=== HyoNova Mail ===
Contributors: hyonova
Tags: email marketing, newsletter, woocommerce, double opt-in, forms
Requires at least: 6.2
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Subscription forms with double opt-in, connection status and (with WooCommerce) signed customer, order and product sync for HyoNova Mail.

== Description ==

HyoNova Mail connects your WordPress site to your HyoNova Mail account with a single scoped API key.

* **Subscription forms** — shortcode `[hyonova_mail_form id="FORM_ID"]` or the "HyoNova Mail Form" block. Double opt-in is handled by HyoNova: the visitor is not on the list until they confirm the email.
* **Connection status** — Settings → HyoNova Mail shows the organisation the key belongs to, its scopes, the last check and an error log. Disconnect at any time.
* **WooCommerce** — registers signed webhooks (orders, customers, products) and runs an incremental export of existing data. The store shows as *Connected* in HyoNova only after a signed verification ping.
* **Consent, honestly** — a technical connection never equals marketing consent. HyoNova reads marketing consent *only* from the explicit opt-in checkbox this plugin can add at checkout and on the registration form (`hyonova_marketing_opt_in`). Customers and buyers without it are synced as *pending* and never receive marketing email until they confirm. WordPress users are never imported as subscribers.

**What leaves your site**

* Form submissions (what the visitor typed) → HyoNova's hosted form endpoint.
* With WooCommerce: customer name, email, billing company/phone/country and the explicit opt-in flag; order id, status, total, currency, dates and billing email; product id, name, short description, permalink, price, stock status and image URL.
* Nothing else: no passwords, no other user meta, no post content.

**Security**

* The API key is pasted once and stored encrypted (AES-256-GCM keyed from your `wp-config.php` salts). It is never displayed again.
* Every call to HyoNova goes over HTTPS with certificate verification.
* WooCommerce webhooks are signed by WooCommerce itself with a per-store secret HyoNova issued; HyoNova rejects unsigned or replayed deliveries.

== Installation ==

1. Upload the `hyonova-mail` folder to `/wp-content/plugins/` or install the zip from Plugins → Add New → Upload.
2. Activate the plugin.
3. In HyoNova Mail → Transactional → API keys create a key with the scopes `mail.integrations.write` and `mail.events.read` (add `mail.contacts.read` if you want the forms list refreshed from the API).
4. Go to Settings → HyoNova Mail, paste the key, click **Connect**. The page shows your organisation name when the key verifies.
5. Create a form in HyoNova Mail → Forms (double opt-in recommended) and embed it with the shortcode or the block.
6. With WooCommerce: on the same settings page, review the consent checkbox text and click **Connect WooCommerce**. The HyoNova Integrations page turns *Connected* once the signed ping is verified; the first export starts automatically.

== Frequently Asked Questions ==

= Does the plugin subscribe my WooCommerce customers? =
No. Customers are synced as contacts, but they become marketable only if they ticked the explicit opt-in checkbox (or a known newsletter opt-in field is present). Everyone else is *pending*.

= Can I self-host or use a staging HyoNova? =
Yes: change the API origin on the settings page (HTTPS only).

= What happens when I disconnect? =
The key and the WooCommerce secret are removed from this site, the WooCommerce webhooks created by the plugin are deleted, and forms stop submitting until a key is pasted again. Contacts already in HyoNova keep their current consent.

== Changelog ==

= 1.0.0 =
* First release: forms with double opt-in, settings page with status and error log, WooCommerce signed webhooks + incremental export, explicit consent checkbox.
