=== Well Done Suite Connector — Changelog ===

The current release is listed in readme.txt. This file keeps the full history.

= 0.6.4.1 =
* Fix: saving the cookie notice in the console, or publishing the privacy notice page, now clears the site's page cache (LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache or SiteGround Optimizer), so visitors see the change straight away instead of the page from before it.

= 0.6.4 =
* The cookie notice can be set in the console under Settings → Privacy and is shown on this site by the connector: its wording, buttons and position, and whether the theme's own notice is switched off. Each visitor's answer goes to the business's consent log with the words they were shown.
* The console can publish a privacy & cookies notice page and set it as the privacy policy page. A page the connector did not make — your terms, say — is never overwritten; a new page is created.
* New signed endpoints `GET /wds/v1/privacy`, `PUT /wds/v1/privacy/banner` and `POST /wds/v1/privacy/notice`, and the public `POST /welldosu/v1/consent`. All are listed on Settings → Well Done Suite — Overview.
* Where the Well Done Suite plugin or the Well Done Suite Website plugin already shows a notice, the connector's stays off.

= 0.6.3 =
* Fix: when the console sends a specification to a variable product, the response now names each attribute that was left unchanged because the product's variations are built from it, so the console can show it. Attributes whose values already match are not reported.

= 0.6.2 =
* Fix: saving a specification on a variable product no longer replaces the attributes its variations are built from, and no longer takes the site down when a SKU is already used by one of those variations. The rest of the update still saves, and the response lists anything that was left unchanged.

= 0.6.1 =
* Product updates from the console can set cross-sells and upsells (by SKU), attributes — shared attributes for filters, product-only attributes for the rest of the specification — the SEO title and meta description, alt text on product images, and a bundle with a discount. Attributes that make variations are never changed.
* The SEO title and description are kept in the connector’s own product fields, and also written to Yoast SEO, Rank Math or SEOPress when that plugin is active. With no SEO plugin active, the connector prints them on the product page.
* A product read includes its cross-sells, upsells, attributes, SEO fields and bundle.

= 0.6.0 =
* Shop orders can be moved along from the console: status (pending payment, on hold, processing, completed or cancelled), order notes and tracking, through the new signed `PATCH /wds/v1/orders/{id}`. Status changes go through WooCommerce, so its customer emails and stock changes happen as in wp-admin. Each change needs the administrator who connected the site to be allowed to edit shop orders. Orders are still never created, refunded, repriced or deleted.
* One order now comes with its order notes, and every order with the tracking recorded in the console.
* The suggested privacy-policy text and the Overview screen now list every site setting the connector reads, including the time format and the first day of the week.

= 0.5.0 =
* Security: every response from the connector's REST routes is now sent with WordPress's no-cache headers and marks the request with `DONOTCACHEPAGE`, the signal caching plugins such as LiteSpeed Cache read. Before, a page cache or host CDN in front of WordPress could store a signed response and serve it to an unsigned request for the same address.
* Optional customer portal on the WooCommerce My Account page: shop orders, quotes, invoices, support requests and bookings in one place, in the design set in the console. Off by default; it needs a switch here and one in the console.
* The orders endpoint can be narrowed to one customer by billing email.
* Fix: connecting a site could fail with "Connection request expired" on hosts with a persistent object cache (for example LiteSpeed with Memcached), because the cache dropped the one-time pairing code. The code is now stored in the database, still expires after five minutes and is still single-use; WP-Cron removes expired codes.

= 0.4.0 =
* The form shortcode is now `[welldosu_form slug="…"]`. Replace `[wds_mechanism slug="…"]` on your pages; the console shows the new shortcode.
* All plugin functions, classes, constants, options and hooks use the distinct `welldosu` prefix. An existing connection is carried over automatically on update.
* Narrower scope: the connector no longer lists WordPress users, media or aggregate counts, and the settings endpoint returns only the site name, address, language, time zone and date format. The console keeps people and statistics itself.
* Orders are read-only. Order creation, status changes, invoice emails and refunds are handled in the console, not on the site.
* Removed unused product-deletion and term-creation routes, and unused background event and task code.
* Images copied into the media library for a product are attributed to the administrator who approved the connection.
* The activation notice appears once, on the Plugins screen only, and not at all when the site is already connected.

= 0.3.6 =
* Product images and services from the console can be sent to WooCommerce.
* Images and PDF files can be uploaded from the console to the media library.
* The form shortcode shows the real form built in the console, in an iframe.

= 0.3.5 =
* The console can save catalogue edits back to WooCommerce products and variations.

= 0.3.4 =
* Fixed the signed disconnect request so Disconnect also releases the connection in the service.
* Added the read-only identity endpoint.

= 0.3.3 =
* Restricted single-item content reads to publicly registered post types.

= 0.3.2 =
* Corrected the idempotency-key and content-status disclosures.

= 0.3.1 =
* Fixed a fatal error for refund IDs in the orders endpoint, pairing next to the Well Done Suite plugin, requests without a body, and sites installed in a subdirectory.

= 0.3.0 =
* Removed remote plugin installation and activation, user and settings changes, remote HTML embeds and the generic task dispatcher.
* Bound content changes to the administrator who approved the connection; removed caller-selected authors and permanent deletion.

= 0.2.0 =
* Added signed, replay-protected and idempotent content changes.

= 0.1.0 =
* Initial read-only connector, pairing screens and endpoint overview.
