=== WalletPro for WooCommerce - Wallet, Store Credit & Cashback ===
Contributors: isupercoder
Tags: wallet, store credit, cashback, wallet system, gift card
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.89.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A complete WooCommerce wallet and store credit system: prepaid balance, top-ups, partial payments, cashback rewards, and refunds to store credit.

== Description ==

WalletPro for WooCommerce is a complete digital wallet and store credit system. Every customer gets a prepaid balance (wallet / store credit / account funds) they can top up and spend at checkout, with cashback rewards, partial payments, refunds to store credit, and a full transaction history. HPOS-compatible and Blocks-checkout ready.

**What customers can do**

* Add funds to their balance from the My Account area and pay with any active gateway.
* Pay for an order entirely from their balance.
* Apply part of their balance to an order and pay the remainder with another gateway.
* See their balance and a full transaction history in My Account.

**What merchants can do**

* View and edit any customer's balance from the user profile, with recent activity shown inline.
* Refund an order paid with funds straight back to the customer's balance.
* Refund any order to store credit, regardless of how it was originally paid.
* Set top-up minimum, maximum and preset amounts.

**Built for trust**

Every balance movement is recorded in an append-only transaction ledger (credit, debit, top-up, refund, adjustment) with the resulting balance, so the audit trail is always complete. Debits are atomic, so two concurrent checkouts can never both spend the same funds.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/walletpro-for-woocommerce` (or install the zip from Plugins → Add New → Upload).
2. Activate it through the Plugins screen. WooCommerce must be active.
3. Go to WooCommerce → Settings → Payments and enable **Wallet**.
4. Customers see their balance, history and the Add Funds form under My Account → Wallet.

== Frequently Asked Questions ==

= Where is the balance stored? =

In the `account_funds` user meta value, as a single decimal. This contract is preserved so external systems that write the balance directly keep working.

= Does it work with the block-based checkout? =

Yes. Paying from the balance works on both the classic and Blocks checkout. The partial-payment toggle currently targets the classic checkout.

= Can I refund to store credit instead of the original payment method? =

Yes. Use the "Refund remaining total to account funds" order action on any order.

= Is the data removed when I uninstall? =

Plugin settings are removed on uninstall. By default customer balances and the transaction ledger are deliberately preserved so financial data is never destroyed. A merchant can opt in under Wallet Settings ("Wipe all wallet data on uninstall") to also drop the plugin tables and balances.

== Changelog ==

= 1.89.0 =
Ten new WooCommerce backend and admin features for merchant operations, reconciliation, and customer support:
* Scheduled liability snapshot: a daily cron records total outstanding wallet liability with a 90-day trend chart and CSV export so finance teams can monitor exposure over time.
* Order-screen wallet panel: a read-only metabox on every WC order edit page shows the customer's current balance plus all wallet ledger entries tied to that order (HPOS-compatible).
* High-value credit alert: any single wallet credit above a configurable threshold triggers an admin email and an audit-log flag, with automatic suppression during bulk imports.
* Orders list wallet column and filter: a new "Wallet" column (hidden by default, toggle in screen options) and a dropdown filter on the WC orders table to narrow orders by wallet-payment type.
* Reconciliation drift auto-repair: from the Reports page, a single click queues a drift correction through the maker-checker approval queue rather than writing directly, preserving the audit trail.
* CS internal notes: CS agents can append timestamped, internal notes to any customer wallet account; notes are append-only, capped at 20 entries, and full GDPR-eraser and exporter support is wired in.
* Wallet quick-lookup bar: a global search bar on the Customer Balances page resolves any customer by user ID, login, or partial email within 30 req/min, with admin nonce and capability checks.
* Finance dashboard widget: a 5-KPI (total liability, top-ups today, withdrawals pending, adjustments pending, credits today) summary widget on the WP admin dashboard with a 5-minute transient cache.
* Per-product wallet settings: each WC product can individually disable wallet-payment acceptance or cashback earning via a side metabox, overriding the global gateway and cashback settings.
* Admin-imposed wallet freeze: CS can freeze any customer wallet with an optional expiry and a reason; frozen wallets cannot spend; auto-thaw happens lazily on next checkout; all actions are audit-logged.

