AMS Studio ERP turns WordPress into the back office of a small company. Quotes, invoices,\npurchase orders, stock, deals, documents, treasury and accounting all live in your\nown database, on your own server. There is no service to subscribe to and no second\npassword to remember.<\/p>\n\n
The document chain<\/strong><\/p>\n\n Nothing is retyped from one step to the next. A quote becomes an invoice, the invoice\ncalls for its payment, the payment produces its ledger entry, and every document keeps\nthe link back to the one it came from.<\/p>\n\n What holds up under audit<\/strong><\/p>\n\n These rules live in the engine, and the plugin refuses whatever breaks them.<\/p>\n\n What this plugin does<\/strong><\/p>\n\n What it does not do<\/strong><\/p>\n\n Purchasing, stock, deals, treasury, accounting, the document library and the\nWooCommerce bridge are not part of this plugin<\/strong>. They come with AMS Studio Pro, a\nseparate add-on installed alongside it and distributed from https:\/\/www.ams-studio.lu\/<\/p>\n\n Nothing here is capped, time-limited or waiting for a key: what you install is\ncomplete. The modules above are simply not in this package \u2014 the menu shows them so\nyou know they exist, and says where to get them.<\/p>\n\n Languages<\/strong><\/p>\n\n French and English. The plugin follows your site's language, or its own if you ask it to \u2014\nan English site can run a French ERP.<\/p>\n\n Producing an invoice as a PDF needs an HTML-to-PDF engine, and WordPress core\nhas none. Four libraries are bundled, unmodified except where noted, each with\nits own licence file in its directory \u2014 all GPL-compatible:<\/p>\n\n They are bundled rather than pulled by Composer because the plugin must install\nfrom the WordPress admin, on shared hosting, with no command line. Their\nnamespaces are prefixed under dompdf's fifth dependency, php-svg-lib, is deliberately not<\/strong> bundled. It\nexists only to draw SVG images inside a PDF, and drawing one means parsing XML\nthat a site user supplied. The plugin does not need it \u2014 logos are PNG, JPEG,\nGIF or WebP, and an SVG is refused at upload \u2014 so the smaller attack surface is\nworth more than the feature. The three places where dompdf reached for it are\nneutralised in place, and an SVG is simply not a recognised image type any\nmore.<\/p>\n\n One more deviation is replayed automatically rather than by hand: in\nphp-font-lib, The admin interface is a React\/TypeScript application, compiled with Vite. The\ncompiled, minified bundle is in The same sources are publicly available at https:\/\/github.com\/SanMat11\/wp-erpx<\/p>\n\n To rebuild the bundle \u2014 Node.js 18 or 20 and later, verified with Node.js 22:<\/p>\n\n 5.9, then builds them with Vite 5.4 into Vite writes the entry point as Nothing about the plugin requires npm at runtime. The bundle is committed and\nshipped because the target audience installs from the WordPress admin, on shared\nhosting, with no command line.<\/p>\n\n VIES \u2014 EU VAT number validation<\/strong> (European Commission)<\/p>\n\n Used only when you click \"check\" beside an EU VAT number, to confirm that the number\nexists. What is sent: the country code and the VAT number, in the request URL. Nothing\nelse \u2014 no company name, no site address, no identifier.\nService: https:\/\/ec.europa.eu\/taxation_customs\/vies\/\nTerms and privacy: https:\/\/ec.europa.eu\/taxation_customs\/vies\/#\/help<\/p>\n\n Stripe \u2014 card payment of your invoices<\/strong> (Stripe, Inc.)<\/p>\n\n Used only if you enter your own Stripe API keys in the settings. It lets a customer of\nyours pay a shared invoice by card. What is sent, when your customer clicks \"pay\": the\namount, the currency, the invoice reference and the return address. The plugin never\nsends your customer list or your documents.