v1.13.0-beta1

What's Changed

• feat(ci): add PHP lint/smoke and vueManager ESLint gate on PR by @Ibochkarev in #394
• fix(customer): stop checkout token takeover via email by @Ibochkarev in #391
• fix(api): omit customer secrets from profile/add responses by @Ibochkarev in #428
• fix(manager-api): tighten ACL on customers and category products by @Ibochkarev in #400
• fix(manager-api): require msorder_save for order write routes by @Ibochkarev in #402
• fix(manager-api): require mssetting_save for config writes by @Ibochkarev in #404
• fix(manager): ограничить payload /deliveries-active whitelist'ом by @Ibochkarev in #427
• fix(customer): reject expired API tokens instead of silent renew by @Ibochkarev in #396
• fix(api): stop loading storefront routes via manager connector by @Ibochkarev in #401
• fix(order): prevent duplicate order numbers under concurrent submit by @Ibochkarev in #399
• fix(product): persist clearing color/size/tags on save by @Ibochkarev in #325
• chore(build): clean full vue-dist on prebuild by @biz87 in #470
• fix(order): multiply draft weight by product count by @Ibochkarev in #403
• fix(order): return error when status save fails by @Ibochkarev in #392
• fix(import): read processor object in startImport by @Ibochkarev in #390
• fix(manager): выровнять ответ обновления заказа с GET и скрыть секретный token by @Ibochkarev in #426
• fix(vueManager): format order date filters in local calendar by @Ibochkarev in #405
• fix(resource): конвертация modDocument → msProduct by @Ibochkarev in #331
• fix(mgr): ACL на запись /grid-config (mssetting_save) by @Ibochkarev in #436
• fix(mgr): ACL view_document на /references (PII покупателей) by @Ibochkarev in #438
• fix(api): запретить подделку privacy_accepted_at через customer/add by @Ibochkarev in #439
• chore(vueManager): consolidate Dependabot security dependency updates by @Ibochkarev in #483
• fix(mgr): scope category product publish/bulk by parent by @Ibochkarev in #443
• fix(vue-manager): clean vue-dist before Vite build by @Ibochkarev in #398
• feat(ci): PHPStan gate + PHPUnit scaffold for pure helpers by @Ibochkarev in #433
• fix: латентный фатал getPaymentLink и мёртвая регистрация ms3_config_manager by @Ibochkarev in #485
• chore(lexicon): EN/RU parity and remove duplicate keys by @Ibochkarev in #360
• fix(options): whitelist msProductOption criteria перед xPDO lookup by @Ibochkarev in #452
• fix(product-data): category scope для inline-edit PUT by @Ibochkarev in #454
• fix(email): экранирование & в ссылке на заказ в письме менеджеру by @Ibochkarev in #465
• fix(mgr-api): whitelist filter_* на списках customers by @Ibochkarev in #457
• fix(api): безопасный CORS — без * + credentials по умолчанию by @Ibochkarev in #463
• fix(customer): restore storefront login and session auth by @Ibochkarev in #321
• test(unit): RepeaterFieldService pipeline + clampComputedTotal by @Ibochkarev in #493
• fix(auth): session bypass после revoke API-токенов + Web logout by @Ibochkarev in #462
• fix(api): HTTP 401/429 для auth и rate-limit в Web API by @Ibochkarev in #434
• fix(api): auto-mint guest token for cart/get; sync publicRoutes; lexicon Web errors by @Ibochkarev in #440
• fix(web-api): remove false-success stub for token/refresh by @Ibochkarev in #351
• fix(web-api): bind API token on email verify by @Ibochkarev in #441
• Web API: публичный Customer DTO и allowlist полей профиля by @Ibochkarev in #475
• feat(web-api): customer logout and password recovery routes by @Ibochkarev in #442
• RateLimitMiddleware: pluggable storage (Redis/Memcached) by @Ibochkarev in #487
• fix(order): единая база для процентной комиссии оплаты (cart-only) by @Ibochkarev in #460
• fix(order): align finalize cost with ManagerOrderCostRecalculator by @Ibochkarev in #448
• fix(order): повторная проверка fixed после mutation статуса плагином by @Ibochkarev in #464
• fix(order): блокировка Save во время пересчёта стоимости by @Ibochkarev in #461
• fix: проверка связи delivery/payment при оформлении заказа by @Ibochkarev in #459
• fix: payment_link в письме о новом заказе by @Ibochkarev in #458
• chore(deps): vueManager security bumps (js-yaml, fast-uri, happy-dom) by @Ibochkarev in #506
• Удалить deprecated pass-through OrderService/Customer by @Ibochkarev in #489
• fix(mgr): не грузить отсутствующий vue-dist/main.min.css на product/update by @Ibochkarev in #504
• fix(currency): символ рубля вместо "?" в ms3Config by @Ibochkarev in #498
• fix(vue): unwrap пустого object/data в request.js by @Ibochkarev in #466
• fix(vue): stale response race в OrdersGrid и CategoryProductsGrid by @Ibochkarev in #468