= 1.88.0 =
Ten new features, each money-safe (every movement is one ledger row through the single write path):
* Win-back (dormancy rescue): customers whose wallet balance has gone unspent for a threshold are emailed a claimable win-back code, turning silent balance lapse into a reason to return.
* Partner Credit API: a signed, replay-proof, credit-only REST endpoint so a trusted partner system can fund customer wallets. Off by default, separate HMAC secret.
* Adjustment approval queue (maker-checker): high-value manual wallet credits/debits can require a second admin to approve before any money moves.
* Checkout round-up to wallet: a customer can round their order up to the next increment and add the spare change to their wallet.
* Self-service spending guardrails: a customer can set their own per-period wallet spend limit and a self-freeze with a cool-off.
* Scheduled and recurring wallet grants: schedule unattended, calendar-driven store-funded wallet credits to a saved customer segment.
* Wallet checkout tip: a customer can add a wallet-funded tip at checkout to a store recipient wallet.
* Customer-issued gift codes: a customer can convert part of their own balance into a shareable gift code, redeemable by anyone, with owner-only void-to-reclaim.
* Return streak rewards: a store-funded bonus for customers who place a qualifying order in consecutive months.
* Scheduled wallet allowance: a customer can set up a recurring weekly wallet-to-wallet allowance that drips to a chosen recipient.

= 1.87.0 =
* New: gift recipients are now emailed automatically when a gift is fulfilled. A gift held for an unregistered email carries its redemption code (which auto-applies once they create an account); a gift to an existing customer confirms the credit with a link to their wallet. Toggle it under WooCommerce > Settings > Emails ("Gift wallet credit received").
* Money-safety: redeeming a code that would push a wallet over its balance cap is now refused, and the code stays active, instead of silently crediting only part of its value. Redeem it after spending some of the balance down.
* Held gift codes now expire 365 days after they are issued (filterable).

= 1.86.5 =
* Top-up surcharge now returns zero for an unrecognized gateway fee type, instead of applying it as a fixed surcharge.

= 1.86.4 =
* Referral attribution now requires both parties to have a real (non-empty) email, so a missing or blank email can never be counted as a valid referral.

= 1.86.3 =
* Cashback coupon credit now returns zero for an unrecognized credit type, instead of treating it as a fixed credit.

= 1.86.2 =
* BNPL fee calculation now returns zero for an unrecognized fee type, instead of treating it as a fixed charge.

= 1.86.1 =
* Gift amount clamp now caps to the configured maximum even when the gift band is misconfigured with a minimum greater than the maximum, so a gift amount can never exceed the maximum.

= 1.86.0 =
* Ledger hardening and admin polish. A scheduled daily integrity check now verifies the tamper-evident transaction ledger and, if the HMAC chain ever fails, raises an admin notice and emails the site admin (both filterable; silent when all is well). A new supported command, wp wallet rekey-ledger, safely re-stamps the ledger after a WordPress security-salt rotation: it verifies the existing chain under the old key first, so a tampered row cannot be laundered, and is idempotent. The ledger signing key now fails closed instead of falling back to a built-in default. Destructive admin money actions (bulk balance, segment grants, withdrawals, codes, KYC decisions) now ask for confirmation before they run. The admin screens get an accessibility pass (table scope and aria-sort, form labels, ARIA tabs, fieldset grouping, localized status text), and admin strings, CSV export headers, and dropdown option labels are now fully translatable. Documented in docs/45-tamper-evident-ledger.md and docs/96-ledger-rekey.md.

= 1.85.0 =
* New: the Fahad AI assistant integration now also exposes referral details (read-only). A signed-in shopper who asks how to refer a friend gets their real referral code, share link, and the actual reward amounts.

= 1.84.0 =
* New: Fahad AI Shopping Assistant integration. When that assistant is installed, a signed-in shopper who asks "what's my balance?" now gets their real wallet balance from WalletPro instead of a guessed answer. Read-only (balance only); top-ups and spending stay on WalletPro's own audited paths.

= 1.83.1 =
* Fixes from browser smoke and a UI/UX audit of the 1.83.0 surfaces. Removes a fatal in wp-admin caused by the retired Envato license screen still being wired (licensing is handled by Freemius), with a guard test so the regression cannot return. Tidies the new customer screens: the My Account Referrals stat tiles now space the value and label correctly (no more "0Friends invited"), the Wallet "Orders paid" card drops the redundant "across 0 orders" at zero, the Referrals tab gets the accessibility focus-ring stylesheet and a proper heading, the checkout wallet breakdown is announced to assistive tech, and the admin tables gain scope/aria-sort semantics. Settings tab labels are now translatable.

