*** WooCommerce Extension Changelog ***

2026-09-16 - version 1.1.17
* Resolve a page by slug/path on GET /payhelm/v1/pages so PayHelm can find a page from its URL instead of its numeric id


2026-09-14 - version 1.1.16
* Keep reconnect secrets out of the iframe URL; deliver private_key/api_token via postMessage to PayHelm origins only


2026-09-14 - version 1.1.15
* Detect PayHelm private_key mismatch (reinstall) and open the reconnect / link-site flow with owner-gated reconnect payload


2026-09-08 - version 1.1.14
* WordPress-only (no WooCommerce): load the link-site iframe so PayHelm can claim the store without WooCommerce OAuth

2026-09-08 - version 1.1.13
* WordPress-only (no WooCommerce): do not force the onboard iframe that auto-starts wc-auth; pass store_less in the iframe payload

2026-09-08 - version 1.1.12
* Fix install/auth redirect loop: stop esc_url() from rewriting the iframe store_url host (broke HMAC verify → 400 → wc-auth loop)
* Defer PayHelm register_store until admin load when WooCommerce is available (activation no longer registers store_less without keys)
* Re-register keyless / store_less installs once WooCommerce is available (gated on missing key_id, not /authorize; rotation only via needs_keys)
* Detect WooCommerce with WC() and plugins_loaded priority 20

2026-09-03 - version 1.1.11
* QIT: Tested up to WordPress 7.1 and WooCommerce 11.1
* Align the text domain with the wordpress.org slug (payhelm-for-woocommerce)
* Stop calling load_plugin_textdomain(); WordPress.org loads translations automatically

2026-08-31 - version 1.1.10
* Woo Excellence Verified / QIT: declare HPOS compatibility; refresh WC tested up to 10.9 and plugin headers
* Remove manual Woo: readme header (injected on Woo deploy); normalize Requires PHP to 7.4
* Harden QIT security/plugin-check: DirectDatabaseQuery/PreparedSQL ignores for Woo REST key table, drop uninstall error_log, fix pixel URL string interpolation, enqueue pixel in footer
* Add offline QIT Playwright E2E smoke package under tests/e2e (storefront + admin menu)

2026-08-07 - version 1.1.9
* Replace the PayHelm admin menu icon with the current PayHelm logo (monochrome inline SVG, sized and color-matched to the other admin menu icons)

2026-08-04 - version 1.1.6
* Woo QIT marketplace compliance: add missing i18n text domains, prefix bootstrap functions, hoist the missing-WooCommerce notice out of a nested function
* Replace cURL in uninstall with the WordPress HTTP API (wp_remote_request) and wrap uninstall logic to avoid global scope pollution
* Read the WCPay account option via get_option() instead of a direct database query
* Align the plugin header name with readme.txt ("... for WooCommerce")

2026-08-04 - version 1.1.5
* Allow AI-authored <style> blocks in page/post/template content (e.g. self-contained product carousels) instead of the CSS leaking as visible text
* Fix published Additional CSS: stop encoding ">" to "&gt;" so child-combinator selectors work
* Add custom CSS reset with one-level undo (restore the previous CSS)
* Add basic SEO: per-entity title tag + meta description (no SEO plugin required)
* Expand the AI site-editing REST endpoints

2026-07-23 - version 1.1.4
* Fix: reconnect now rotates the WooCommerce REST key and re-registers when PayHelm has no consumer key/secret on record (needs_keys), so product operations work after delete-reinstall
* Allow clipboard access in the embedded PayHelm app iframe (wp-admin)

2026-07-22 - version 1.1.3
* Security: send uninstall credentials in a signed request body instead of the URL query string

2026-07-22 - version 1.1.2
* Add /media endpoint for AI image upload to the WordPress media library

2026-07-20 - version 1.1.1
* Fix admin iframe login authentication (sign payload with timestamp + HMAC)

2026-06-29 - version 1.1.0
* Auto-provision WooCommerce REST API keys on activation (no wc-auth OAuth step)
* Signed registration with PayHelm server and plugin health endpoint
* WordPress site proxy API for AI: posts, pages, settings, pixel, templates
* Security hardening: HMAC on /secure, dedicated & rotated API token (decoupled from iframe key), timestamped/signed request support, rate limits

2026-05-20 - version 1.0.10
* Declare compatibility with WordPress 7.0

2025-04-21 - version 1.0.8
* Update

2024-09-19 - version 1.0.7
* Bugfixes

2024-07-30 - version 1.0.6
* Bugfixes

2024-07-20 - version 1.0.5
* Bugfixes

2024-07-15 - version 1.0.4
* Bugfixes

2024-07-09 - version 1.0.3
* Update

2024-06-05 - version 1.0.2
* Update

2023-05-01 - version 1.0.1
* Update

2023-01-27 - version 1.0.0
* Initial release
