Security: the Form block’s render callback now verifies the stored shortcode is exactly the first-party [site2crm-form] shortcode before executing it, so a hand-edited block attribute can never coerce the block into running an arbitrary shortcode. Any other tag falls back to the deterministic, individually-escaped script-embed path.
0.3.1
Security: tightened REST permission checks on the admin-bar lead endpoints (/pulse and /dismiss) to require manage_options, matching the admin-only admin-bar UI that calls them.
Compliance: moved all admin-bar, onboarding-wizard, and submenu-page inline scripts and styles into properly enqueued asset files (wp_enqueue_style / wp_enqueue_script with localized config) — no more inline <script>/<style> in admin screens.
Docs: clarified in code that the Form block’s shortcode output is escaped inside the first-party [site2crm-form] shortcode.
0.3.0
New: native Gutenberg blocks — Site2CRM Booking Calendar, Site2CRM Form, Site2CRM AI Agent — searchable in the block inserter with a picker dropdown that lists your forms / agents / booking pages from your account. No more shortcode hunting for block-editor users.
New: Integrations admin page — connect HubSpot, Salesforce, Pipedrive, Nutshell, Zoho, or Zapier via a popup-OAuth flow without leaving WP.
New: Leads admin page — searchable, source-filterable inbox of recent leads pulled from your account.
New: admin-bar bubble — real-time unread-lead count next to the Site2CRM menu, refreshed every 60s via REST.
New: Home onboarding checklist — progress bar tracks form created / agent placed / lead captured / CRM connected.
New: Health & Logs page — connection status, retry-queue counts and recent failures with a one-click re-queue, debug-log tail, per-page chat-bubble exclusion, and GDPR consent settings.
New: [site2crm-chat] and [site2crm-booking] shortcodes — full parity with the existing [site2crm-form]. Drop a chat agent or inline booking page anywhere a shortcode is supported.
New: GDPR consent checkbox on captured forms (opt-in). The widget blocks submission until consent is given and records the consent state with each lead.
New: brand-aware booking card — pulls org name, brand color, and logo from the dashboard payload so embeds match your site, not Site2CRM’s chrome. Per-block accent-color override available.
New: WP-CLI commands — wp site2crm status / test / leads / sync-forms / flush-queue.
New: form-plugin adapters for Gravity Forms, Elementor Pro Forms, Fluent Forms, and Ninja Forms — submissions sync through the same idempotency-keyed pipeline as WPForms + CF7.
New: WP user-registration adapter — new WP signups become leads tagged wordpress:registration (filterable to disable).
New: REST endpoint /wp-json/site2crm/v1/embeddables powers the block picker; /pulse powers the admin-bar heartbeat.
New: i18n setup — npm run make-pot generates languages/site2crm.pot via wp-cli.
Changed: form block defaults to inline-script render (no iframe); form widget mounts directly into the host theme.
Changed: booking block renders a branded “Book a meeting” CTA card opening the booking page in a new tab. Iframe embedding is the SaaS-side follow-up once the booking pages relax frame-ancestors.
Changed: dev-mode asset URLs auto-bust on file change (filemtime cache-buster gated by WP_DEBUG).
Changed: bin/build-dist.sh runs npm run build before zipping; /build/ is now committed so dist zips ship working blocks.
0.2.0
New: 5-step onboarding wizard replaces the bare “paste your org key” page on first install.
New: deep-link signup handshake — popup opens site2crm.io, returns the org key automatically (or via copy-paste fallback for local installs).
New: admin submenus — Forms, AI Chat, Calendar, Analytics — show embed snippets and 30-day usage counts.
New: [site2crm-form] shortcode embeds the Site2CRM-hosted form anywhere.
New: inline quick-create — name your form/widget/booking page in the WP admin and the plugin spins up a starter item with a copy-paste snippet ready.
New: revoked-key admin banner with a one-click reconnect.
New: wizard step 5 fires a real test lead through the full pipeline (auth + transport + ingest + idempotency).
New: debug logger with admin toggle (off by default, org keys redacted).
New: PHPUnit test suite (Brain Monkey, no WordPress bootstrap required).
0.1.1
New: Contact Form 7 adapter. Captures CF7 submissions via wpcf7_mail_sent and routes them through the same idempotency-keyed pipeline as WPForms.
New: honors the HTTP Retry-After header on 429 / 5xx responses, so the plugin defers retries for exactly as long as the server asks (capped at 24 hours).
New: dead-letter admin notice surfaces a count of submissions that failed all retries, so dropped leads don’t go unnoticed before the full Logs UI lands.
0.1.0
Initial release. WPForms adapter ships the end-to-end vertical slice.
New: settings page (org key + Test connection button) at Site2CRM admin menu.
New: submission log table (wp_site2crm_submissions) records every form submission, with idempotency-key dedupe so retries cannot create duplicate leads on the server side.
New: WP-Cron retry queue with exponential backoff (5m / 30m / 2h / 12h, four retries before permanent failure).
New: opt-in “Delete on uninstall” setting (default: off — your lead history is preserved through plugin removal).
New: graceful degradation when WPForms is not installed (admin notice instead of fatal errors).
Extension hooks: site2crm_form_adapters filter (Pro plugin uses this to register Gravity / Elementor / etc.) and site2crm_outgoing_payload filter (custom payload transforms).
