== 4.0.0-rc8.10 ==

* Moved the mobile centering/overflow fix for `[aitk_pro_tools]` into the plugin itself so no extra theme Additional CSS is required.
* Added a final mobile-only viewport centering layer for iPhone/Safari and block themes such as Twenty Twenty-Five.
* Preserved desktop layout and existing shortcode/AJAX behavior.

=== AI Toolkit Pro ===
Version: 4.1.0

== Description ==
Modular AI features for WordPress — bring your own Anthropic or OpenAI API key, no agency branding, no subscription. This is a white-label plugin intended to be installed on a client's own site as part of a custom AI development project.

== Dashboard ==
Clicking AI Toolkit in the WP Admin sidebar opens an overview Dashboard showing every feature, its shortcode, and a usage tip — so a customer can see what they have and how to use it without digging through documentation. A "View full documentation" link on the Dashboard opens a proper in-admin Documentation page (Free vs Pro breakdown, Getting Started steps, and a What's New summary) — this readme is reference material for you as the developer, but customers see the same information rendered directly inside their own WP Admin. Settings and License each have their own separate menu entry.

== Welcome Wizard ==
On first activation, the plugin redirects straight into a 5-step setup wizard: an overview of what's included, connecting an AI provider (with the same "Test API Key" check used on the Settings page), choosing which features are enabled, activating a Pro license if you have one, and a finish screen listing the shortcodes to drop onto a page. Every step besides skipping can be skipped, and anything set here can be changed later under AI Toolkit → Settings/License — the wizard is a convenience, not a one-time gate. It only triggers on a single-plugin activation (never on bulk/network activation), and it's also reachable anytime from a "Setup Wizard" link on the Dashboard.

== Module Manager ==
AI Toolkit → Module Manager shows every registered module - including the AI Pro Tools sub-features (SEO, Image Studio, Reply Generator, Prompt Library, Dating Profile Builder), which share one underlying toggle and are shown nested under it rather than implying they're independent - with its shortcode, a real running/not-running status (this catches a module whose file or class failed to load, not just whether the setting is checked), and an instant on/off switch. Turning on a Pro module without an active license is blocked with a clear message rather than silently doing nothing. Provider/API key setup still lives under Settings; license activation still lives under License — this page is specifically about which features are switched on.

== Role Permissions ==
AI Toolkit → Role Permissions lets you delegate the AI *workspaces* - AI Writer, AI Blog Writer, AI Pro Tools - to specific roles (Editor, Author, a custom staff role, etc.) without making them an Administrator. Administrators always have full access to everything automatically; this only ever adds access for other roles, never restricts an Administrator. Settings, License, Module Manager, History, and Analytics stay Administrator-only on purpose, since those touch API keys, billing, and other people's usage data. A delegated user sees a Dashboard scoped to only the workspace(s) they've been granted, with the admin-only setup/roadmap panels hidden rather than shown as dead-end links they can't follow.

== Demo Content ==
A "Load Demo Data" button appears on the History and Analytics pages whenever they're empty - adds a handful of realistic sample History entries and ~14 days of backfilled sample Analytics records, so a fresh install (or a public demo site) doesn't look empty before any real usage exists. The button only shows up when the relevant table is genuinely empty, and seeded data behaves identically to real entries (same favorite/delete/clear-all actions) rather than being a special case. **Ships to every install, including real customers** - it's a low-risk, first-impression improvement (a new customer's dashboard doesn't sit empty on day one) rather than a demo-site-only convenience.

== Batch Content Pipeline ==
AI Toolkit → Batch Content lets you paste a list of topics (one per line, optionally with a keyword and tone) and get a draft post generated for each one automatically, a few at a time in the background via WP-Cron - no babysitting one generation at a time, no server timeouts. Reuses the exact same generation logic as Blog Writer (including its word-count self-correction pass) rather than a separate, duplicated implementation. Capped at 50 topics per submission. Shares Blog Writer's Role Permissions delegation and Pro license gate, since it's genuinely the same kind of generation, just queued.

== Internal Linking Assistant ==
A panel in the post editor sidebar (Classic and Block editor both) that suggests internal links while you're writing - click "Scan for Links" and it compares the post against your other published posts' anchor keywords (a comma-separated field on each post; falls back to that post's title if left blank). In the Block editor, each match shows as a suggestion with Approve/Ignore - nothing is written into the post until you click Approve, and approved links are inserted through the block editor's own data layer so serialization stays intact. Classic Editor applies matches directly to the content since there's no equivalent in-editor review step there. Pro feature; the keyword field stays usable even without an active license.

