Changelog

Every kitloom package is released at once, under one tag: composer update takes all of them to the same version. Newest first.

1.4.0 — 23 October 2026

Child themes, the theme Customizer, revisions you can restore, and more of the admin for AI agents. composer update "kitloom/*" takes a 1.3 site to it; then rebuild the Vue and React themes (npm run build:themes): their entry now imports its templates from virtual:kitloom-templates. New projects have everything.

Themes

• Child themes (kitloom/site, kitloom/site-inertia): a theme names its parent in its composer.json (extra.kitloom.theme.parent) and holds only what it changes. Templates, Blade views (parent:: for the parent's own), Vue and React components at the same @/ path, parts, migrations, words, settings and the demo fall back on the parent, which counts as active while its child is; a Blade child's resources/style.css goes after the parent's styles. One level, as in WordPress. Appearance → Themes says Child of … and Parent of …, and a child whose parent is missing cannot be activated. Child Themes.
• kitloom:make-theme <Name> --parent=<Theme> writes a child as a folder of themes/ (or a package with --package); --copy starts it from some of the parent's files. Generating a Theme.
• Theme settings and Appearance → Customize (both admins): a theme declares the colours, the logo, the footer's line and other settings its owner may change (settings(), ThemeSetting); the owner changes them beside a preview of the site — a draft only they see, never cached or indexed — and publishes. Kept in theme_mods_<theme>; on the page as CSS variables, the Theme facade in Blade, the theme part in Vue. The logo of a site moved from WordPress is kept. A child starts from its parent's values. New permission in the admins: Edit theme options (WordPress's edit_theme_options). Theme Settings (Customize).
• Blade, Journal and generated themes offer their accent colour, logo and footer line; Blade also its heading font and the tagline switch.

Revisions

• Every save of a post, a page or a record of another type keeps a revision, as WordPress keeps them: its title, content, excerpt and the fields and SEO meta modules declare — custom fields and Rank Math's titles and descriptions among them. Up to 25 per record; deleting a record for good takes them with it.
• Revisions on every record's edit page, in both admins: a version picked, compared with the record line by line, and restored. Products and the types of Post Types keep them too. Search & Replace keeps each record as it was before a run; an import keeps none.

AI agents

• Undo: content_revisions lists a record's versions, the agent's own changes marked, and restore_revision brings one back.
• New tools: theme_customize and theme_settings in describe_site; users_create, users_update and users_set_role (a new user is invited by email to choose a password, and agents never give or touch roles that manage options or users); form_create; field_groups_get and field_groups_save; order_create, an order taken by phone at the catalogue's prices; the salon's catalog in Bookings; payments_methods (what is on and which credentials are missing, never a value); media_regenerate and list_media with images missing alt text and files nothing seems to use; Search & Replace with a dry run first (content tables only); Internal Links; privacy requests; site_cache_clear; pulse_report; ai_writer_usage; health_failed_jobs (which job and when, never why). describe_site lists the shortcodes the site draws. AI Agents.

Modules

• A module takes the third-party packages it brought in along: switched off, Horizon no longer leaves its dashboard, routes and commands behind. Both admins name these packages before the switch.
• Users: a user made by someone else gets WordPress's Login Details email and chooses a password on the account page.

Demo

• The Assistant and a demo's Feedback sit side by side in the corner, one panel open at a time.
• Two new video lessons: child themes and Customize.

1.3.0 — 22 October 2026

A new module, the Assistant: a chat with the site's AI model on every admin page. composer update "kitloom/*" takes a 1.2 site to it; the module comes with composer require kitloom/assistant and kitloom/assistant-filament or kitloom/assistant-nova, then php artisan migrate for the conversations. It answers with AI Writer's model, so AI Writer needs a key. New projects have it.

New modules

• Assistant (new, kitloom/assistant): ✦ Assistant in the corner of every admin page opens a chat over the screen, and it knows which page that is — on a post, "write an excerpt for this post" means that post. It looks things up and changes content, orders, settings and every installed module's records with the tools AI agents get, as the user chatting; every change waits in a card for Approve or Reject, and nothing is deleted for good. ☰ lists your conversations to go back to; Assistant → Chat has them on a page of their own. Assistant → Settings: steps per answer, how long conversations are kept, and Make changes without asking, which turns the approvals off only once whoever turns it on accepts full responsibility — agents cannot change it themselves. Each answer costs what AI Writer's model charges and counts against its monthly budget; the modules' tools wait behind a tool search and the unchanging part of every question is cached, which made a typical exchange about eight times cheaper than sending everything each time. Administrators get the new permission Use the assistant. Three Ways to Use AI compares it with AI agents and AI Writer.