= 1.83.0 =
* Screenshot-parity release: builds out the customer- and admin-facing surfaces shown in the marketing screenshots, all test-first. Customer My Account now has a dedicated Referrals page (your referral code with a Copy Link button, Friends Invited / Converted / Earned stats, and a Recent Referrals list with earned/pending status), and the Wallet page shows Total Earned (cashback plus top-ups), Total Spent and an order count, with a Gift action to send wallet credit to another customer (atomic, audited, no second money path). Admins get a unified Customer Wallet Balances page (all customers with email, balance, last activity, per-row edit, Add Credit through the capped and ledgered chokepoint) plus Average and Top balance stats, and the Reports screen gains period-over-period deltas, an Active Wallets stat, a monthly Issued-vs-Redeemed activity chart and liability-share bars. Cashback adds an Apply-to-Shipping toggle and per-role Max-Per-Order caps; checkout shows "WalletPro Store Credit" / "Wallet Credit Applied" labels with a used and remaining-after-order breakdown and an auto-apply option; and the admin settings are reorganised into tabs (General, Top-Up, Cashback, Referrals, Expiry, BNPL) with no change to any stored option.

= 1.82.0 =
* Wallet top-up now bypasses the cart entirely: a pending WC order is created directly for the deposit and the customer is redirected to the order-pay page. The regular cart is untouched and available for a separate checkout. WooCommerce's core cart-clearing hook (wc_clear_cart_after_payment) is suppressed for deposit orders on the thank-you page so other cart items are preserved.

= 1.81.0 =
* Merchants can schedule a periodic (daily/weekly/monthly) transaction-ledger CSV to be emailed to one or more admin recipients on a WP-Cron schedule, reusing the existing CSV exporter. Idempotent per period (no duplicate sends), with all/incremental scope, off by default. The cron is cleared on deactivation and uninstall, and the new options are included in uninstall cleanup. No schema change. Documented in docs/90-scheduled-export.md.

= 1.80.0 =
* Merchant-configurable per-period spending limits / velocity caps on wallet spend (max amount and/or number of debits per rolling day, week or month, optionally per role), enforced at the gateway-availability and partial-payment layers so they cannot be bypassed. The spend window is derived from the existing ledger, so there is no schema change. Off by default. Documented in docs/92-spending-limits.md.

= 1.79.0 =
* New WP-CLI commands wp wallet export and wp wallet import for a safe balances/ledger round-trip: export dumps balances (re-importable CSV) or a balances-plus-ledger JSON snapshot; import is atomic per row, idempotent per file (re-running is a no-op), supports --dry-run, and applies through the existing credit/adjust chokepoints so role caps are honored and each movement records a ledger row. No schema change. Documented in docs/95-cli-export-import.md.

= 1.78.0 =
* New admin report showing the largest wallet balances and liability concentration (the share of total outstanding liability held by the top customers), reusing the liability calculator and exportable to CSV. Figures reconcile to the ledger-derived liability total. Read-only; no money logic or schema change. Documented in docs/93-top-balances-report.md.

= 1.77.0 =
* Merchants can surface the logged-in customer's wallet balance anywhere via a Gutenberg block, a [walletpro_balance] shortcode, and a classic widget, all sharing one accessible balance view with an optional top-up link and a configurable logged-out message. Guests see nothing (or the configured message). Presentational only; no money logic or schema change. Documented in docs/94-balance-block-shortcode.md.

= 1.76.0 =
* Customers can generate a printable wallet statement (balance plus transactions for a chosen date range) from My Account, scoped strictly to their own account. Ships a clean print-optimized HTML statement by default, with PDF generation available behind a pluggable renderer filter so no heavy PDF dependency is bundled. Accessible and RTL-aware markup. No money logic or schema change. Documented in docs/91-wallet-statement.md.

= 1.75.0 =
* The My Account transaction history now uses stable cursor (keyset) pagination with accessible prev/next links, served through the per-user history cache, replacing the offset-based numbered pager. Pages stay stable when new transactions are added between views, and the existing type/date/search filters carry across pages. Presentational only; no money logic or schema change. Documented in docs/88-history-ui-cursor.md.

= 1.74.0 =
* Admin settings for payouts and webhooks: a capability-guarded "Payouts & Webhooks" section now renders and persists the non-secret configuration for automated withdrawal payouts and outbound webhooks (both off by default). Secrets are write-only and can be overridden by wp-config constants, and are never rendered back in plaintext. Both option groups are now included in uninstall cleanup. Documented in docs/89-payouts-webhooks-settings.md.

