What changed in Store Console

Store Console v1.2.0

Fixes

• A fresh install no longer stops at the database step with "Canvas catalogue is missing or invalid".
• An add-on whose term has lapsed still updates with the core.
• The inventory dashboard counts only the stock of live products. Out of stock reads negative, and quantities and value are formatted.
• Cost of goods is never silently missing, and cancelling an order refunds the full amount.
• My Account → Refunds and the headless checkout code no longer fail with an error.
• The order cache is cleared when an order changes.
• Employee numbers with a department code work on PostgreSQL.
• Product chat reports stock correctly, social sign-in shows the avatar, and the footer builder shows its own labels.
• A closed campaign bar no longer flashes back on reload.
• The admin sidebar follows the language switch.

Improvements

• Contact rules also fire for Form Builder messages.
• Forms limit answer length, thank the sender by email and send quieter stock alerts. Form submissions open support tickets on PostgreSQL.
• Live ticket updates stay under the socket limit, and the guide covers app push setup.
• Custom HTML sections keep their design in the mobile app and the Next.js storefront.

Quality

• Static analysis runs at PHPStan level 7 with no baseline, and every fix above has a test.

Store Console v1.1.0

Delivery

• A courier parcel becomes Assigned only when the carrier books it.
• A parcel is booked once. A second click, on the same screen or another, is refused.
• Bulk booking assigns the parcels it books and moves their orders on.
• Carrier refusals show the carrier's reason. Courier lookups the carrier refuses stop filling the log.

Inventory

• A cancelled order that is reopened takes its stock again.
• A repeated cancellation no longer credits the stock twice.

Chat and history

• Chat messages can be kept in MongoDB, alongside the activity log, CRM email, Social Hub and Manufacturing history.

Storefront

• Menu links carry the visitor's language prefix.
• The announcement bar close button sits at the bar's edge, in the bar's own colour, and works right-to-left.

Housekeeping

• Each module's composer.json version now matches its module.json.
• npm reports 0 advisories.

The first general release. Everything since v0.13.0-beta, plus the security and quality pass that gates v1.0.0.

Security

• Staff permissions. Storefront settings, SEO, search analytics and reports were open to any staff member, and any staff member could change them. They now need their own permissions; admin, store manager and social manager hold them.
• HR records. An employee could list, open and download colleagues' HR documents and file expense claims or asset requests in their name. Employees now see and file only their own records. Seeing everyone needs HR directory access.
• Licence pages. The customer view no longer carries product cost price, raw licence features or the staff audit log (IPs, reasons).
• SMS misuse. Every SMS passes one guard: a valid mobile, allowed countries (the store's own by default), per-number limits (5 per 10 minutes, 20 a day), store-wide caps (300 an hour, 2,000 a day) and duplicate suppression. Codes are capped per contact and per IP.
• Licence checks in the Launcher read only the signed licence token.
• Symfony 8.1.11 (advisories of 4 November: HEAD requests and access rules, path rules, trusted proxies, generated URL hosts, serializer file reads, YAML parse time) and symfony/mime 8.1.10 (CVE-2026-45070). Build tooling updates for postcss, nanoid and source-map-js.
• The language switcher returns only to pages on the same site.
• Release bundles refuse backups, editor files, AI and plan docs and source maps. The unused Ziggy package and its generated route list are gone.

Languages in the web address

• The default language has no prefix (/shop); every other language lives under its code (/bn/shop). Each language has its own indexable address, and product, category, listing and bundle pages list every language in hreflang.
• Old ?lang= links and /en/... redirect to the right address. Admin, API, file and signed links never take a prefix.
• Changing language keeps you on the same page, without a reload. A returning visitor lands in the language they chose.
• The Next.js storefront follows the same rules. Setup: docs/LANGUAGE-URLS.md.

Header

• The announcement bar and campaign banner have a close button (on by default, RTL-aware). A visitor who closes it does not see it for 6 hours to 7 days, or until the message changes.

Faster sign-in

• Signing in, with a password or a passkey, no longer reloads the page.

Mobile app links

• Tapping a notification opens the matching app screen instead of the browser.

SMS

• BulkSMSBD and Vonage providers (SMS_PROVIDER), with a log-only mode for staging.
• Login code, checkout code and password reset by SMS.
• Order placed, shipped and delivered texts, including to guests' checkout phones, only where the admin turned SMS on for orders.
• SMS templates per notification with placeholders, plus admin-editable limits and countries.
• Phone validation for every country (libphonenumber), on checkout, checkout codes and form-builder phone fields.

Setup: docs/SMS.md.

Digital goods, licences and subscriptions

• One record per money event: each recurring charge is its own order. Balance due and total spent follow payments.
• Licence pages (admin, My Account, Next.js, mobile) list their orders and payments and the term history.
• Free test sites: staging, dev, test and demo addresses don't use a live seat (up to 3 per seat).
• One licence issuing path; downloads are owned by the licence only.
• A gateway subscription page with Sync and Cancel at period end.
• "+ tax" on tax-exclusive gateway amounts; Manage billing from Payment methods.
• A lifetime licence never expires.

Other changes

• Content Studio pagination and search.
• History on MongoDB: activity log, AI/MCP calls, Social Hub events and messages, CRM email and Manufacturing history can move to MongoDB (HISTORICAL_DB_CONNECTION), keeping their ids. php artisan history:copy-to-mongo copies existing rows. Chat messages stay on SQL for now. Setup: docs/MONGODB-HISTORY.md.
• My Account menu without duplicate entries.
• Manufacturing costs post to the books on new installs.
• Unused tables and columns are dropped.

Module versions

0.x modules are now 1.0.0. Changed modules carry their own version: PlatformKit, Storefront and Menu 1.1.0; Accounting 2.1.2; Order, Payment, Manufacturing and Notification 1.0.2; the rest of the changed modules 1.0.1.

Companion releases: Next.js storefront 0.6.0-beta.1, mobile app 0.1.0-beta.9.

Upgrade notes

• Migrations drop unused columns (no data held on any install), merge duplicate My Account menu items and drop the SQL foreign key from OEE losses to OEE snapshots.
• Storefront links in another language now use /bn/.... Old ?lang= links keep working through a permanent redirect.
• After updating, run php artisan permissions:sync; deploys do this automatically.
• To use SMS, set the provider keys in .env and turn SMS on in Notifications. See docs/SMS.md.