Modules

• AI Writer: the input a provider reads from or writes to its prompt cache is logged apart (Usage shows it) and counted at the cache's own price — Anthropic bills a cached read at a tenth of the input price or less — so the month's figure is what the provider charges. A server may set a budget ceiling no administrator can raise (KITLOOM_AI_WRITER_BUDGET_CEILING), for a site whose administrators are not the ones who pay.
• AI agents: the assistant's settings are among those agents may not change.
• Emails: an email sent through an SMTP server is logged as sent; it stayed pending before.

Demo

• Every demo sandbox has the assistant, open from the first page of the admin, with a few questions to start with.

1.2.0 — 22 October 2026

Two new modules, Emails and Sign In As. composer update "kitloom/*" takes a 1.1 site to it; a new module comes with composer require (kitloom/emails with kitloom/emails-filament or kitloom/emails-nova, and the same for kitloom/impersonate) and php artisan migrate for the email log. New projects have both.

New modules

• Emails (new, kitloom/emails): every email the site sends goes out through the SMTP server set up in Emails → Settings, from the address chosen there, as WP Mail SMTP keeps it — a site that sent through an SMTP server under WordPress sends through the same one, password included. Send a test email says at once what the server answered, and the Email Log lists every email with its status; Site Health warns when the last day's emails failed.
• Sign In As (new, kitloom/impersonate): support signs in as a customer from Users → Sign in as in either admin and sees the site as they do — account, orders, bookings, courses, saved cart. A bar at the foot of every page says whose account it is and leads back to the user's page in the admin; after an hour the next page brings the admin back by itself. Only users who hold no permission the admin lacks, and by default nobody who works in the admin; Activity Log records who was behind it. Administrators get the new permission Sign in as another user.

Modules

• Redirections: a site that ran Yoast SEO Premium keeps its redirects. Redirects → Settings → Import from Yoast SEO Premium (or php artisan redirects:import --from=yoast, --dry-run first) makes each of them a rule once; a source with a rule of its own here keeps it, and what stays behind is listed with the reason. Expressions, decoded addresses and trailing slashes come over as Premium ran them.
• Languages: the users list no longer shows an empty Translations column.

License

• The license names Kitloom's Manitoba registry number (10284043). Since 1.1.1 it names the editions Kitloom for Filament and Kitloom for Nova, says that modules and themes you write for kitloom are yours, and covers what imports do with other plugins' data.

1.1.0 — 21 October 2026

New imports from Yoast SEO and the Redirection plugin; composer update "kitloom/*" takes a 1.0 site to it, with no new migrations.

Modules

• SEO: a site that ran Yoast SEO keeps its SEO. SEO → General Settings → Import from Yoast SEO (or php artisan seo:import --from=yoast, --dry-run first) takes the titles, descriptions, robots, canonicals and social meta of posts, terms and authors, the templates of Titles & Meta, breadcrumbs, verification codes and sitemaps once into Rank Math's keys. Only what is empty is filled; Yoast's data is left as it was. A large site imports on the queue and is told when it is done.
• SEO: X's tags take the Facebook title, description and image until a record has an X field of its own, as Rank Math's "Use Data from Facebook Tab" does.
• Redirections: a site that ran the Redirection plugin keeps its rules. Redirects → Settings → Import from Redirection (or php artisan redirects:import) takes them once, with their hits, last visit and order; what changes on the way and what stays behind is listed with the reason.
• Courses: both admins' course forms carry the Course Review add-on's Enable reviews switch (a course without it keeps its reviews); in Filament the comments' own switch is now Take new reviews, so the two read apart.

Installing

• kitloom:install --all activates the theme APP_THEME names, so --demo fills it; --theme still wins.
• A new project links storage (uploads are served), sets APP_URL to http://localhost:8000, the address php artisan serve opens, and db:seed after a theme's demo no longer trips over its front page.

1.0.1 — 21 October 2026

Fixes and smaller additions; composer update "kitloom/*" takes a 1.0 site to it, with one new migration (php artisan migrate).

Modules

• Courses: students leave a review with stars and a title on the course page, as LearnPress Course Review keeps it (one per course, Discussion rules apply); the course's average rating is kept; the catalog sorts and filters by the sale price only between the sale's dates. Lyceum shows the reviews and the form.
• Listings: one place writes a listing's gallery, hours and location for both admins and agents; the search index keeps up with meta saved after the record; currency, area unit and favorites fall back to Houzez's and Listeo's own settings; a guest's enquiry only fills a lead's empty fields; reviews follow the Discussion rules; the personal data export carries the enquiry's message and favorites.
• Privacy: Payments hands over the payer's data (keeping what accounting needs); the export archive is built by a queued job; Site Health warns when the export disk does not last; anonymised comments are named in the site's language.
• Maintenance: while the site is closed, guests no longer read its posts through /wp-json/wp/v2; a setting keeps the REST API open for a headless front end.
• SEO: Rank Math's variables moved from the site package into SEO.

