=== Maven Connect ===
Contributors: focalshiftai
Requires at least: 6.0
Requires PHP: 7.4
Stable tag: 1.3.3
License: GPL-2.0-or-later

Securely connects this WordPress site to FocalShift Mission Control — one plugin for the
Maven Connect visitor card, site health, one-click login, templates, lead capture, Maven web
chat, booking, agent site-ops (cache, updates, content), and Knowledge + WooCommerce sync.

Pair once with a one-time code; your card's design, wording and settings live in Mission Control
and update on your site automatically — no re-download.

== Description ==

The connector pairs with Mission Control using a one-time code, then stores a per-site token +
HMAC secret server-side. Every call to and from Mission Control is signed and replay-guarded. Your
WordPress admin password is never shared.

Features:
* Secure pairing + signed heartbeat (site health in Mission Control).
* [focalshift_form] lead-capture shortcode → your Inbound leads.
* Maven web chat: your own FocalShift Maven answers site visitors, captures leads and books calls.
* Login with FocalShift (companion plugin).
* Agent site-ops: cache purge, apply updates, one-click login, backup, logs, content publishing.
* Copyright hold (0.26.0): if FocalShift receives a complete copyright notice naming a page on this site, Mission Control may place that one page on a reversible hold — it is never deleted, visitors cannot see it while held, and you see the case, the reason and the way to dispute it in your dashboard.
* Booking surface (new in 0.3.0).

== Booking (0.3.0) ==

Surface your FocalShift booking page anywhere on this site. One primitive — an iframe of your
public, slug-gated booking page (bookpage.php) — so it always matches the services, providers,
hours, intake form and theme you manage in Mission Control. Nothing is re-implemented and nothing
drifts.

Placements:
* Shortcode: `[focalshift_booking]` renders your booking page inline (auto-height).
  - `[focalshift_booking service="12"]` preselects a service.
  - `[focalshift_booking mode="button" label="Book now"]` renders a button that opens the wizard
    in an overlay.
  - `[focalshift_booking height="760"]` sets the inline height.
* Block: add the **FocalShift Booking** block (Embed category) — same output, no shortcode needed.
* Floating button: enable a site-wide "Book a time" button under FocalShift → Booking.

Your booking slug and display prefs are fetched **live** from Mission Control over the existing
signed channel (short-lived cache), so a slug rename or a service change propagates automatically —
no re-setup, no re-pairing. No signed token is ever placed in cached HTML; the iframe carries only
your public booking slug and all live data loads inside it from the Mission Control origin, so page
caching (WP Rocket, LiteSpeed, …) is safe.

If a host blocks framing, use `mode="button"` with new-tab open mode (set in Mission Control) as a
fallback.

== Changelog ==

= 1.3.3 =
* If you add your Help Desk page from FocalShift (with the FocalShift Toolkit), it becomes this site's help centre: the /help address now takes visitors to it, so your site never shows two help centres.

= 1.3.2 =
* SEO titles and descriptions can now be set from Mission Control on sites that use the FocalShift Toolkit's own SEO module (no Yoast or Rank Math needed).

= 1.3.1 =
* New FocalShift Testimonials block and [focalshift_testimonials] shortcode: your approved testimonials from Mission Control, only where your clients agreed. Withdrawn testimonials leave your site within 5 minutes.

= 1.3.0 =
* Your help centre can now live on this site at /help: your Public Knowledge pages and answers from Mission Control, inside your theme, with search and "Was this helpful?". Switch it on in Maven Connect.
* Maven’s answers in the chat card now say where they came from ("From: …") when they use one of your Public Knowledge entries.

= 1.2.3 =
* When someone from your team takes over a chat, visitors now see their first name and photo ("Sally has joined"), plus "Sally is typing…" while they write.

= 1.2.2 =
* WooCommerce buyers now arrive in your Customers: a paid order adds the buyer as a contact in Mission Control, and a repeat buyer updates the same contact instead of making a second one.

= 1.2.1 =
* Shop switches you can trust: Mission Control can now offer the FocalShift shop to every site without changing one that has not chosen it, and "Replace WooCommerce with the FocalShift shop" is a button on this screen. A WooCommerce store keeps /shop until you press it.

