HXSE — Code-First Search

1.7.0

• Added: Filter UI inside the iframe embed view — set embed.show_filters to let visitors filter within the embed (WordPress sources only)
• Added: Automatic iframe height notification via postMessage — the embed reports its height to the parent on load, resize, and after htmx filtering
• Added: postMessage target origins limited to allowed_origins (no wildcard) for security
• Added: htmx and hxse.js are inlined into the embed page when filters are enabled
• Note: Parent pages must add a small receiver snippet to auto-resize the iframe (see manual)

1.6.0

• Added: iframe embed view — access ?hxse_embed={schema_id} to output a list-only, self-contained HTML page for embedding on external landing pages
• Added: embed schema key — enabled, allowed_origins, title, per_page
• Added: Clickjacking protection — Content-Security-Policy: frame-ancestors restricts which domains may embed the view (same-origin only when no origins are specified)
• Added: includes/embed.php — embed view rendering and frame security headers

1.5.0

• Added: Merge mode (sources key) — combine WordPress posts, RSS feeds, and APIs into a single chronological list
• Added: hxse_fetch_merged_data() — fetches, normalizes, and merges multiple data sources
• Added: Source normalizers for wp_query / rss / api / xml into a common format (title, link, date, excerpt, source, raw)
• Added: orderby / order / limit keys for merge mode sorting
• Added: map key — maps API/XML response keys to the common format
• Added: templates/merged.php — default template with source badges
• Added: Merge list styles in hxse.css

1.4.0

• Added: source: ‘rss’ mode — fetches RSS 2.0 and Atom feeds and converts to PHP array automatically
• Added: source: ‘xml’ mode — fetches any XML and converts to PHP array using xpath key
• Added: hxse_parse_rss() — RSS 2.0 / Atom parser
• Added: hxse_parse_xml() — generic XML parser with xpath support
• Added: hxse_simplexml_to_array() — recursive SimpleXMLElement to array converter
• Improved: hxse_do_remote_fetch() now handles json / rss / xml based on source key
• Improved: backward-compatible hxse_do_api_request() alias retained

1.3.0

• Added: Cache mapping (hxse_cache_map option) — tracks schema ID → filename relationships to detect orphaned files
• Added: Orphan file detection — warns when JSON files exist without a corresponding schema
• Added: “今すぐ更新” button — manually re-fetches API and regenerates JSON from admin UI (API schemas only)
• Added: Bulk delete all cache button with total file size display
• Added: Delete orphaned files button in admin UI
• Improved: hxse_delete_static_cache() now also removes the mapping entry
• Improved: uninstall.php now also deletes the hxse_cache_map option

1.2.0

• Added: cache_mode: ‘static’ — saves API responses as JSON files in wp-content/hxse-cache/ (blocked from web access via .htaccess)
• Added: cache_file key — custom filename for the static JSON cache
• Added: includes/cache.php — cache directory management (init, load, save, delete)
• Added: Admin UI — static JSON cache list with individual delete buttons (Settings → HXSE)
• Added: uninstall.php — removes wp-content/hxse-cache/ directory on plugin uninstall
• Improved: refactored hxse_fetch_api_data() to support both transient and static cache modes

1.1.0

• Added: source: ‘api’ mode — fetch data from external APIs (GAS, REST API, etc.) via PHP and render with a custom theme template
• Added: token key — appended as _token GET parameter for simple API authentication
• Added: cache key — transient-based caching for API responses (seconds, 0 to disable)

1.0.2

• Added: SECURITY.md — security policy, vulnerability reporting, and disclosure timeline
• Added: MAINTENANCE.md — architecture overview, htmx update steps, and fork guide
• Docs: Updated ai-reference.md — added design philosophy and maintainability section for AI agents

1.0.1

• Grid columns now controllable via columns schema key (CSS variable injection).
• Table headers customizable via table_columns schema key.
• Assets now loaded only on pages containing the [hxse] shortcode.
• Refactored hxse.js: replaced var with const/let.
• Taxonomy conditions now auto-detect slug vs term_id.
• Fixed: escape the_title() in templates for XSS hardening.

1.0.0

• Initial release.
• Filter types: search, taxonomy, meta, date, relation.
• UI types: select, radio, checkbox, range.
• URL parameter sync with browser history support.