The site and the admins

• The settings snapshot leaves WordPress transients and very large rows out — they are read when asked for.
• Inertia themes see a rebuilt theme without a worker restart.
• Theme demos write reviews, terms and menus through the same writers as the admins.
• kitloom:user asks for the password (or reads KITLOOM_USER_PASSWORD) instead of taking it on the command line, and creates the account the way sign-up does.

1.0.0 — 21 October 2026

kitloom is released as 1.0: every package is required as ^1.0 and main is aliased to 1.0.x-dev. A site on 0.1 changes its kitloom requirements from ^0.1 to ^1.0 and runs composer update "kitloom/*"; nothing else changes on the way.

New modules

• Privacy (kitloom/privacy): WordPress's Export and Erase Personal Data, and Settings → Privacy with the privacy policy page as WordPress chooses it. The shop, forms, bookings, comments, account modules and webhooks' delivery log hand their personal data to it through the PersonalDataExporter and PersonalDataEraser contracts.
• Listings (kitloom/listings): real estate and directory listings on Houzez's and Listeo's data — search with facets and a map (MapLibre on OpenFreeMap), agents and agencies, enquiries, favorites, reviews and opening hours.
• Courses (kitloom/courses): online courses on LearnPress's data — a curriculum of lessons and quizzes, quizzes marked on the server, students' progress, paid courses sold through the shop.

New themes

• Quire, the first React + Inertia theme: a storefront in English and French.
• Keystone (real estate) and Waypoint (a city guide) on Listings; Lyceum, an online school on Courses; Parsec, a dark magazine.
• Every theme names its demo, requires widgets and declares a footer zone; kitloom:install --demo fills a new site with the active theme's demo, and kitloom:make-theme writes themes with widgets, a footer zone and a demo.

The site

• Forms in the page's language: a module's texts are translated through wp-schema's TranslatableTexts.
• Page images point at the uploads disk, not at /wp-content/uploads.
• The page cache leaves partial Inertia answers, stray versions and endless page numbers out.
• Under Octane, services a request owns are resolved when called, and a theme switch reloads long-lived workers.

Security

• read_post as WordPress maps it, protected posts in search for editors only, commenters' emails for moderators only, a throttle on the profile, typed passwords hashed.
• Webhooks go only to public hosts, follow no redirects and carry public types only.
• The default role, role edits and one's own role stay within reach of those who may change them.

For developers

• kitloom:user makes an account on a server without the seeder.
• The test suites pass on MySQL with the WordPress table prefix.
• Site Health checks hosts without a lasting disk.

0.1.1 — 18 October 2026

Installing

• A new site picks what it keeps: after composer create-project, php artisan kitloom:install asks for the modules group by group (the usual ones ticked), the themes and the active one, then removes the rest with Composer, so the site's composer.json lists what it runs. A theme keeps the modules it needs. --modules, --themes, --theme and --all answer without questions. The site's tests are its own: Unit and Feature suites with an example each.
• After the installer, APP_THEME in .env names the active theme (empty for none), and the skeletons' Vite config builds nothing without a Vue theme.
• A new site's tests are its own: phpunit.xml runs tests/Unit and tests/Feature, with an example test in each.
• php artisan site:theme <Name> activates a theme from the console as Appearance → Themes does; --none leaves the site without one.
• The active theme is kept in the kitloom_theme option, not WordPress's current_theme, which WordPress overwrites on a shared database.

New modules

• Languages (kitloom/languages): translations laid over posts, terms and options, languages in addresses, a language switcher, search and sitemaps per language, and translation with AI into drafts.
• AI Writer (kitloom/ai-writer): the site's own AI provider, key and monthly budget for the modules that write text — translations first — through the TextGenerator contract.
• Link Checker (kitloom/link-checks): broken links among the links Internal Links counts.
• Webhooks (kitloom/webhooks): outgoing webhooks to Zapier, Make, n8n or any URL — published posts, comments, orders, bookings.
• Maintenance mode (kitloom/maintenance): a coming soon or maintenance page for visitors while the owner works on the site.

