=== Live Quote Package Builder ===
Contributors: khurshidbilal
Tags: live quotes, package builder, booking, configurator, stripe
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.11
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create live package quotes with guided package builders, bookings, coupons, availability rules, custom steps, and optional Stripe Checkout deposit sessions.

== Description ==

Live Quote Package Builder helps service, event, rental, and custom-package businesses create guided package configurators with real-time pricing inside WordPress.

It includes editable templates, dynamic pricing, quote rules, booking records, custom steps, coupon codes, availability protection, optional Stripe Checkout deposit sessions, and customer/admin email notifications.

Developed by Khurshid Bilal (KhurshidBilal.com), CEO of Webzeno.com.

= Key features =

* Visual package configurator shortcode.
* Six starter templates for event rental, floral bar, photo booth, catering, beauty services, and universal packages.
* Editable packages, add-ons, delivery options, events, text, colors, fonts, currency, defaults, and quote rules.
* Custom step builder with fields, image, description, content, and shortcode support.
* Booking records saved in WordPress admin.
* Coupon codes and availability / double-booking controls.
* Optional Stripe Checkout deposit sessions only. No public Stripe webhook endpoint is included in this WordPress.org version.
* Admin and customer email notifications.
* Elementor friendly via shortcode.
* Documentation page inside the WordPress admin.
* Free support by email at info@webzeno.com.

= Shortcodes =

Add the configurator to any page:

`[livequpa_builder]`

Add a thank-you page:

`[livequpa_thank_you]`


= Free support =

For free setup help and general plugin questions, email info@webzeno.com. Please include your WordPress version, PHP version, plugin version, and a screenshot of the issue when possible.

= Source code and build process =

This plugin does not require a build step. The JavaScript and CSS shipped in `assets/` are human-readable source files. A copy of the frontend JavaScript source is also included at `src/frontend.js` for review and maintenance.

= External services =

Live Quote Package Builder can connect to Stripe only when the site administrator enables Stripe payments and enters Stripe API keys.

When a visitor clicks the payment/deposit button, the plugin sends the checkout amount, currency, customer email, selected package name, and booking metadata to Stripe to create a checkout session. This request is sent to `https://api.stripe.com/v1/checkout/sessions`.

Stripe service terms: https://stripe.com/legal
Stripe privacy policy: https://stripe.com/privacy

If Stripe payments are not enabled, Live Quote Package Builder works locally for configurators, quote requests, booking records, coupons, availability rules, templates, and admin settings.

= Privacy =

The plugin stores booking details submitted by visitors, such as name, email, phone, event details, selected package, add-ons, custom step answers, totals, coupons, and payment status. Site owners are responsible for explaining this data collection in their own privacy policy.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP from Plugins > Add New.
2. Activate Live Quote Package Builder.
3. Go to Live Quote Builder > Builder.
4. Select a template and customize packages, add-ons, delivery options, colors, text, payment settings, and emails.
5. Create a page and add `[livequpa_builder]`.
6. Create a thank-you page and add `[livequpa_thank_you]`.

== Frequently Asked Questions ==

= Does it require Stripe? =

No. Stripe is optional. If payments are disabled, bookings and quote requests can still be collected.

= Can I use it with Elementor? =

Yes. Add the shortcode with Elementor's Shortcode widget.

= Does it block duplicate bookings? =

Yes, if you enable availability rules in the admin settings.

= Can I add my own questions? =

Yes. Use Custom Steps to add fields, content, images, and shortcodes.

= Does this plugin connect to a Live Quote Package Builder server? =

No. This upload version does not include cloud/license/support connections or public webhook endpoints. The only external service is optional Stripe Checkout session creation when enabled by the site administrator.

== Screenshots ==

1. Template selection and builder settings.
2. Frontend package configurator.
3. Custom step builder.
4. Booking detail screen.
5. Coupons, availability, and payment settings.

== Changelog ==

= 1.0.11 =
* Security: Further hardened thank-you page output so invalid or missing booking access tokens show only generic confirmation text.

= 1.0.10 =
* Security: Hardened thank-you page output so invalid or missing booking access tokens show only generic confirmation text.

= 1.0.9 =
* Security: Added signed thank-you booking access tokens so public thank-you pages do not reveal booking status from booking_id alone.

= 1.0.8 =
* Added explicit check_ajax_referer() validation to frontend AJAX booking and Stripe Checkout actions.
* Clarified that Stripe integration creates Checkout sessions only and does not include a public webhook endpoint.

= 1.0.7 =
* Strengthened AJAX nonce verification and request validation for frontend booking and Stripe Checkout actions.
* Tightened admin action nonce/permission handling for reset and template apply actions.
* Minor sanitization and internal cleanup improvements for WordPress.org review.

= 1.0.6 =
* Final reviewer fix: no public Stripe webhook endpoint, no php://input webhook handling, and no webhook-based booking status update path in this WordPress.org build.

= 1.0.5 =
* Removed the public Stripe webhook endpoint from the WordPress.org version and kept Stripe Checkout creation behind explicit customer action.

= 1.0.4 =
* Cleaned internal prefixes to use the unique livequpa prefix.

= 1.0.3 =
* Internal review cleanup: updated settings option/group naming and final sanitization consistency.

= 1.0.1 =
* Improved settings sanitization and shortcode output escaping for WordPress.org review.

= 1.0.0 =
* Initial WordPress.org-ready release.

== Upgrade Notice ==

= 1.0.11 =
Security-focused thank-you page review update.

= 1.0.10 =
Security-focused thank-you page review update.

= 1.0.0 =
Initial public release.