= 1.73.0 =
* Multi-currency ledger: non-base-currency wallet movements now record a currency-tagged transaction-ledger row, so every currency has a complete, reconcilable audit trail. Adds a currency column to the transactions table (DB schema 12, non-destructive migration stamps existing rows with the store base currency; no value drift). Reconciliation and liability reports are scopable by currency. Documented in docs/87-multi-currency-ledger.md.

= 1.72.0 =
* Expanded locale catalog: ships Spanish (es_ES) and French (fr_FR) translations compiled to MO, covering the high-value customer-facing strings (wallet, balance, top-up, add funds, transaction history, redeem, withdraw, transfer, gift, and core ledger labels). Built from the existing POT template; no money logic or schema change. Documented in docs/86-locales.md.

= 1.71.0 =
* Turnkey Klaviyo and Mailchimp recipes that map the plugin's existing signed outbound webhooks (top-up, credit, debit, refund, cashback, expiry) into marketing events, so merchants can drive flows/automations without custom code. Each event is mapped to a concrete API call with a field-by-field table and example payload. Ships an opt-in, example-only payload mapper (not wired into the runtime) whose output is unit-tested against the documented Klaviyo and Mailchimp shapes, and a test asserting every event the recipes reference is a real ledger type. No money logic or schema change. Documented in docs/85-marketing-recipes.md.

= 1.70.0 =
* Published an OpenAPI 3.1 document and TypeScript types for the plugin's own `walletpro/v1` REST API (balance and ledger reads, admin credit/debit/adjust writes, and the analytics summary), with auth, params, request bodies, response schemas and error envelopes. An integration test boots the real REST server and diffs the registered routes against the spec in both directions, so the document cannot drift from the actual register_rest_route() calls. No money logic or schema change. Documented in docs/84-openapi.md; spec and types under docs/openapi/.

= 1.69.0 =
* RTL and locale-aware currency formatting for the customer wallet UI. The wallet accessibility stylesheet now ships an `*-rtl.css` companion that WordPress loads automatically under right-to-left locales (is_rtl()), so the dashboard, history table and forms read correctly in RTL. Multi-currency balances shown on the checkout gateway now format in the active checkout currency's symbol/position (not the store base), while every customer-facing amount continues to render through WooCommerce's locale formatter (wc_price), honouring the store's decimals and decimal/thousand separators. No money logic or schema change. Documented in docs/83-rtl-locale.md.

= 1.68.0 =
* Accessibility (WCAG) audit and fixes for the My Account wallet UI: the wallet dashboard is now a labelled `region` landmark, every interactive control has an accessible name, the history filter fields have explicit labels, and ledger amounts announce their increase/decrease direction in words (never color alone). A new presentational-only stylesheet guarantees a visible, high-contrast keyboard focus ring and contrast-safe amount/bonus colors independent of the active theme. A retained Playwright + axe-core check scans the main wallet page and asserts no serious/critical violations, contrast passes, and every control is named and focus-visible. No money logic or schema change. Documented in docs/82-accessibility.md.

= 1.67.0 =
* Multi-currency wallets: customers can hold a separate wallet balance per currency, and spend/top-up/refund/renewal each operate within the order or cart currency with no implicit conversion (a EUR wallet pays EUR orders, a USD order draws the USD balance). The base-currency balance keeps the existing `account_funds` storage byte-for-byte, so balances never change value on upgrade; non-base currencies use per-currency `account_funds_<CUR>` keys with the same atomic-debit, first-row-only and cache-invalidation guarantees. No schema change. Supersedes and removes the temporary multi-currency guard. Documented in docs/81-multi-currency.md.

= 1.66.0 =
* Subscriptions deep integration: when WooCommerce Subscriptions is active and the merchant opts in (off by default), a scheduled renewal is paid from the wallet first with automatic fallback to the customer's saved payment method when the balance is insufficient, optionally triggering an auto-reload before the renewal. The renewal debit is atomic and idempotent (reuses the order debit marker so a repeated renewal callback never double-charges); a fallback never partially debits the wallet, and a failed renewal defers to Subscriptions' own retry/dunning. Pure renewal-decision logic, no schema change. Documented in docs/80-subscriptions-deep.md.