The site

• A page answers Accept: text/markdown with its text as Markdown.
• Classic text gets its paragraphs, as WordPress's wpautop gives them; a shortcode alone in a paragraph is drawn outside it.
• PageResponding: a module answers a page before it is drawn (WordPress's template_redirect).
• Typed output: every part of a page declares a JSON Schema, the page document has one, and Vue themes get TypeScript declarations — Journal is written in TypeScript.
• The menus part of a page — and the menus prop of a Vue theme — carries the menus in the site's locations and no other; a site moved from WordPress with many menus shows the few in use. Menus::get() still finds a menu in no location, read on demand. A menu is built only when a page draws it: a page that shows none reads none, which took 13–15 ms off every page on the benchmark's site. The Portfolio, Game Reviews and Marketplace themes no longer fall back to a menu with the slug main: put it in a location.
• Fewer queries per page — term archives, the shop, the page cache's options — and php artisan site:preload for opcache.preload.
• Benchmarks measured again, now also against WordPress with Yoast SEO, Contact Form 7 and WooCommerce: without a page cache, a kitloom site with what a bare WordPress has answers faster than WordPress (15 ms against 20 ms across thirteen pages), and the whole skeleton is 1.7 times faster than WordPress with those plugins.
• The Blade theme has menu locations, widget zones, featured images and a demo; Saffron keeps a recipe's card in tables of its own, and kitloom:make-theme --storage=tables does the same for a generated theme.

Shop

• Cart totals as WooCommerce adds them up — coupons with tax, remainders, rounding — and orders as WooCommerce writes them, checked against a real WooCommerce.
• A signed-in shopper's cart is kept on their account; WooCommerce's Cart and Checkout blocks draw the cart and the checkout; an offline method's instructions reach the payer; grouped and external products are not sold.

AI agents

• An agent reads only the types and records its user may see.
• New tools: post types and taxonomies made in the admin, the search index, image compression, import history and an import from an address.
• render_page answers in the shape its output schema says; get_page_schema gives the schema.

Admin

• Add New User in the Filament admin's Users menu, as in WordPress.
• Each record's page and address in the admins, per language too.
• KITLOOM_MODULES_MENU_HELP=false leaves How it works out of every module's menu section and keeps the pages.
• The admin opens only for a role that has something to do there.

Security

• The fixes of the 17–18 October audit: posts and private content follow each type's capabilities; sign-in throttles, an account lock that spares known browsers, no timing tells at sign-in, trusted hosts and Referrer-Policy; no leaks through agents and the REST API, no SSRF; wrong application passwords limited per address; an attachment's files deleted only inside its own folder; unsafe link schemes dropped from menus; a comma in a form field adds no recipient; a limit of upcoming bookings per client; a depth limit for serialized values in Search & Replace.

For developers

• Test helpers ship with the packages — ApplicationTestCase, DatabaseTestCase, CreatesUsers, InteractsWithFilament, InteractsWithNova — and a module's tests live in the module.
• CommentType: a module declares a comment type of its own (the shop's review).
• A throttle counts under its route's name; modules' scheduled tasks run on one server of several.
• PHP 8.4 for every package; Laravel 13.36.

0.1.0 — 15 October 2026

The first release of every package at once.

The site

• kitloom/site is the core of the public site, done the way WordPress handles a request: rewrite rules, the main query (QueryResult with WordPress's conditional tags), the canonical redirect, the template hierarchy, and the page with its parts, each worked out only when asked. It replaces kitloom/core, kitloom/routing, kitloom/content, kitloom/themes, kitloom/inertia and kitloom/blade, and the page pipeline (PipelineRegistry, stages, pipes, PageContext, config/kitloom-page.php) is gone. The route is Route::fallback(SiteController::class)->middleware(CachePage::class).
• Events RewriteRulesBuilding, MainQueryResolved, TemplateCandidates, PageNotFound.
• Site::resolve() and Site::render(): a page found and drawn without a request, as a visitor or as a given user — for the console, tests and AI agents.
• Every page as JSON with Accept: application/json, parts chosen with ?include=; a page not found answers 404 with its document (kind: not-found). A page cache for guests (SITE_CACHE_TTL).
• Themes are part of kitloom/site: a theme's provider extends Kitloom\Site\Themes\ThemeServiceProvider and names its engine. Blade templates are named by the template hierarchy; Vue themes run on kitloom/site-inertia. Child themes are gone.
• Content filters (the_content), Rank Math's template variables, blocks — static, dynamic (BlockType) and synced patterns.
• Sign-in on the site: POST /login and /logout for the theme's own form, with a SignIn contract that two-factor and social login hook into.
• Page scripts: @siteHead, @siteBodyOpen, @siteFooter in every theme, filled by modules through PageScriptsProvider.