\nService: https:\/\/stripe.com\/\nTerms: https:\/\/stripe.com\/legal\/ssa\nPrivacy: https:\/\/stripe.com\/privacy<\/p>\n\n AMS Studio licence server<\/strong> (AMS Studio, Luxembourg)<\/p>\n\n Only reached if you click \"Upgrade to Pro\" in the application header. That button is a\nlink: your browser opens it, the plugin itself opens no connection and sends nothing on\nits own. What travels in that link: an installation identifier drawn at random on your\nsite, a one-way hash of a secret drawn with it, your site address and your admin email\naddress \u2014 so that the licence you buy is tied to this site and fills itself in when you\ninstall the paid package, with nothing to copy by hand. The hash cannot be reversed, and\nthe secret itself never appears in the link.\nNothing is sent if you never click the button, and nothing is sent on a schedule.\nService: https:\/\/licences.ams-studio.lu\/\nTerms and privacy: https:\/\/www.ams-studio.lu\/<\/p>\n\n The plugin contacts nothing else. No telemetry, no update server, no licence check.<\/p>\n\n\n No command line is required, and no account anywhere: the plugin ships its own\nautoloader and its own PDF engine. Two optional features do contact an outside\nservice when you use them \u2014 see \"External services\" below.<\/p>\n\n\n Your business data stays put. Documents, customers, articles and ledger entries live\nin your own database and are never sent anywhere.<\/p>\n\n Two features do reach outside, and only when you ask them to:<\/p>\n\n Both are documented in full under \"External services\" below.<\/p><\/dd>\n No. Dropping the tables requires adding Yes. Without a transactional engine, operations cannot be made atomic. The built-in\nhealth check reports it.<\/p><\/dd>\n No. Every feature in this package works, with no cap on the number of customers,\nquotes, invoices or articles, and no trial period.<\/p>\n\n Some modules \u2014 purchasing, stock, deals, treasury, accounting, the document library\nand the WooCommerce bridge \u2014 are not in this package at all. They ship with a separate\nadd-on. The menu lists them so you know they exist; they are not disabled code waiting\nfor a key.<\/p><\/dd>\n No. The plugin ships its own autoloader, its own PDF engine and its compiled\nadmin interface. Nothing. Deactivating stops the code from running; the tables, the documents and\nthe ledger stay exactly as they are, and reactivating picks up where you left\noff.<\/p><\/dd>\n The French plan comptable g\u00e9n\u00e9ral and the Luxembourg plan comptable normalis\u00e9 2020.\nAccounts, journals and financial years are all editable.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
\n
Third-party libraries<\/h3>\n\n
\n
AMSBM\\Vendor\\<\/code> with PHP-Scoper, so that two\nplugins bundling dompdf in different versions cannot break each other; the\nprefixing is reproducible with bin\/scoper.sh<\/code>. Every other deviation from the\nupstream code is marked in place and listed in lib\/pdf\/ECARTS.md<\/code>: a direct-access guard on the two files that carry code\noutside a class, embedding a Factur-X XML attachment into a PDF\/A-3 file which\ndompdf does not support upstream, heredoc blocks rewritten as concatenation,\nand the removal of SVG rendering.<\/p>\n\nglyf::toHTML()<\/code> \u2014 a font-debugging method that builds an HTML\npage with inline scripts \u2014 is emptied. Neither dompdf nor the plugin calls it.\n bin\/pdf-patches.php applies that change after every copy of the libraries\n(bin\/vendor-pdf.sh<\/code>) and again after prefixing (bin\/scoper.sh<\/code>), and the\npackage build (build-zip.sh<\/code>) refuses to proceed if it is missing.<\/p>\n\nCompiled admin interface<\/h3>\n\n
app\/build\/<\/code>; its unminified sources ship with\nthe plugin<\/strong>, in app\/src\/<\/code>, along with everything needed to rebuild it:\n app\/package.json, app\/package-lock.json<\/code>, app\/tsconfig.json<\/code>,\n app\/tsconfig.node.json, app\/vite.config.ts<\/code>, app\/tailwind.config.js<\/code> and\n app\/postcss.config.js.<\/p>\n\ncd app && npm ci && npm run build\n\nnpm ci installs the exact dependency versions recorded in\napp\/package-lock.json. `npm run build` type-checks the sources with TypeScript\n<\/code><\/pre>\n\napp\/build\/<\/code>. The file\n app\/build\/morceaux\/vendor-[hash].js is the npm dependencies listed in\n app\/package.json \u2014 React, Ant Design and the others \u2014 bundled together by\nVite; each package's name and exact version are in app\/package-lock.json<\/code>.<\/p>\n\namsbm-app-[hash].js<\/code> and amsbm-app-[hash].css<\/code>,\nwith the code split into chunks under app\/build\/morceaux\/<\/code>. The hash in the\nfilename is the version: a new build produces a new name, so a cached file is\nnever a stale one. app\/build\/manifeste.json<\/code> records the current pair, and the\nplugin reads it rather than guessing.<\/p>\n\nExternal services<\/h3>\n\n
\n
\n
Is my data sent anywhere?<\/h3><\/dt>\n
\n
Is my data deleted when I uninstall?<\/h3><\/dt>\n
define( 'AMSBM_REMOVE_ALL_DATA', true );<\/code> to\nyour wp-config.php<\/code>. Accounting retention obligations \u2014 six years in France, up to ten\nelsewhere in Europe \u2014 outlast the lifetime of any plugin.<\/p><\/dd>\nDoes it need InnoDB?<\/h3><\/dt>\n
Are any features locked or limited?<\/h3><\/dt>\n
Do I need Composer or npm to install this?<\/h3><\/dt>\n
composer.json<\/code> and the JavaScript sources are included so that\nthe build is reproducible and the dependencies are auditable, not because\nanything has to be run.<\/p><\/dd>\nWhat happens to my data if I deactivate the plugin?<\/h3><\/dt>\n
Which chart of accounts is supported?<\/h3><\/dt>\n
0.5.25<\/h4>\n\n
\n
0.5.24<\/h4>\n\n
\n
load_plugin_textdomain()<\/code>, says why it\nstays: the plugin ships its own English catalogue, which WordPress only finds\nthrough that call.<\/li>\n<\/ul>\n\n0.5.23<\/h4>\n\n
\n
wp_enqueue_script()<\/code>, or printed with\n wp_print_inline_script_tag() on the standalone print page. The \"copy backup\ncodes\" button, which copied nothing, now copies.<\/li>\n0.5.22<\/h4>\n\n
\n
app\/src\/<\/code> can be rebuilt from\nthe plugin package alone again. A screen that is not part of this package was\nimported unconditionally, so npm run build<\/code> stopped on a missing file; it is\nnow loaded only where its file exists.<\/li>\n0.5.21<\/h4>\n\n
\n
bon pour accord<\/code>, while\nthe refusal message told English customers to type \"Agreed and accepted\". They\ntyped exactly what was asked and were turned away. The expected wording now\nfollows the language of the site, and French stays accepted so agreements\ngiven before a language change remain valid.<\/li>\n0.5.20<\/h4>\n\n
\n
ams-studio-erp-invoicing-accounting<\/code>, matching the\nslug registered on WordPress.org. It was ams-studio-business-management<\/code> on\n1155 i18n calls, which prevented the plugin from being translated through\ntranslate.wordpress.org. The PHP prefix amsbm_<\/code>, the option, table, post\ntype and REST namespace names are unchanged, as is the main file name.<\/li>\nbin\/i18n\/<\/code> was named\n amsbm-.po, which matched no text domain \u2014 WordPress would never\nhave loaded it. It now carries the domain, as the format requires.<\/li>\n<\/ul>\n\n0.5.19<\/h4>\n\n
\n
0.5.18<\/h4>\n\n
\n
AMSBM\\Vendor\\<\/code> namespace,\nprefixed with PHP-Scoper. Two plugins bundling dompdf in different versions\ncan no longer break each other. A document renders byte-for-byte as before.<\/li>\n<\/ul>\n\n0.5.17<\/h4>\n\n
\n
wp_print_inline_script_tag()<\/code>, which\ncarries the page's Content-Security-Policy nonce where there is one. It stays\na JSON data block, not executable code. Nothing changes on screen.<\/li>\n<\/ul>\n\n0.5.16<\/h4>\n\n
\n
0.5.15<\/h4>\n\n
\n
wpdb::prepare()<\/code>, with no exception.\nTable and column names are bound with the %i<\/code> placeholder instead of being\ninterpolated into the query string, and the plugin's own table names are checked\nagainst a hard-coded list before any query is built. Nothing changes on screen:\nthe 132 read routes return byte-for-byte identical answers.<\/li>\n<\/ul>\n\n0.5.14<\/h4>\n\n
\n
0.5.13<\/h4>\n\n
\n
lib\/pdf\/ECARTS.md<\/code>.<\/li>\n<\/ul>\n\n0.5.12<\/h4>\n\n
\n
0.5.11<\/h4>\n\n
\n
0.5.10<\/h4>\n\n
\n
0.5.9<\/h4>\n\n
\n
0.5.8<\/h4>\n\n
\n
0.5.7<\/h4>\n\n
\n
0.5.6<\/h4>\n\n
\n
0.5.5<\/h4>\n\n
\n
0.5.4<\/h4>\n\n
\n
0.5.3<\/h4>\n\n
\n
0.5.2<\/h4>\n\n
\n
0.5.1<\/h4>\n\n
\n
0.5.0<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n