== Auto-Updates ==
AI Toolkit Pro isn't on wordpress.org, so it ships its own self-hosted updater under AI Toolkit → Upgrade - it hooks into WordPress's native update UI exactly the way a wordpress.org plugin would (the Plugins page "update available" notice, the "View version details" popup), by checking a small JSON manifest hosted on your own server. "Update available" shows to every site regardless of license status; the actual download is only ever served to a site with an active license. Releasing a new version means uploading the zip and editing that one JSON file - no build pipeline.

== AI Provider ==
Choose Anthropic (Claude) or OpenAI (ChatGPT) under AI Toolkit → Settings → AI Provider. Both providers' API keys and models can be saved at the same time — switching the active provider doesn't require re-entering a key you've already configured. Every feature (Writer, Translate, Assistant, Moderation, Blog Writer, AI Pro Tools) automatically uses whichever provider is currently selected, with no other configuration needed.

== Free vs Pro ==
Every feature works on the free tier - generate and regenerate as much as you like everywhere. A Pro license removes the save/apply/execute limits below. See AI Toolkit → Upgrade for a live breakdown of your remaining free quota.

ALWAYS FREE, UNLIMITED:
1. AI Content / Bio Writer — [aitk_writer] shortcode, rewrites rough notes into polished copy (bios, listings, blurbs)
2. AI Translation — [aitk_translate]content[/aitk_translate], 14 languages, translate-on-click
3. AI Content Moderation — screens new comments for scam/abuse patterns via AI classification
4. Prompt Library — the built-in and custom prompt templates inside AI Pro Tools

FREE + PRO (generation is always free; a limit applies only when you commit the result):
5. Conversational AI Assistant — [aitk_assistant] shortcode, a chat widget that defaults to the site's own name (no agency branding). Free tier: 20 messages/day, site-wide. Pro: unlimited.
6. AI Blog Writer — admin-only tool under AI Toolkit → Blog Writer. Generates complete, original articles from a topic at your choice of length (Short ~800 / Medium ~1,200 / Long ~1,800 words, with the Long preset checked against Google AdSense content guidelines). Includes a Target Keyword field, an Additional Context field, and one-click "Copy HTML" / "Copy Text" / "Create WP Draft" actions. Generate and regenerate unlimited times for free; your first 3 posts saved to WordPress (via "Create WP Draft") are free, then Pro is required for unlimited saves.
7. Batch Content Pipeline — paste a list of topics, get an article generated for each one in the background. Free tier: every topic generates a full preview (no post created). Pro: results are automatically created as real WordPress draft posts.
8. Internal Linking Assistant — a panel in the post editor sidebar (Classic and Block editor both) that suggests internal links while you're writing. Scanning is free and unlimited on every tier. Applying a suggestion (Approve) requires Pro.
9. AI Pro Tools — admin workspace plus front-end shortcodes: [aitk_pro_tools] for the full suite, or individual shortcodes such as [aitk_humanize], [aitk_rewrite], [aitk_expand], [aitk_shorten], [aitk_simplify], [aitk_grammar], [aitk_tone], [aitk_seo], [aitk_reply], [aitk_proofread], [aitk_image_prompt], [aitk_dating_profile], and [aitk_ai_style_check]. Generate and regenerate unlimited times for free. Saving a result (the 💾 Save button in the admin workspace) is what counts against the free tier: Reply Generator, SEO Studio, Image Studio, and Dating Profile Builder each get their first 3 saves free; the general writing tools (Humanize, Rewrite, Expand, Shorten, Simplify, Grammar, Tone, Proofreader, AI Style Check) share their own 3 free saves. Every saved result appears under AI Toolkit → History for later review, with favorite/delete/clear actions.

== History ==
Every generation made through the AI Pro Tools admin workspace is logged under AI Toolkit → History - tool used, full input, full output, and timestamp - so past results can be revisited or copied again without re-running the prompt. Front-end shortcode usage by site visitors is never logged, since storing public visitors' input/output indefinitely is a separate privacy decision this plugin does not make on your behalf. History entries can be marked as favorites, deleted individually, or cleared in bulk per module.

The history table is created defensively the first time it's needed, rather than relying solely on the plugin's activation hook - a plugin update delivered by replacing files without a deactivate/reactivate cycle will still get the table correctly.

The Blog Writer and AI Pro Tools admin pages show the same kind of locked notice if accessed without a license. Front-end Pro Tools shortcodes show a small license/login notice instead of exposing raw shortcode text.

== Analytics ==
AI Toolkit → Analytics shows usage across every AI feature in the plugin - AI Writer, Translation, Chat Assistant, Comment Moderation, Blog Writer, and AI Pro Tools - broken down by module, by surface (admin tools vs. front-end shortcodes vs. automated background checks), and by day, with average response time, success rate, and a recent-errors list for quick troubleshooting.