APIs and agents

• The REST root /wp-json/ belongs to the site; modules mount namespaces through RestNamespace. The old POST /api/shortcode endpoint is gone: shortcodes never read the request.
• REST API (kitloom/api): WordPress's wp/v2 with application passwords on Sanctum. Forms answer at contact-form-7/v1, the shop's cart and checkout at wc/store/v1.
• AI agents (kitloom/ai): an MCP server at /mcp with core tools for content, terms, media, settings, addresses and rendered pages; modules add their own through AgentTool and AgentContext. claude.ai connects with the key in the address.

Data

• Users are rows of WordPress's users table, with WordPress's password hashes; a Laravel users table is moved into it by a migration. php artisan wordpress:install leaves what WordPress needs to run on a database the site started.
• Typed models through the ModelRegistry (WpSchema::query('post')), Laravel-named aliases ($post->title, published_at), the meta API (getMeta(), setMeta()…) and custom fields through $model->field(), setField() and the Fields facade. WpSchema::extend() adds relations and scopes to models a module does not own.
• Queries see with the request's eyes (Visibility); writes go through PostWriter and TermWriter with the acting user.
• Content events (PostSaved, PostPublished, PostTrashed…, TermSaved…), settings events (SettingSaved, SettingDeleted) and role events (RoleSaved, RoleDeleted, UserRoleChanged).
• Arrays are written as JSON; WordPress's serialized values are still read.
• Settings are declared by modules, with a type, rules and a permission, and written through SettingWriter; php artisan settings:list shows them.

Modules

• New modules: Activity Log, Ad Pixels, Admin Menu (one domain package for both admins), AI agents, Analytics, REST API, Backup, Cookie Consent, Header & Footer, Site Health, Horizon, Image compression (kitloom/media-optimizer), Pulse, Search, Sentry, Social Login (kitloom/social-accounts), Tag Manager, Two-Factor Authentication, Widgets.
• Cookie consent and trackers: ScriptConsent::gate() holds a tracker back until the visitor agrees; the shop publishes its sales through CommerceEvents for GA4, Tag Manager, Meta and TikTok.
• Widgets and blocks: widget zones are managed in the admin and go into any text with [sidebar] and [widget]; kitloom/widgets brings WordPress's standard widgets as widget types, dynamic blocks and shortcodes.
• Media: uploads cut into image sizes as WordPress cuts them, media:regenerate, a size limit, and the featured image picked in the media library in both admins.
• Contact forms keep bots out with a honeypot and Cloudflare Turnstile.
• Menu locations are managed in the admin.
• php artisan kitloom:make-module generates a module with both admins that passes every check as generated.
• php artisan kitloom:make-theme generates a Vue theme with every template of the hierarchy, optionally a post type of its own with both admins (--type, --taxonomy, --fields), what it brings chosen with --with, a demo command and tests.
• One menu section per module, ending with How it works, made from the module's README.
• A module switch reaches cached sites and long-lived workers: KITLOOM_MODULES_CACHES (auto, deploy, manual).
• kitloom/sandbox: a demo site with a SQLite copy per visitor.

Earlier in this cycle

• Modules screen for Filament and Nova: activate and deactivate installed modules, with dependency checks.
• Themes screen (Appearance → Themes) for Filament and Nova: cards with screenshots, activation with theme migrations; a theme can be deactivated, and the site then returns its pages as JSON.
• Bundled themes: Portfolio and Game Reviews (Vue), Blade and Marketplace (Blade).
• Roles and section permissions: kitloom/access, kitloom/permissions (on spatie/laravel-permission 6, 7 or 8) with Filament and Nova screens.
• Filament 5 admin packages for every module.
• Modules under their own names: kitloom/wp-schema, kitloom/custom-fields, kitloom/post-types, kitloom/forms, kitloom/shop, kitloom/slider (formerly wordpress, acf, acf-post-types, contact-form-7, woocommerce, wp-slide-anything). The data formats did not change.
• Shop module on the WooCommerce data format, with php artisan shop:demo; payments on kitloom/payments.
• Licenses: every package is commercial, under the kitloom EULA.
• Package Dependencies page, generated from the packages' composer.json.

Stack

• Laravel 13 (packages accept 12, most of them 11), PHP 8.3 for the skeletons — most packages accept 8.2; the shop, payments, comments and bookings need 8.3, kitloom/activity-log 8.4 — Filament 5, Nova 5, Inertia 3, PHPUnit 12.
• Sessions are serialized as JSON and the cache keeps no PHP objects (serializable_classes off): cache arrays and scalars.