= 1.65.0 =
* Store API / headless wallet contract: React/headless storefronts (and the Cart & Checkout Blocks) can read the wallet balance and applied credit straight off the WooCommerce Store API cart response under the `walletpro` namespace, and apply/remove wallet credit via the Store API cart-update (extensionCartUpdate) operation. Reuses the existing F4 partial-payment money path (capped, idempotent debit-on-paid, no double-spend) — no second money path and no schema change. Documented in docs/79-store-api.md.

= 1.64.0 =
* Automated withdrawal payout rails: a pluggable PayoutProvider interface dispatches an approved withdrawal to the configured rail. The manual provider (operator pays out off-platform) remains the default; an automated PayPal Payouts provider is available behind a feature flag (off by default) with credentials read from an option or the WALLETPRO_PAYPAL_TOKEN constant. Approval records the provider reference and payout status on the withdrawal row; a failed payout is marked retryable and never re-credits or double-debits the wallet (the funds were debited once at request time). Adds payout_status/payout_reference columns to the withdrawals table (DB_VERSION 11, non-destructive upgrade).

= 1.63.0 =
* New `wp wallet doctor` CLI diagnostics command: checks the installed schema version against the plugin's expected DB_VERSION, that the daily cron events are scheduled, that every wallet balance reconciles with the ledger, and that key settings are sane (top-up min <= max, wallet gateway enabled, store currency set). Prints a clear pass/fail table and exits non-zero on any failure so it can gate CI or an uptime monitor. No schema change.

= 1.62.0 =
* Ledger pagination & caching: the wallet REST history endpoint now supports stable cursor (keyset) pagination on the transaction id, so pages never overlap or skip rows even as new transactions are recorded between fetches. Per-user history pages are cached and invalidated automatically on the next ledger write for that customer (one customer's write never affects another's cache). The benchmark tool reports the query reduction for cached reads. No schema change.

= 1.61.0 =
* Transaction history filters: customers can filter their own wallet history by type and date range and search it, then download a CSV of exactly what they are looking at. Every read is strictly scoped to the logged-in customer (IDOR-safe) and the CSV download stays nonce-protected. No schema change.

= 1.60.0 =
* Saved adjustment reasons: admins can pick from a small managed list of reusable reasons (or type a one-off) when adjusting a balance on the user profile or in the bulk-by-role tool. The chosen reason is recorded on the ledger note and the audit row; newly typed reasons are remembered for next time. Bulk-adjust form tidied into a labelled table with clearer guidance. Option-backed, no schema change.

= 1.59.0 =
* Object-cache invalidation consistency across rollbacks: centralised manual $wpdb transaction control into a TransactionRunner whose rollBack() invalidates the user_meta object cache for every affected user, so a rolled-back balance change can never be served stale from cache. Audited every money-moving path (transfers, codes, requests, gifts, BNPL, withdrawals, referrals); the fund-request accept path now uses the shared runner. No schema change.

= 1.58.0 =
* Targeted balance grants / segment campaigns: define a customer segment by role, last-order date (lapsed vs. recently active) and lifetime spend, preview who matches and the total cost (dry-run, no balances touched), then grant a fixed amount to each matched customer. The commit credits every customer exactly once and is idempotent per batch (re-running cannot double-grant); grants flow through the credit chokepoint so per-role max-balance caps clamp them, land in the ledger as a distinct "grant" type, and an optional expiry date forms a FIFO expiry lot.

= 1.57.0 =
* First-run setup wizard: after activation a dismissible onboarding screen guides the merchant through confirming the store currency, enabling the wallet at checkout, setting top-up presets (min/max + quick-pick amounts) and choosing a cashback preset. Each step writes the existing settings option (no new storage, no money logic); completing or dismissing clears a one-time flag so it never nags again, and re-running is idempotent.

= 1.56.0 =
* WooCommerce Analytics integration: a "Wallet" entry under WooCommerce -> Analytics surfaces top-up volume, redemptions, cashback cost and outstanding liability for a date range, alongside a new manage_woocommerce-gated REST endpoint (walletpro/v1/analytics/summary). Every figure is read from the same report repositories as the bespoke Wallet Reports page (kept as the fallback), so the two surfaces reconcile to the ledger. No build step: a small vanilla-JS view fetches the endpoint.

= 1.55.0 =
* Program analytics dashboard: a read-only Wallet Program Analytics screen showing how the growth features pay back. Cashback ROI (credit spent vs the revenue of the orders it rode on), referral signup -> first-order conversion and reward cost, gift redemption rate, and a wallet-user vs non-user repeat-purchase cohort. All figures are produced by pure, unit-tested aggregators over the ledger and order data, reconcile to the ledger, and support an optional date range.

