About this plugin
AMS Studio ERP turns WordPress into the back office of a small company. Quotes, invoices,
purchase orders, stock, deals, documents, treasury and accounting all live in your
own database, on your own server. There is no service to subscribe to and no second
password to remember.
The document chain
Nothing is retyped from one step to the next. A quote becomes an invoice, the invoice
calls for its payment, the payment produces its ledger entry, and every document keeps
the link back to the one it came from.
- Quotes sent by email with their PDF, then signed online by the customer
- Invoices numbered in a continuous, chronological series
- Payments entered by hand or matched to an imported bank statement
- Ledger entries posted to the right journal and financial year
What holds up under audit
These rules live in the engine, and the plugin refuses whatever breaks them.
- Numbering stays continuous: a prefix already in use cannot change, and a reopened
document keeps its number
- An approved document is sealed by a fingerprint over its amounts, its party and its
number; a mistake is corrected by a credit note, never by editing
- VAT is broken down by rate, as the law requires on the document itself
- Factur-X (PDF/A-3) and Peppol BIS Billing 3.0; a non-compliant invoice refuses to go
out, in print, by email and on the public page
- Attachments are encrypted with AES-256-GCM, outside the public media library
- Exact decimal arithmetic throughout, never floating point
What this plugin does
- Customers: records, addresses, contacts, categories
- Catalogue: products and services, purchase and sale prices, margins, VAT rates
- Quotes: drafted, sent by email with their PDF, signed online by the customer
- Customer invoices and credit notes: continuous numbering, deposits, payment terms,
what is paid and what remains due
- Factur-X (PDF/A-3) and Peppol BIS Billing 3.0 on every invoice
- Encrypted attachments, exact decimal arithmetic, an audit trail on every document
What it does not do
Purchasing, stock, deals, treasury, accounting, the document library and the
WooCommerce bridge are not part of this plugin. They come with AMS Studio Pro, a
lu/
Nothing here is capped, time-limited or waiting for a key: what you install is
complete. The modules above are simply not in this package — the menu shows them so
you know they exist, and says where to get them.
Languages
French and English. The plugin follows your site’s language, or its own if you ask it to —
an English site can run a French ERP.
Third-party libraries
Producing an invoice as a PDF needs an HTML-to-PDF engine, and WordPress core
has none. Four libraries are bundled, unmodified except where noted, each with
its own licence file in its directory — all GPL-compatible:
- dompdf/dompdf 3.1.6 — LGPL-2.1 — https://github.com/dompdf/dompdf
- masterminds/html5 — MIT — https://github.com/Masterminds/html5-php
- sabberworm/php-css-parser — MIT — https://github.com/MyIntervals/PHP-CSS-Parser
- php-font-lib — LGPL-2.1 — https://github.com/dompdf/php-font-lib
They are bundled rather than pulled by Composer because the plugin must install
from the WordPress admin, on shared hosting, with no command line. Their
namespaces are prefixed under AMSBM\Vendor\ with PHP-Scoper, so that two
plugins bundling dompdf in different versions cannot break each other; the
sh. Every other deviation from the
md: a direct-access guard on the two files that carry code
outside a class, embedding a Factur-X XML attachment into a PDF/A-3 file which
dompdf does not support upstream, heredoc blocks rewritten as concatenation,
and the removal of SVG rendering.
dompdf’s fifth dependency, php-svg-lib, is deliberately not bundled. It
exists only to draw SVG images inside a PDF, and drawing one means parsing XML
that a site user supplied. The plugin does not need it — logos are PNG, JPEG,
GIF or WebP, and an SVG is refused at upload — so the smaller attack surface is
worth more than the feature. The three places where dompdf reached for it are
neutralised in place, and an SVG is simply not a recognised image type any
more.
One more deviation is replayed automatically rather than by hand: in
php-font-lib, glyf::toHTML() — a font-debugging method that builds an HTML
page with inline scripts — is emptied. Neither dompdf nor the plugin calls it.
php applies that change after every copy of the libraries
sh ), and the
sh ) refuses to proceed if it is missing.
Compiled admin interface
The admin interface is a React/TypeScript application, compiled with Vite. The
compiled, minified bundle is in app/build/; its unminified sources ship with
the plugin, in app/src/, along with everything needed to rebuild it:
json,
js and
js.
com/SanMat11/wp-erpx
js 22:
cd app && npm ci && npm run build
json. `npm run build` type-checks the sources with TypeScript
4 into app/build/. The file
js is the npm dependencies listed in
json — React, Ant Design and the others — bundled together by
json.
css,
with the code split into chunks under app/build/morceaux/. The hash in the
filename is the version: a new build produces a new name, so a cached file is
never a stale one. json records the current pair, and the
plugin reads it rather than guessing.
Nothing about the plugin requires npm at runtime. The bundle is committed and
shipped because the target audience installs from the WordPress admin, on shared
hosting, with no command line.
External services
VIES — EU VAT number validation (European Commission)
Used only when you click “check” beside an EU VAT number, to confirm that the number
exists. What is sent: the country code and the VAT number, in the request URL. Nothing
else — no company name, no site address, no identifier.
eu/taxation_customs/vies/
eu/taxation_customs/vies/#/help
)
Used only if you enter your own Stripe API keys in the settings. It lets a customer of
yours pay a shared invoice by card. What is sent, when your customer clicks “pay”: the
amount, the currency, the invoice reference and the return address. The plugin never
sends your customer list or your documents.
com/
com/legal/ssa
com/privacy
AMS Studio licence server (AMS Studio, Luxembourg)
Only reached if you click “Upgrade to Pro” in the application header. That button is a
link: your browser opens it, the plugin itself opens no connection and sends nothing on
its own. What travels in that link: an installation identifier drawn at random on your
site, a one-way hash of a secret drawn with it, your site address and your admin email
address — so that the licence you buy is tied to this site and fills itself in when you
install the paid package, with nothing to copy by hand. The hash cannot be reversed, and
the secret itself never appears in the link.
Nothing is sent if you never click the button, and nothing is sent on a schedule.
lu/
lu/
The plugin contacts nothing else. No telemetry, no update server, no licence check.