This is metadata-only: call counts, timing, and character counts. It never stores the actual input or output text (that's what History is for, and History deliberately stays admin-only). Because it's metadata-only, front-end/public usage is included here even though it isn't in History - there's no privacy concern with counting that a translation happened, only with storing what was translated.

All of this is logged from one single choke point inside the plugin's API layer, so every module is covered automatically without needing its own separate instrumentation - new modules get analytics for free. The table is created defensively on first use, the same pattern as History, and old entries are pruned automatically after 90 days to keep it from growing forever on busy sites.

== Why "Bring Your Own Key" ==
Every site using this plugin uses its own API key (Anthropic or OpenAI - your choice, under AI Toolkit → Settings → Provider), set under AI Toolkit → Settings. Usage costs are billed directly to that key's owner — there's no shared backend, no per-site subscription beyond the Pro license itself, and no usage data passing through a third party.

== Cost Control ==
Each module is independently rate-limited per visitor, per hour (configurable, default 20/hour) to keep costs predictable even on busy sites.

== Licensing Setup (for the developer/seller) ==
1. ✅ Done: the Pro product exists in LemonSqueezy ("HiRizzi AI Toolkit Pro," Store #410767, Product #1165881)
2. ✅ Done: AITK_LS_STORE_ID and AITK_LS_PRODUCT_ID are hardcoded at the top of ai-toolkit-pro.php — a license key only validates if it actually belongs to this specific product, not just any valid key from another HiRizzi LemonSqueezy item
3. For local testing without a real license, define AITK_LICENSE_OVERRIDE = true in wp-config.php to unlock Pro features — never ship a build with this defined to a real customer

== Installation ==
1. Upload the `ai-toolkit-pro` folder to /wp-content/plugins/
2. Activate from WP Admin > Plugins
3. Go to AI Toolkit (opens the Dashboard) → Settings, choose a Provider (Anthropic or OpenAI), add that provider's API key, click "Test API Key"
4. Toggle on any modules you want - every module works free out of the box. Activate a license under AI Toolkit → Upgrade whenever you want to remove the free-tier save/apply limits.
5. Drop shortcodes onto pages, including [aitk_pro_tools] for the full front-end AI suite or individual tools like [aitk_humanize], [aitk_seo], [aitk_reply], and [aitk_dating_profile]
6. For long-form content, go to AI Toolkit → Blog Writer, enter a topic, choose a word count, and click Generate Blog Post (unlimited free; your first 3 saved posts are also free)

== Changelog ==
= 4.1.0 =
* Freemium relaunch, mirroring the model shipped for HiRizzi AI SEO: every feature now works free, with generation/regeneration unlimited everywhere. A quota is only consumed when something is saved, applied, or executed.
* Added AITK_Gate as the single centralized choke point for every free-vs-Pro decision, replacing scattered license checks across the plugin.
* Comment Moderation is now unlimited on every tier. Chat Assistant gets 20 free messages/day (site-wide), then Pro for unlimited. Blog Writer, Reply Generator, SEO Studio, Image Studio, and Dating Profile Builder each get their first 3 saves free, with unlimited free generation/regeneration before that. Batch Content Pipeline generates a full free preview per topic, with Pro auto-creating real WordPress drafts. Internal Linking scanning is unlimited and free; applying a suggestion requires Pro.
* Rebuilt the License page into a full Upgrade page: Free vs Pro comparison table, live remaining-quota cards, and Buy via LemonSqueezy / Gumroad buttons. Module Manager no longer disables any module toggle - Free vs Pro is enforced per-feature, not per-module.
* QA pass: fixed Batch Content Pipeline previews staying stuck on "Upgrade to publish" after a site upgrades to Pro (added a one-click Publish Now action), fixed Chat Assistant charging a daily message against quota even when the API call failed, and removed the last defensive license-check fallbacks so AITK_Gate is the only place Free/Pro logic lives.
* Critical fix (caught in independent pre-release review): the Batch Content Pipeline's table-migration check had an early return that skipped it entirely on any site upgrading from before the freemium tables existed, so the batch queue table would keep missing its new preview columns forever. Fixed, and a dedicated regression test now guards against this exact failure mode.
* Three further fixes from a second independent review pass: migration ALTER TABLE failures are now logged for diagnosis instead of silently ignored; publishing an old preview now safely handles a failed database update after the draft was already created (clear error, post ID logged for recovery, no duplicate draft on retry); corrected an inaccurate code comment about dbDelta()'s column-migration capabilities. Added a `tests/` directory with the full automated test suite (220 checks) and instructions for running it.
* Fixed a labeling bug caught during live staging testing on real WordPress: the free-tier quota-blocked message for every Pro Tools bucket (Reply Generator, SEO Studio, Image Studio, Dating Profile Builder, general Pro Tools) showed the raw internal feature key instead of its proper name. Added a regression test so this specific wording can't silently break again.

