tr><td colspan=\"6\" class=\"empty\">No sales in this window.</td></tr>";
+  var dayBlock =
+    "<section><h2>By day</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">Date</th><th scope=\"col\">Currency</th><th scope=\"col\" class=\"num\">Orders</th><th scope=\"col\" class=\"num\">Gross</th><th scope=\"col\" class=\"num\">Net</th><th scope=\"col\" class=\"num\">Refunds</th></tr></thead><tbody>" + dayRows + "</tbody></table>" +
+    "</div></section>";
+
+  var body =
+    "<section><h2>Reports</h2>" + notice +
+      "<p class=\"meta\">Window: " + _htmlEscape(_fmtDate(report.from)) + " → " + _htmlEscape(_fmtDate(report.to)) + "</p>" +
+      rangeForm +
+    "</section>" +
+    statsBlock + funnelBlock + topBlock + dayBlock;
+  return _renderAdminShell(opts.shop_name, "Reports", body, "reports", opts.nav_available);
+}
+
 function renderAdminOrder(opts) {
   opts = opts || {};
   var o = opts.order;
@@ -4854,6 +5264,22 @@ function renderAdminOrder(opts) {
   }).filter(Boolean).join(" ");
   var actions = actionForms || "<span class=\"meta\">This order is in a final state — no further changes.</span>";
 
+  // Printable operator documents — a receipt + a packing slip, each opening
+  // the print-optimized HTML in a new tab. Rendered only when the matching
+  // render primitive is wired (the routes mount only then).
+  var docLinks = [];
+  if (opts.can_receipt) {
+    docLinks.push("<a class=\"btn btn--ghost\" href=\"/admin/orders/" + _htmlEscape(o.id) + "/receipt\" target=\"_blank\" rel=\"noopener\">Print receipt</a>");
+  }
+  if (opts.can_packing_slip) {
+    docLinks.push("<a class=\"btn btn--ghost\" href=\"/admin/orders/" + _htmlEscape(o.id) + "/packing-slip\" target=\"_blank\" rel=\"noopener\">Print packing slip</a>");
+  }
+  var documentsPanel = docLinks.length
+    ? "<div class=\"panel mt\"><h3 class=\"subhead\">Documents</h3>" +
+        "<div class=\"order-actions\">" + docLinks.join(" ") + "</div>" +
+      "</div>"
+    : "";
+
   // Shipment + tracking panel. Renders only when the tracking primitive is
   // wired (`can_track`). For each existing shipment: the carrier, status,
   // tracking number (linked to the carrier's public URL when known), and
@@ -4938,6 +5364,7 @@ function renderAdminOrder(opts) {
       "<div class=\"panel mt\"><h3 class=\"subhead\">Actions</h3>" +
         "<div class=\"order-actions\">" + actions + "</div>" +
       "</div>" +
+      documentsPanel +
       trackingPanel +
     "</section>";
   return _renderAdminShell(opts.shop_name, "Order " + o.id.slice(0, 8), body, "orders", opts.nav_available);

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.27",
+  "version": "0.2.28",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {