AMS Studio ERP — Invoicing & Accounting

AMS Studio ERP turns WordPress into the back office of a small company. Quotes, invoices,
purchase orders, stock, deals, documents, treasury and accounting all live in your
own database, on your own server. There is no service to subscribe to and no second
password to remember.

The document chain

Nothing is retyped from one step to the next. A quote becomes an invoice, the invoice
calls for its payment, the payment produces its ledger entry, and every document keeps
the link back to the one it came from.

• Quotes sent by email with their PDF, then signed online by the customer
• Invoices numbered in a continuous, chronological series
• Payments entered by hand or matched to an imported bank statement
• Ledger entries posted to the right journal and financial year

What holds up under audit

These rules live in the engine, and the plugin refuses whatever breaks them.

• Numbering stays continuous: a prefix already in use cannot change, and a reopened
  document keeps its number
• An approved document is sealed by a fingerprint over its amounts, its party and its
  number; a mistake is corrected by a credit note, never by editing
• VAT is broken down by rate, as the law requires on the document itself
• Factur-X (PDF/A-3) and Peppol BIS Billing 3.0; a non-compliant invoice refuses to go
  out, in print, by email and on the public page
• Attachments are encrypted with AES-256-GCM, outside the public media library
• Exact decimal arithmetic throughout, never floating point

What this plugin does

• Customers: records, addresses, contacts, categories
• Catalogue: products and services, purchase and sale prices, margins, VAT rates
• Quotes: drafted, sent by email with their PDF, signed online by the customer
• Customer invoices and credit notes: continuous numbering, deposits, payment terms,
  what is paid and what remains due
• Factur-X (PDF/A-3) and Peppol BIS Billing 3.0 on every invoice
• Encrypted attachments, exact decimal arithmetic, an audit trail on every document

What it does not do

Purchasing, stock, deals, treasury, accounting, the document library and the
WooCommerce bridge are not part of this plugin. They come with AMS Studio Pro, a
separate add-on installed alongside it and distributed from https://www.ams-studio.lu/

Nothing here is capped, time-limited or waiting for a key: what you install is
complete. The modules above are simply not in this package — the menu shows them so
you know they exist, and says where to get them.

Languages

French and English. The plugin follows your site’s language, or its own if you ask it to —
an English site can run a French ERP.

Third-party libraries

Producing an invoice as a PDF needs an HTML-to-PDF engine, and WordPress core
has none. Four libraries are bundled, unmodified except where noted, each with
its own licence file in its directory — all GPL-compatible:

• dompdf/dompdf 3.1.6 — LGPL-2.1 — https://github.com/dompdf/dompdf
• masterminds/html5 — MIT — https://github.com/Masterminds/html5-php
• sabberworm/php-css-parser — MIT — https://github.com/MyIntervals/PHP-CSS-Parser
• php-font-lib — LGPL-2.1 — https://github.com/dompdf/php-font-lib

They are bundled rather than pulled by Composer because the plugin must install
from the WordPress admin, on shared hosting, with no command line. Their
namespaces are prefixed under AMSBM\Vendor\ with PHP-Scoper, so that two
plugins bundling dompdf in different versions cannot break each other; the
prefixing is reproducible with bin/scoper.sh. Every other deviation from the
upstream code is marked in place and listed in lib/pdf/ECARTS.md: a direct-access guard on the two files that carry code
outside a class, embedding a Factur-X XML attachment into a PDF/A-3 file which
dompdf does not support upstream, heredoc blocks rewritten as concatenation,
and the removal of SVG rendering.

dompdf’s fifth dependency, php-svg-lib, is deliberately not bundled. It
exists only to draw SVG images inside a PDF, and drawing one means parsing XML
that a site user supplied. The plugin does not need it — logos are PNG, JPEG,
GIF or WebP, and an SVG is refused at upload — so the smaller attack surface is
worth more than the feature. The three places where dompdf reached for it are
neutralised in place, and an SVG is simply not a recognised image type any
more.

One more deviation is replayed automatically rather than by hand: in
php-font-lib, glyf::toHTML() — a font-debugging method that builds an HTML
page with inline scripts — is emptied. Neither dompdf nor the plugin calls it.
bin/pdf-patches.php applies that change after every copy of the libraries
(bin/vendor-pdf.sh) and again after prefixing (bin/scoper.sh), and the
package build (build-zip.sh) refuses to proceed if it is missing.

Compiled admin interface

The admin interface is a React/TypeScript application, compiled with Vite. The
compiled, minified bundle is in app/build/; its unminified sources ship with
the plugin, in app/src/, along with everything needed to rebuild it:
app/package.json, app/package-lock.json, app/tsconfig.json,
app/tsconfig.node.json, app/vite.config.ts, app/tailwind.config.js and
app/postcss.config.js.

The same sources are publicly available at https://github.com/SanMat11/wp-erpx

To rebuild the bundle — Node.js 18 or 20 and later, verified with Node.js 22:

cd app && npm ci && npm run build

npm ci installs the exact dependency versions recorded in
app/package-lock.json. `npm run build` type-checks the sources with TypeScript

5.9, then builds them with Vite 5.4 into app/build/. The file
app/build/morceaux/vendor-[hash].js is the npm dependencies listed in
app/package.json — React, Ant Design and the others — bundled together by
Vite; each package’s name and exact version are in app/package-lock.json.

Vite writes the entry point as amsbm-app-[hash].js and amsbm-app-[hash].css,
with the code split into chunks under app/build/morceaux/. The hash in the
filename is the version: a new build produces a new name, so a cached file is
never a stale one. app/build/manifeste.json records the current pair, and the
plugin reads it rather than guessing.

Nothing about the plugin requires npm at runtime. The bundle is committed and
shipped because the target audience installs from the WordPress admin, on shared
hosting, with no command line.

External services

VIES — EU VAT number validation (European Commission)

Used only when you click “check” beside an EU VAT number, to confirm that the number
exists. What is sent: the country code and the VAT number, in the request URL. Nothing
else — no company name, no site address, no identifier.
Service: https://ec.europa.eu/taxation_customs/vies/
Terms and privacy: https://ec.europa.eu/taxation_customs/vies/#/help

Stripe — card payment of your invoices (Stripe, Inc.)

Used only if you enter your own Stripe API keys in the settings. It lets a customer of
yours pay a shared invoice by card. What is sent, when your customer clicks “pay”: the
amount, the currency, the invoice reference and the return address. The plugin never
sends your customer list or your documents.
Service: https://stripe.com/
Terms: https://stripe.com/legal/ssa
Privacy: https://stripe.com/privacy

AMS Studio licence server (AMS Studio, Luxembourg)

Only reached if you click “Upgrade to Pro” in the application header. That button is a
link: your browser opens it, the plugin itself opens no connection and sends nothing on
its own. What travels in that link: an installation identifier drawn at random on your
site, a one-way hash of a secret drawn with it, your site address and your admin email
address — so that the licence you buy is tied to this site and fills itself in when you
install the paid package, with nothing to copy by hand. The hash cannot be reversed, and
the secret itself never appears in the link.
Nothing is sent if you never click the button, and nothing is sent on a schedule.
Service: https://licences.ams-studio.lu/
Terms and privacy: https://www.ams-studio.lu/

The plugin contacts nothing else. No telemetry, no update server, no licence check.