• fix(cart): смена опций в корзине через Web API и storefront by @Ibochkarev in #502
• fix(import): toast и Message при ошибках fields/preview by @Ibochkarev in #453
• test(integration): finalize required fields + cart SQLite draft by @Ibochkarev in #495
• test(integration): MySQL CI + AuthManager lifecycle by @Ibochkarev in #496
• chore(api): remove dead field-config override endpoints by @Ibochkarev in #383
• refactor(mgr-api): extract extra-fields CRUD into controller by @Ibochkarev in #491
• refactor(api): единый Response envelope на HTTP boundary by @Ibochkarev in #505
• feat(api): лексикон для сообщений CategoryProductsController by @Ibochkarev in #467
• fix(products): дополнительные категории в msProducts и гриде категории by @Ibochkarev in #482
• feat(mgr-api): document-level ACL для category products by @Ibochkarev in #473
• feat: единый EventGate для returnedValues by @Ibochkarev in #456
• refactor(import): декомпозиция ImportCSV, EventGate и ProductImportService by @Ibochkarev in #499
• refactor(di): OptionSync/Loader + ManagerOrderCostRecalculator in ServiceRegistry by @Ibochkarev in #477
• Унификация расчёта стоимости заказа: checkout ↔ manager by @Ibochkarev in #476
• perf(orders): conditional Address JOIN и отдельный stats endpoint by @Ibochkarev in #469
• feat(mgr-api): category-scoped PUT для inline-edit product data by @Ibochkarev in #474
• feat(order): EmptyOrder events and Order::set validation errors by @Ibochkarev in #393
• fix(auth): ротация API-токена против token fixation by @Ibochkarev in #516
• docs: граница Domain facades vs Controllers/Api by @Ibochkarev in #511
• refactor(grid): разрез GridConfigService (Phase A #365) by @Ibochkarev in #513
• refactor(options): разрез OptionLoaderService (Phase B #365) by @Ibochkarev in #514
• refactor(product): разрез ProductDataService (Phase C #365) by @Ibochkarev in #515
• feat(import): поддержка msExtraField в импорте товаров из CSV by @Ibochkarev in #510
• feat(gallery): выбор главного превью без смены порядка by @Ibochkarev in #512
• refactor(mgr-api): общий CRUD deliveries ↔ payments by @Ibochkarev in #509
• feat(extra-fields): add ms3-key-value field type by @Ibochkarev in #323
• refactor(cart-customer): thin Cart/Customer facades via Services managers by @Ibochkarev in #406
• refactor(mgr-api): ModelFieldsController → ModelField services by @Ibochkarev in #517
• fix(grid): relation-поля в гриде «Товары категории» by @Ibochkarev in #330
• feat: вкладка «Категории» товара на Vue (#113) by @Ibochkarev in #479
• feat(web-api): implement public product catalog endpoints by @Ibochkarev in #333
• feat(web-api): GET customer/orders list and get by id by @Ibochkarev in #425
• Заменить abandoned rakit/validation by @Ibochkarev in #486
• refactor(vueManager): parallelize option field values load in OrderView by @Ibochkarev in #447
• refactor(vue-manager): extract thin list/config/crud/sort composables by @Ibochkarev in #397
• GridConfigService: request-scoped memoize getGridConfig by @Ibochkarev in #488
• feat(settings): consolidate dual API combo lists, drop member processors by @Ibochkarev in #490
• Распил OrderView.vue: composable и диалоги by @Ibochkarev in #478
• fix(migrations): inline ruble symbol in currency mojibake repair by @Ibochkarev in #520
• fix(di): OptionCategoryService в ms3_option_service (Settings/Category Options) by @Ibochkarev in #535
• chore(mgr): удалить orphan Ext assets (Phase 0 #521) by @Ibochkarev in #530
• feat(order): публичный sessionless API программного создания заказов by @Ibochkarev in #508
• feat(product): Vue вкладка «Связи» и трекер ExtJS→Vue формы by @Ibochkarev in #518
• feat(mgr): Orders/Order без Ext wrapper (Phase 1a #521) by @Ibochkarev in #533
• feat(mgr): Settings без Ext tabs (Phase 1b #521) by @Ibochkarev in #536
• feat(mgr): Customers/Notifications без Ext wrapper (Phase 1d #521) by @Ibochkarev in #534
• feat(mgr): Utilities без Ext tabs (Phase 1c #521) by @Ibochkarev in #537
• refactor(orders): decompose OrdersController + ServiceRegistry factory map by @Ibochkarev in #492
• fix(vue): изоляция confirm-диалогов категории через group — двойной confirm (#538) by @biz87 in #540
• fix(mgr): токен в ms3.config — гонка HTTP_MODAUTH на Ext-less Vue-страницах (#544) by @biz87 in #545
• fix(vue): бесконечная реактивная петля в ResourceCategoryTree — фриз Настройки→Опции (#546) by @biz87 in #547
• fix(vue): изоляция ConfirmDialog вкладок Настроек (#548) by @Ibochkarev in #549
• fix(vue): убрать лишний confirm удаления в VendorsGrid (#551) by @biz87 in #552
• chore(release): 1.13.0-beta1 — версия + changelog by @biz87 in #560

Full Changelog: v1.12.0-beta1...v1.13.0-beta1