= 1.2.0 =
* The FocalShift shop on your own domain. Products, cart and checkout from Mission Control appear at /shop, /product/<name>, /cart and /checkout in your theme — the right-side cart drawer, quick add, the "Choose options" pop-up, light and dark, and the cart riding the Maven launcher. On by default when a site with a FocalShift storefront connects; a site that was already connected keeps what it has until you press "Use the FocalShift shop on this site". If WooCommerce is active it keeps the shop until you choose "FocalShift shop" in Mission Control. Place products on any page with [focalshift_products]. With the FocalShift Storefront theme the whole site wears the design.

= 1.1.2 =
* Mission Control now knows when you have switched this site's Artifacts wall off, and stops offering it as a place to send things.

= 1.1.1 =
* Updating from FocalShift now installs the newest Maven Connect in one go (it used to install whatever WordPress had cached first, which could be an older release). A site owner can switch the Artifacts wall off; then /artifacts/ is not shown and nothing can be sent to the wall.

= 1.1.0 =
* Your Artifacts wall. Everything you send to this site with Shift This and choose "Artifacts wall" gets its own page at /artifacts/<name>/, and /artifacts/ shows them all as a wall — in your theme's own fonts and colours, with the source always credited and linked, share buttons, and "Add to my wall" for FocalShift members. Place the wall on any page with the [focalshift_artifacts] shortcode. Nothing else changed.

= 1.0.7 =
* Mission Control can now send a curated story to your site as a draft with its featured image, category, tags and a canonical link to the original source set for you. With Yoast or Rank Math active the canonical link goes into their own field; without one, this plugin adds it to that post only. Nothing else changed.

= 1.0.6 =
* The three screens in your WordPress admin (Maven Connect, Ads on my site, Cookies & consent) now draw in the FocalShift Graphite look: the same panels, buttons, icons and type as the Entrepreneur's Toolkit, in light and dark. Sharper corners on the cookie notice, the Maven chat card and the booking window. Nothing else changed: every setting, code and switch is where it was.

= 1.0.5 =
* One name. The menu in your WordPress admin now says Maven Connect, and the platform is called FocalShift everywhere this plugin speaks to you (it used to say FocalShift Ai). Nothing else changed: no setting, address or connection moved.


= 1.0.4 =
* Themes from Mission Control. Pick a free WordPress theme in Mission Control's template selector, preview it on your own pages before anything changes, then switch your site to it only when you confirm. A previewed theme you decide against can be removed again; nothing else on your site is touched.

= 1.0.3 =
* One code now connects everything. The code from Mission Control's Connect a site connects Maven Connect and the Entrepreneur's Toolkit on this site, whichever one you paste it into. Each plugin keeps its own connection.
* New installs keep themselves up to date with WordPress's automatic updates. If your site already runs Maven Connect, the FocalShift Ai screen offers one click to turn them on, and you can turn them off again on the Plugins screen.
* The Login with FocalShift Ai card now tells you when that plugin is active but not set up yet.

= 1.0.2 =
* The FocalShift Ai screen in your WordPress admin now names Mission Control's menus as they are today. To connect a site, open WordPress Sites in Mission Control (a direct link is on the screen) and click Connect a site. Website chat is switched on or off under Meet Maven, Maven Connect, Sites. Your booking surface is switched on under Revenue, My Page, and the booking buttons now open that page directly. Nothing else changed.

= 1.0.1 =
* Podcast storage: a chunked upload route to your own server and your WordPress Media Library. When you choose this site (or your FocalShift server) as the place your podcast episodes live, Mission Control sends the episode in pieces of up to 8 MB, so a large episode is not refused by your host's upload limit and a dropped connection only costs the last piece. On your FocalShift server the episode is kept in its own folder (wp-content/uploads/focalshift-podcasts) and is not added to your Media Library; on any other connected site it becomes a normal Media Library item. Only MP3 and M4A audio and JPEG or PNG cover art are accepted, every piece is signed by Mission Control and checked here, and an upload you abandon is cleaned up after a week. Nothing else changed.

= 0.26.2 =
* Your card now follows the Identity switches in Mission Control (Maven Connect, Identity). Turn off your profile photo, your name, your headline, your short bio, the verified badge or the link to your community profile, and the card on your site stops showing it. Turn on availability and the card shows "Available now" during the weekly hours you set for Connect Calls (or always, if your HelpDesk is set to always online) and "Away right now" otherwise. Anything you turn off is left out of the page entirely, not just hidden. If you never touched these switches, your card looks exactly as it did. Nothing else changed.

