# International Scale Readiness

This application is designed as a multi-company, multi-branch ERP. “Internationally scalable” is an operational standard, not a one-time feature flag. The controls below are required before each production launch.

## Implemented foundations

- Products, SKU variants, warehouses, inventory movements, purchasing, sales, accounting, and users are tenant-scoped by company and branch.
- Product slugs and SKU codes are unique within a company, allowing independent tenants to use familiar identifiers.
- Inventory is identified by immutable `product_sku_id`; human-readable SKU codes can be changed without disconnecting stock history.
- Company records support base currency, country, language, timezone, date/number formats, fiscal year, and tax identity.
- Monetary columns use fixed-precision decimals rather than floating-point storage.
- Stock workflows use database transactions and validate company ownership.

## Required per-country configuration

- Configure ISO 4217 currency code and decimal precision.
- Configure IANA timezone, language/locale, date format, and number separators.
- Obtain local review for tax calculation, invoice numbering, fiscal documents, retention, privacy, payroll, and accounting rules.
- Use GS1 GTIN/EAN/UPC identifiers when selling through retailers or marketplaces that require them. Internal SKU-only operation remains supported.

## Production requirements

- Use MySQL or PostgreSQL with automated backups, point-in-time recovery, encryption at rest, and tested restores.
- Set `APP_ENV=production`, `APP_DEBUG=false`, HTTPS-only cookies, trusted proxies/hosts, a shared cache, and durable queue workers.
- Run migrations during a controlled deployment and keep rollback/backup procedures.
- Add rate limiting and idempotency keys to public/integration APIs before exposing them.
- Centralize structured logs, error reporting, metrics, uptime checks, queue monitoring, and database alerts.
- Load-test with representative tenant, SKU, invoice, and stock-ledger volumes; define measured SLOs.
- Perform independent security, privacy, accessibility, and country-specific compliance reviews.

## Release gate

A release is internationally production-ready only when migrations, automated tests, frontend build, backup restore test, load test, security review, and target-country legal/accounting review all pass for that release.

## Deployment verification

```bash
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan test
npm ci
npm audit --audit-level=high
npm run build
php artisan optimize
```

Deploy from `.env.production.example` using secrets supplied by the hosting platform. The `/ready` endpoint deliberately returns HTTP 503 in production when debug mode is enabled, the application key is missing, the public URL is not HTTPS, or secure session cookies are disabled.