= 1.54.0 =
* Unified customer Wallet dashboard: the scattered My Account wallet surfaces (balance, quick top-up, recent transaction history, pending withdrawals & incoming money requests, redeem) are now composed into one polished, accessible dashboard with an in-page section nav. Reuses the existing flows; all deep-link endpoints keep resolving, and a customer only ever sees their own data.

= 1.53.0 =
* Admin audit log: append-only record of every manual balance adjustment, withdrawal approval/rejection and settings save, capturing actor (id + login), target, before/after values, reason and timestamp. New Wallet Audit Log admin screen with date/actor/action filters and a CSV export. Audit capture is fail-safe and never blocks the underlying operation; the log is retained on uninstall as part of the financial trail unless full wipe is opted in.

= 1.52.0 =
* Accounting: liability & breakage reporting plus a GL-friendly CSV export. Period-close view of total outstanding wallet liability as of any date and expired-credit (breakage) for a date range, all derived read-only from the ledger and reconciling to the cent (liability == sum of balances == ledger total). New Liability & breakage section on the Wallet Reports screen and a GL CSV export (date, type, debit, credit, running liability, customer) with an opening/closing/totals footer.

= 1.51.0 =
* Auto-reload: customers can opt in to automatic wallet top-ups. When the balance falls below a customer-set threshold, a saved payment method is charged for a set amount and credited via the normal top-up path. Hard guardrails — per-day reload cap, per-role max-balance cap, idempotency (no double charge), failure backoff and auto-disable after repeated failures, and an optional email receipt. Off by default; the off-session charge is gateway-agnostic and filterable.

= 1.50.0 =
* Safety net: detect active multi-currency plugins (Aelia, WPML/WCML, WOOCS/CURCY) and show an admin notice that wallet balances are held and spent in the store base currency and are not converted. Optional setting (off by default) blocks wallet spend at checkout when the active currency differs from base. Superseded by full multi-currency support when delivered.

= 1.49.0 =
* Security: step-up authentication for high-risk debits. Withdrawals, and transfers above a configurable threshold, now require re-confirming the account password or a short-lived single-use emailed one-time code before any money leaves the wallet. Enforced at the service layer (cannot be bypassed) and rate-limited.

= 1.48.0 =
* Security: brute-force protection on code redemption. Repeated failed code guesses are now throttled per-user and per-IP with a temporary, exponentially backing-off lockout; valid redemptions are unaffected and reset the counter.

= 1.47.0 =
* New: partial payment now works on the Blocks / Store API checkout. Customers can apply part of their balance and pay the rest with another gateway, reusing the same idempotent debit-on-paid path as the classic checkout so funds can never be double-counted.

= 1.46.0 =
* New: uninstall data-retention choice. A new Wallet Settings toggle controls whether uninstall wipes everything (balances, ledger and tables) or retains the financial ledger. Defaults to retain, the safe choice.

= 1.45.0 =
* New: optional self-hosted auto-updates. Point the plugin at a JSON update manifest (the WALLETPRO_UPDATE_URL constant or the walletpro_update_url option) and licensed sites receive one-click updates. Off by default; with no endpoint configured nothing changes.

= 1.44.1 =
* Fix: the internal version constant now matches the plugin header version, so the update checker reports the installed version correctly. No change to wallet behavior.

= 1.44.0 =
* Performance: the store-wide Wallet Reports aggregates (outstanding liability and totals) are cached and invalidated on every balance movement, so the admin dashboard does not re-scan the whole balances table on each load. With a persistent object cache the warm read is free.

= 1.43.0 =
* Performance: a covering index on the transaction ledger (type, amount) so the Wallet Reports totals (grouped by type) use an index scan instead of scanning the whole table, keeping admin reports fast on large stores. Added automatically on update.

= 1.42.0 =
* Performance benchmark harness: wp wallet benchmark seeds a synthetic dataset (default 1M ledger rows), times the wallet hot paths, and cleans up, so performance work is measurement-driven. For developers; no effect on normal operation.

= 1.41.0 =
* Outbound webhooks: send a signed (HMAC-SHA256) POST to your endpoint when wallet events occur (top-up, debit, cashback, refund, withdrawal and more). Delivery is asynchronous and retried with backoff. Configure under WooCommerce > Wallet Webhooks; off by default.