= 0.26.1 =
* Fixes an update fault: when Mission Control updated a single plugin on your site (including this one), WordPress switched that plugin off before replacing its files and nothing switched it back on, so the plugin stayed inactive until someone clicked Activate in your dashboard. Mission Control's update now remembers that the plugin was on, turns it back on afterwards, checks that it really is on, and reports honestly if it is not. Nothing else changed.

= 0.26.0 =
* Copyright hold. When FocalShift Ai receives a complete copyright notice under the DMCA naming a page on your site, Mission Control's copyright desk can place that one page on hold: visitors get a not-found page, the page is never deleted, and you see it in your dashboard marked "On hold (copyright notice)" with the case number, the date and a link to your Dispute Center, where you can send a counter-notice. While a page is held it cannot be published, trashed or deleted from your dashboard; you can still edit it. The hold is released automatically when a counter-notice runs its statutory clock, or by the desk. Every hold and every release is signed, can only be used once, and is written to your site's activity log.

= 0.25.4 =
* Mission Control can now switch a named plugin on your site off (or back on) from the cockpit, instead of someone needing shell access to your server. It only ever works on a short built-in list of plugins, in a built-in direction — it can never be pointed at an arbitrary plugin, it can never switch off this plugin, your Toolkit or the Design Canvas builder, and every request is signed and can only be used once. Nothing on your site changes until Mission Control asks, and every ask is recorded in your site's activity log.

= 0.25.3 =
* The company name now reads FocalShift Ai in full everywhere this plugin says it: the FocalShift Ai menu in your dashboard, the FocalShift Ai column on your Posts, Pages and Products lists, the booking block's description in the editor, and the wording on the plugin's own screens. Wording only — no setting, no design and nothing this plugin does has changed.

= 0.25.2 =
* Fixes a stray line of code that was printed as visible text at the foot of every page when the cookie banner was switched on. The banner, the choices it saves and the small “Cookie choices” re-open button all behave exactly as before — the junk text is simply gone.

= 0.25.1 =
* Ad slots are now signed end to end. Every ad your site shows arrives with a short-lived signature from Mission Control, and only a click carrying that signature is ever counted or paid — so nobody, including a copy of this plugin, can manufacture a click on your site or credit one site's click to another.
* If an ad ever arrives without that signature, the slot stays empty rather than showing something that could never be counted. Nothing about how your ads look, where they appear, or your emergency off switch has changed.

= 0.25.0 =
* Ads Publisher restored (WP-ADS-1, ruling 238): a switchable module (default OFF) that lets a member host FocalShift Ai sponsored slots on her WordPress site and earn a 25% share of every real view and click. Shortcode [focalshift_ad], a Gutenberg block and a sidebar widget; the creative is fetched fresh per visitor from Mission Control, labelled Sponsored, and collapses on a no-fill. Ads never show for site editors or on cart/checkout. An emergency local switch in wp-admin turns every ad off instantly. Mission Control counts the billable events and keeps the ledger; this side counts nothing and pays out nothing.

= 0.24.0 =
* Cache purge now also clears the FocalShift Toolkit's own page cache (the Performance module), so a purge from Mission Control reaches every cached page on your site.

= 0.23.0 =
* Site audit log: your site now keeps a plain record of what happened on it - who signed in and who failed to, users created or deleted and roles changed, plugins and themes activated, updated or switched, changes to the settings that matter, and any use of the built-in file editor - and Mission Control collects it, so you can read it from the Hub instead of only from wp-admin.
* Everything Mission Control asks your site to do was already recorded here; now that record reaches Mission Control too, in the same timeline as everything else.
* The log is a switchable module. It is on by default because it only watches - it changes nothing a visitor sees - and you can switch it off from either Mission Control or wp-admin. Switched off, it records nothing at all.
* Nothing is dropped quietly: if Mission Control has not collected for a very long time and the buffer fills, the log says in its own words how many events could not be kept.
* Passwords and keys are never recorded. A refused sign-in records the name that was tried and nothing else.

