=== OkFlow Widget ===
Contributors: okflow
Tags: feedback, widget, visual feedback, okflow
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Embed the OkFlow visual feedback widget on your WordPress site.

== Description ==

OkFlow Widget is a lightweight WordPress plugin that lets you embed the OkFlow visual feedback widget on your site without editing theme files.

The plugin provides two ways to add the widget:

* **Global injection** — Automatically adds the widget script to every page via `wp_head`.
* **Shortcode** — Use `[okflow_widget]` to embed the widget on specific pages or posts. Supports an optional `token` attribute for per-page tokens.

All widget logic is served remotely from the OkFlow app server. The plugin only injects a single async `<script>` tag, keeping your site fast and lightweight. The settings page also shows a live connection status and your monthly annotation usage, so you can confirm the widget is talking to your OkFlow project without leaving WP Admin.

== Installation ==

1. Upload the `okflow-widget` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. Go to **Settings > OkFlow Widget** to enter your OkFlow snippet token.
4. Save your settings. The widget will now appear on your site.

== Frequently Asked Questions ==

= Where do I find my OkFlow snippet token? =

Log in to your OkFlow account at [app.okflow.io](https://app.okflow.io) and navigate to your project settings to find your snippet token.

= Can I use different tokens on different pages? =

Yes. Use the `[okflow_widget token="YOUR_TOKEN"]` shortcode to override the global token on specific pages or posts.

= Does this plugin slow down my site? =

No. The plugin loads a single script tag with the `async` attribute, so it does not block page rendering. No additional CSS or JavaScript files are enqueued on the front end. The connection-status check that powers the settings page only runs in WP Admin, never on front-end page loads.

= Why does the settings page say "Unverified"? =

The plugin could not reach the OkFlow API to confirm your snippet token when the status was last checked (for example, if your server cannot make outbound HTTPS requests, or OkFlow was briefly unreachable). The widget script itself still loads normally — this only affects the status indicator. Save your settings again to force a recheck.

== Screenshots ==

1. Settings page showing the connected status and monthly annotation usage.
2. The OkFlow feedback widget on a live site.
3. Leaving an annotation on a page element.

== Changelog ==

= 1.2.0 =
* Settings page now shows a real connection status (Connected / Invalid token / Unverified / Not configured) instead of a token-presence guess, backed by the OkFlow snippet-validation API and cached for 10 minutes.
* Connected sites see their monthly annotation usage, with an upgrade link shown for Free-tier projects.
* Removed dead Settings API registrations that the hand-rendered settings page never used.
* `Requires PHP` lowered to 7.4 (no 8.0+ syntax is used by the plugin).
* Added an `Update URI` header pointing at the OkFlow-hosted plugin package.
* Uninstall cleanup is now multisite-aware and removes options (and the cached status) from every site on the network.
* Hardened the injected WordPress-user identity script with `JSON_HEX_TAG | JSON_HEX_AMP` escaping.
* Fixed an inconsistent default for the global-injection option.

= 1.1.0 =
* Added an "Identify WordPress Users" setting. When enabled, logged-in WordPress users are passed to the OkFlow widget automatically so they are not asked to enter their name and email again.
* Removed the Gutenberg block — it was a redundant third injection path that only re-emitted the same script tag as global injection and the shortcode.

= 1.0.0 =
* Initial release.
* Global widget script injection via wp_head.
* Settings page for snippet token and global injection toggle.
* `[okflow_widget]` shortcode with optional token attribute.
* Uninstall cleanup of all plugin options.