= 1.40.0 =
* Developer hooks: a documented action/filter surface (see docs/HOOKS.md) for extending the wallet without forking, including a new walletpro_before_debit action. Existing hooks such as walletpro_funds_recorded and walletpro_cap_credit are now reference-documented.

= 1.39.0 =
* WP-CLI: wp wallet get/credit/debit/adjust/ledger to inspect and adjust balances and dump the ledger from the shell, alongside the existing reconcile and verify-ledger commands. Every change runs through the audited money path.

= 1.38.0 =
* REST API: a walletpro/v1 namespace to read a balance and ledger (owner or admin) and to credit, debit or adjust a wallet (admin only, idempotency-key aware). Every write goes through the same audited, atomic money path as the rest of the plugin.

= 1.37.0 =
* License activation and updates: a Wallet License screen verifies your Envato purchase code (with the personal token configurable via the WALLETPRO_ENVATO_TOKEN constant or on the screen) and enables update notifications. The update source is filterable and stays a safe no-op until you configure it.

= 1.36.0 =
* Hardened KYC document storage: identity documents now live in a private directory outside the uploads folder, protected on Apache, IIS and with a directory index, and can be moved fully outside the web root with the WALLETPRO_KYC_DIR constant. Existing documents are migrated automatically on update.

= 1.35.0 =
* GDPR tools: the wallet now plugs into WordPress Export/Erase Personal Data. Export returns the balance, transaction history, withdrawals and KYC status; erase deletes identity documents and anonymizes payout details while retaining financial records, plus a suggested privacy-policy snippet.

= 1.34.0 =
* Translation ready: ships a languages/walletpro-for-woocommerce.pot template (305 strings) covering the whole plugin, with the text domain loaded on boot, so it can be fully localized. No functional change.

= 1.33.0 =
* Tamper-evident ledger: every transaction row now carries a keyed integrity hash (HMAC keyed by the site secret), so an edited or forged ledger row is detected. A new Ledger integrity section on Wallet Reports and the `wp wallet verify-ledger` CLI command report any mismatch, and the CLI exits non-zero so it can gate a scheduled check. Existing rows are hashed automatically on upgrade.

= 1.32.0 =
* Wallet reconciliation: a Reconciliation section on Wallet Reports (and a `wp wallet reconcile` CLI command) proves every stored balance is explained by its ledger and flags any out-of-band drift with the exact difference. Read-only; never auto-corrects.

= 1.31.1 =
* WordPress 7.0 compatibility: the Wallet Balance block now uses Block API v3, so the post editor keeps its new iframe (no apiVersion 2 deprecation warning) and the plugin is tested against WordPress 7.0. No functional or data changes.

= 1.31.0 =
* Buy Now Pay Later: let trusted customers spend past zero up to a configurable credit limit (with eligibility by role and order count, optional fee, and block-until-settled) and clear the balance with a later top-up. Enforced with an atomic, race-safe floor; off by default.

= 1.30.0 =
* KYC identity verification: gate withdrawals, transfers and money-request acceptance behind admin-approved document verification, enforced server-side. Documents are stored privately with admin-only access.

= 1.29.0 =
* Referral program: refer-a-friend wallet rewards for the referrer and/or referee, triggered on signup and/or the referee first qualifying order, with a per-referrer cap, an audit table, and refund reversal.

= 1.28.0 =
* Scheduled cashback campaigns: time-boxed multipliers (e.g. 2x) that stack over your cashback rules, plus coupon-style codes that credit the wallet instead of discounting the cart. Both reverse on refund.

= 1.27.0 =
* Gift wallet credit: a purchasable product that funds another person's wallet by email, with a personal message, optional scheduled delivery, a held-code fallback that auto-applies when an unregistered recipient signs up, and refund reversal.

= 1.26.0 =
* Recharge governance: a master enable/disable switch for top-ups, a minimum first deposit, and per-gateway surcharges added as itemised cart fees (store revenue, never credited to the wallet).

= 1.25.0 =
* Redemption codes: generate gift-card-style codes (with optional expiry and email restriction) that customers redeem into their wallet. Codes are stored hashed, single-use, and credited through the audited ledger.

= 1.24.0 =
* Per-role wallet rules: gate wallet spending and top-ups by WordPress user role (e.g. wholesale-only wallet), set per-role top-up bands, and cap the maximum balance per role. No rules configured leaves behaviour unchanged.

= 1.23.0 =
* Bulk balance tools: segment-wide credit/debit by role and a CSV importer (credit/debit/set) with a dry-run preview, decimal accuracy, and idempotent per-batch commits. Every change is recorded in the ledger.

