New “Where the widget loads” settings section: master on/off toggle (default on), “Show only on these paths” include rules, and “Never show on these paths” exclude rules. Wildcards * and ? are supported via fnmatch, matched against the request path.
Connect-return handler accepts both xpayacp_* and legacy asp_* query parameters from the xpay onboard page.
$_GET index checks refactored to explicit branches so static analysers can verify each access.
$xpayacp_options and $xpayacp_opt variables in uninstall.php properly prefixed.
0.4.0
Renamed to xpay✦ Agentic Commerce for Publishers. New slug xpay-agentic-commerce-for-publishers. The previous working name overlapped with Automattic’s Storefront theme.
Native WordPress settings screen. The admin settings screen is now a standard wp-admin page built with the Settings API. The embedded widget.xpay.sh/embed/admin/settings iframe has been removed; no remote UI is loaded into wp-admin.
Auto-injection of the widget removed. The widget no longer appends itself to post content. It renders only where you place the [xpay_recs] shortcode or the Recommendations block. Existing sites with the auto-inject toggle previously on must add the shortcode or block where they want the widget.
Signed /page-context REST endpoint. The widget iframe now signs its page-context requests with an HMAC derived from the per-site secret minted at activation. The endpoint no longer accepts unauthenticated reads.
Tightened admin handlers. The disconnect action now runs through a nonced admin-post.php handler with an explicit manage_options capability check.
All function, class, constant, option, transient and shortcode-internal prefixes consolidated under xpayacp_ / XPAYACP_.
0.3.6
Pre-WordPress.org-submit hardening pass against the published guidelines.
/llms.txt body is now composed from pre-escaped values.
Readme privacy section reworded to match the code’s actual behaviour.
Added empty index.php silence files to every plugin subdirectory.
0.3.5
Front-end widget script now flows through wp_register_script / wp_enqueue_script / script_loader_tag.
Readme short description rewritten in plain English.
0.3.4
Plugin URI updated to the dedicated landing page.
Documentation set published at docs.xpay.sh/en/publishers/wordpress-plugin/*.
0.3.0
Thin-shell architecture — front-end widget runs inside a sandboxed iframe.
0.2.0
One-click “Open xpay dashboard” link from the connected settings screen.
0.1.0
Initial release.
Shortcode and Gutenberg block for placing recommendation widgets manually.
/.well-known/agent-storefront.json emitter with detect-existing safety check.
