=== Well Done Suite Connector — Changelog ===

The current release is listed in readme.txt. This file keeps the full history.

= 0.6.1 =
* Product updates from the console can set cross-sells and upsells (by SKU), attributes — shared attributes for filters, product-only attributes for the rest of the specification — the SEO title and meta description, alt text on product images, and a bundle with a discount. Attributes that make variations are never changed.
* The SEO title and description are kept in the connector’s own product fields, and also written to Yoast SEO, Rank Math or SEOPress when that plugin is active. With no SEO plugin active, the connector prints them on the product page.
* A product read includes its cross-sells, upsells, attributes, SEO fields and bundle.

= 0.6.0 =
* Shop orders can be moved along from the console: status (pending payment, on hold, processing, completed or cancelled), order notes and tracking, through the new signed `PATCH /wds/v1/orders/{id}`. Status changes go through WooCommerce, so its customer emails and stock changes happen as in wp-admin. Each change needs the administrator who connected the site to be allowed to edit shop orders. Orders are still never created, refunded, repriced or deleted.
* One order now comes with its order notes, and every order with the tracking recorded in the console.
* The suggested privacy-policy text and the Overview screen now list every site setting the connector reads, including the time format and the first day of the week.

= 0.5.0 =
* Security: every response from the connector's REST routes is now sent with WordPress's no-cache headers and marks the request with `DONOTCACHEPAGE`, the signal caching plugins such as LiteSpeed Cache read. Before, a page cache or host CDN in front of WordPress could store a signed response and serve it to an unsigned request for the same address.
* Optional customer portal on the WooCommerce My Account page: shop orders, quotes, invoices, support requests and bookings in one place, in the design set in the console. Off by default; it needs a switch here and one in the console.
* The orders endpoint can be narrowed to one customer by billing email.
* Fix: connecting a site could fail with "Connection request expired" on hosts with a persistent object cache (for example LiteSpeed with Memcached), because the cache dropped the one-time pairing code. The code is now stored in the database, still expires after five minutes and is still single-use; WP-Cron removes expired codes.

= 0.4.0 =
* The form shortcode is now `[welldosu_form slug="…"]`. Replace `[wds_mechanism slug="…"]` on your pages; the console shows the new shortcode.
* All plugin functions, classes, constants, options and hooks use the distinct `welldosu` prefix. An existing connection is carried over automatically on update.
* Narrower scope: the connector no longer lists WordPress users, media or aggregate counts, and the settings endpoint returns only the site name, address, language, time zone and date format. The console keeps people and statistics itself.
* Orders are read-only. Order creation, status changes, invoice emails and refunds are handled in the console, not on the site.
* Removed unused product-deletion and term-creation routes, and unused background event and task code.
* Images copied into the media library for a product are attributed to the administrator who approved the connection.
* The activation notice appears once, on the Plugins screen only, and not at all when the site is already connected.

= 0.3.6 =
* Product images and services from the console can be sent to WooCommerce.
* Images and PDF files can be uploaded from the console to the media library.
* The form shortcode shows the real form built in the console, in an iframe.

= 0.3.5 =
* The console can save catalogue edits back to WooCommerce products and variations.

= 0.3.4 =
* Fixed the signed disconnect request so Disconnect also releases the connection in the service.
* Added the read-only identity endpoint.

= 0.3.3 =
* Restricted single-item content reads to publicly registered post types.

= 0.3.2 =
* Corrected the idempotency-key and content-status disclosures.

= 0.3.1 =
* Fixed a fatal error for refund IDs in the orders endpoint, pairing next to the Well Done Suite plugin, requests without a body, and sites installed in a subdirectory.

= 0.3.0 =
* Removed remote plugin installation and activation, user and settings changes, remote HTML embeds and the generic task dispatcher.
* Bound content changes to the administrator who approved the connection; removed caller-selected authors and permanent deletion.

= 0.2.0 =
* Added signed, replay-protected and idempotent content changes.

= 0.1.0 =
* Initial read-only connector, pairing screens and endpoint overview.