= 0.22.0 =
* SEO management (inbound, HMAC-signed): seo/get and seo/set read and write a post's SEO title,
  meta description and slug through the SEO plugin the site actually runs — Yoast SEO and Rank Math
  are detected automatically. If neither is installed, the connector says so honestly instead of
  writing meta nowhere.
* WooCommerce management (inbound): wc/product-update changes a product's price, sale price, stock,
  description or status through WooCommerce's own setters, and wc/coupon-create creates a coupon
  (percent, fixed cart or fixed product, with optional expiry). An existing coupon code is refused,
  never overwritten. Both routes answer honestly when WooCommerce is not installed.
* Comment moderation (inbound): comments/list shows held, approved or spam comments, and
  comments/moderate approves, holds or marks one as spam. There is deliberately no delete —
  permanent deletion stays a human action in wp-admin.
* Every new route uses the payload-bound signature (tamper-proof in flight), the once-nonce replay
  guard and the WP-side audit ring — the same discipline as every 0.7.0 write route. Nothing about
  existing routes changed; 0.21.2 sites keep working untouched.

= 0.7.0 =
* Maven web chat (visitor plane): the on-site chat is now your OWN FocalShift Maven, not a
  third-party live-chat bubble. When enabled, the footer loads the first-party Maven web widget by
  its public widget key — it answers visitor questions grounded in your knowledge base, captures
  leads, and deep-links to your real booking page. The per-site HMAC secret never reaches the
  browser, and the previous third-party chat script is removed.
* Agent site-ops (inbound, HMAC-signed): new routes the Mission Control WordPress cockpit calls —
  cache/purge and cache/purge-all (detects WP Rocket / W3TC / LiteSpeed / WP Super Cache / SiteGround
  + object cache), wordpress/update (apply core, plugin and theme updates), magic-login (single-use,
  60-second, audited one-click admin login), backup (via your backup engine, honestly gated if none),
  and logs (read-only, secret-redacted debug.log tail).
* Content management (inbound): content/list, content/create (draft by default), content/update, and
  content/publish for posts and pages, plus media/list and media/delete — so your agent can draft and
  publish to your site.
* redirects (list; add/delete behind confirm on the Redirection plugin).
* Security hardening: a stored once-nonce list rejects a replayed signed request within the 5-minute
  window for every privileged/destructive write, and every privileged call is audited on the WP side.
  The existing HMAC signature scheme and payload-bound write signatures are unchanged.

= 0.6.0 =
* Media Library push (BYOS): adds the signed /wp-json/focalshift/v1/media-upsert route so Mission
  Control can push generated images, audio and video straight into this site's Media Library. Files
  arrive as proper attachments (metadata and thumbnails generated) and are returned with their public
  URL and attachment id. The request is HMAC-signed and payload-bound like every other channel — no
  WordPress login or admin password is involved.

= 0.4.0 =
* Train Maven on your content: index published pages, posts and custom post types into your
  FocalShift Knowledge base. Page-builder layouts (Elementor, Divi, Beaver Builder, Oxygen, Bricks)
  are rendered before indexing, so Maven sees what your visitors see. Drafts are never sent and
  unchanged content is skipped on re-sync (content-hash dedup). Bulk sync is resumable on shared
  hosting, and single-item changes sync automatically on publish, trash and delete.
* WooCommerce: sync your whole catalogue (every product type, including subscriptions, bundles and
  bookings) plus your valid coupon codes so Maven can recommend products, quote live price and stock,
  and offer real codes. Order lookups use the customer's signed identity, coupons stage for one-click
  apply on the visitor's next cart load, and captured leads can mirror to WooCommerce customers.
* A "FocalShift Ai" column on the Posts, Pages and Products lists shows Indexed / Out of date / Not
  indexed at a glance.
* Logged-in WooCommerce customers get a signed shopper identity token so Maven can personalise —
  the email is SHA-256 hashed and never leaves the site in plaintext.

= 0.3.0 =
* Add booking surface: [focalshift_booking] shortcode, FocalShift Booking block, and an optional
  site-wide floating "Book a time" button. Live slug + prefs via the existing signed channel.
* Admin: a Booking card with status, the shortcode, the floating-button option and deep links.

= 0.2.0 =
* Maven Chat bubble.

= 0.1.0 =
* Initial connector: pairing, heartbeat, lead capture, templates, Login with FocalShift Ai.
