Changelog

All notable changes to ChatCart are listed here. This project follows Semantic Versioning.

[1.0.0] - 2026-10-02

Initial release.

WhatsApp checkout: the cart becomes a pre-filled chat message, with no payment gateway and no fees.
Three storefront modes: full store, QR menu for tables, and link in bio.
Order message template you can edit, with a live preview.
Storefront with a home page builder, search, filters, cart, and wishlist.
Products with variants, image galleries, stock tracking, and reviews.
Categories with subcategories, set with a Parent category field.
Coupons: percent off, fixed amount, and free delivery, with total and per-customer limits. Product and category coupons discount only the matching items.
Delivery, pickup, and dine-in, with shipping zones and fees.
Admin console with a dashboard, order status flow, invoices, and sales reports.
CSV import and export for products, and CSV export for orders. An import that updates a product changes only the columns in the file.
Multi-store: run several stores, each with its own domain and branding.
Users with three roles (owner, manager, staff), optionally limited to some stores.
Seven languages with right-to-left support, plus a currency switcher.
Optional customer accounts, blog, and newsletter, per store.

Prices, delivery fees, and discounts are always calculated on the server. If a price changed, the customer sees the new total before ordering.
The server checks stock for every order, so an order can never oversell.
Canceling an order gives its stock and coupon use back. Reopening it takes the stock again.
An order confirmation page opens only with the private link the customer gets at checkout, or for the signed-in customer who placed the order.

Admin permissions are checked against the database on every request. Removing a user, or changing their role, stores, or password, takes effect at once.
Staff of one store cannot see or change another store's data.
Admin and customer sign-in are rate limited, and take the same time for known and unknown emails.
Customers must enter their current password to set a new one. Changing it signs out their other devices.
API writes from other websites are refused, and request bodies overundefinedMB are refused.
Links entered in the admin only allow http, https, mailto, tel, and site paths.
CSV exports escape cells that start with =, +, - or @, so spreadsheets do not run them as formulas.
The service worker never caches account, checkout, cart, or order pages. Private pages send a noindex header.
Security headers: frame-ancestors, Permissions-Policy, and Strict-Transport-Security.
npm run create-admin has no built-in password, and npm run seed will not wipe a database that has data unless you pass --force.

Node.js 20.19 or newer. npm ci works with the included package-lock.json.
Documentation with one page per topic: a quick start, MongoDB and Atlas setup, troubleshooting, screenshots, step-by-step guides, and annotated diagrams.
A README in the app folder.