= 1.22.0 =
* Advanced cashback rules: per-role rates, cart-total tiers, payment-gateway allow/deny, and a per-order cap, composed over the existing per-line engine. Cashback is clawed back proportionally when an order is refunded.

= 1.21.0 =
* Request money: customers can request funds from another customer by email or username; the payer accepts or rejects from their wallet page. Accepting settles atomically through the same transfer engine (idempotent, fully ledgered).

= 1.20.0 =
* Low-balance reminder email: nudges a top-up when a wallet falls below a configurable threshold.
* Pre-expiry reminder email: warns customers before FIFO funds expire, showing the amount and date. Both off by default, sent by a daily scan with per-customer de-duplication.

= 1.19.0 =
* Preset top-up packages: define deposit tiers with per-tier bonuses (override or stack with the global bonus), optional packages-only mode, and server-side amount validation.
* Top-up refunds now reverse the credited balance and bonus so a refunded top-up cannot keep its wallet credit.

= 1.18.0 =
* My Account dashboard wallet card: shows the customer balance plus top-ups, earned and spent totals with a link to the wallet.

= 1.17.0 =
* Admin lock / freeze: freeze a customer wallet from their profile to block spending, transfers and withdrawals (balance and history preserved).

= 1.16.0 =
* Customer CSV export: customers can download their own wallet transaction history from My Account.

= 1.15.0 =
* Transactional wallet emails: optionally email customers when their wallet balance changes (a native WooCommerce email, toggleable under Settings > Emails).

= 1.14.0 =
* Withdrawals / cash-out: customers can request to withdraw their balance (with limits and fees); admins approve (pay out) or reject (refund). Funds are held on request.

= 1.13.0 =
* Wallet balance widget: show the balance anywhere with a [walletpro_balance] shortcode or a native Wallet Balance Gutenberg block.

= 1.12.0 =
* Wallet-to-wallet transfers: customers can send balance to another customer by email or username, with optional limits and a flat or percentage fee. Money-safe (atomic) with a Send money form on the wallet page.

= 1.11.0 =
* Top-up deposit bonus: reward deposits with a percentage or flat bonus, with a minimum deposit and optional scheduled promotion window.

= 1.10.0 =
* Admin CSV export: download wallet transactions (date-ranged) and all customer balances from Wallet Reports.

= 1.9.0 =
* Wallet Settings screen: manage the wallet label and all top-up, cashback, expiry, eligibility and milestone options in one place. Rename "Wallet" to any term.

= 1.8.0 =
* WooCommerce Subscriptions: pay subscription renewals from the wallet when the Subscriptions extension is active; renewals fail cleanly when the balance is short.

= 1.7.0 =
* Admin Wallet Reports: deposits, granted credit, spend, expiry, net adjustments, and outstanding liability, with a date range.

= 1.6.0 =
* Spending eligibility rules: restrict wallet spending by minimum order value, exclude coupon or sale orders, and limit to specific product categories. The Wallet gateway and partial-payment option hide when a cart is not eligible.

= 1.5.0 =
* Funds expiration: optionally expire wallet funds a configurable number of days after they were earned, via a daily job. Spending uses the oldest funds first (FIFO).

= 1.4.0 =
* Rebranded to WalletPro for WooCommerce. Wallet/store-credit terminology in the customer and admin UI. No data migration: existing balances and history are preserved.

= 1.3.0 =
* Milestone rewards: credit the wallet for account registration and approved product reviews.

= 1.2.0 =
* Cashback rewards: credit a percentage of eligible order lines back as account funds on completion, with an optional per-product rate.

= 1.1.0 =
* Store-credit product: give any product an account funds credit value (which can differ from its price) to sell or gift prepaid credit.

= 1.0.0 =
* First commercial release: packaging, documentation, build script and uninstall handling.

= 0.6.0 =
* Transaction history in My Account and recent activity on the admin user profile.

= 0.5.0 =
* Refund orders to account funds (gateway refunds and a store-credit order action for any order).

= 0.4.0 =
* Partial payment: apply funds to part of an order and pay the remainder with another gateway.

= 0.3.0 =
* Customer top-up / Add Funds from My Account.

= 0.2.0 =
* Append-only transaction ledger and a single FundsManager write path.

= 0.1.0 =
* Initial gateway, balance storage, admin balance editing and Blocks support.

== Upgrade Notice ==

= 1.0.0 =
First commercial release.