= 4.0.0-rc10.13 =
* Security hardening pass. Changes:
* The 3 public-facing shortcode REST endpoints (AI Writer, Chat Assistant, Translate) no longer accept requests with no verification at all - each now requires a valid WordPress REST nonce (`X-WP-Nonce`, generated fresh whenever the shortcode renders), closing off trivial direct API scripting/bot abuse of API credits while still working for every real visitor, logged in or not.
* IP detection in class-api.php now runs `wp_unslash()` on the `$_SERVER` header before validating it with `filter_var(..., FILTER_VALIDATE_IP)`.
* Fixed a real bug in the Settings and Setup Wizard API key fields: submitting the form with an API key field left blank was silently wiping the already-saved key instead of preserving it, in both save paths. The field itself no longer echoes the full saved key into the page at all - only a masked preview (e.g. `sk-ant••••1234`) shows separately, and the "Test API Key" buttons were updated so testing still works against the saved key when the field is left blank.
* Added optional `AITKP_ANTHROPIC_API_KEY` / `AITKP_OPENAI_API_KEY` constants - define either in `wp-config.php` to keep the real key out of the database entirely; when defined, it always takes priority over whatever is saved in Settings.
* Remote update manifest fields (`description`, `changelog`) are now passed through `wp_kses_post()` before being shown in the plugin update details modal.
* Replaced an `@`-suppressed `set_time_limit()` call in the Blog Writer with an explicit check against `disable_functions`, avoiding blanket error suppression.

= 4.0.0-rc10.12 =
* Fixed: Internal Linking's "Scan for Links" always returned "No new linking opportunities found," even with correct, matching anchor keywords. Root cause - AI Toolkit Pro's own Blog Writer/Batch Pipeline save generated posts as plain HTML, which WordPress loads as a single Classic block (`core/freeform`), not individual `core/paragraph` blocks. The scanner only checked `core/paragraph`/`core/list-item`, so it found nothing to search on every AI-generated post - confirmed via live testing on the demo site, traced through the AJAX response (which was correct - the bug was entirely client-side, in which blocks got scanned).
* Also fixed: the live block list was read once when the panel first rendered and never refreshed, so a scan run without reloading the page first could miss edits made after the panel mounted. Now reads the block tree fresh at the moment "Scan for Links" is clicked.

= 4.0.0-rc10 =
* Added Smart Internal Linking Assistant (post editor sidebar, both Classic and Block editor): on-demand "Scan for Links" panel that compares the current post's content against other published posts' anchor keywords (a new comma-separated field on each post, falling back to that post's title when left blank) and suggests internal links.
* Nothing is auto-inserted. Gutenberg shows each match as a suggestion with Approve/Ignore; only Approve calls updateBlockAttributes() to write the link, so WordPress's own block parser handles re-serialization rather than a raw string-replace against post_content.
* Classic Editor gets a simpler scan-and-apply flow instead of per-suggestion Approve/Ignore, since there's no React-based UI layer available there without a bigger dependency than this feature warrants - worth revisiting if Classic Editor users want the same review step.
* Skips any phrase already inside an `<a>` tag, and suggests at most one link per target post per scan, so repeated scans don't pile up duplicate or redundant links.
* New `modules/internal-linking/class-aitk-internal-linking.php` + `assets/js/internal-linking.js`. Pro license gated and re-checked on every scan request, same pattern as Batch Pipeline and Blog Writer; the keyword field itself stays available even without a license so nothing is lost if one lapses.
* Registered in the Module Manager, Settings, and Dashboard like every other module. Not added to Role Permissions - access follows WordPress's own `edit_post` capability rather than a separate delegated area, since anyone who can edit a post already needs this.

= 4.0.0-rc9 =
* Added Batch Content Pipeline (AI Toolkit → Batch Content): paste a list of topics, one per line, and get a draft post generated for each one automatically in the background, a few at a time. Reuses Blog Writer's existing generate_article() directly rather than duplicating its prompt/word-count-correction logic.
* Uses native WP-Cron with a small queue table (same defensive-creation pattern as History/Analytics), not Action Scheduler - that's a substantial external library normally provided by WooCommerce, and pulling it in as a new bundled dependency was a bigger commitment than this feature needed.
* Capped at 50 topics per batch submission to bound cost/abuse on a single request; processes 2 rows per cron tick to keep API usage naturally throttled and avoid timeouts.
* Shares the same Role Permissions area as Blog Writer (delegating either one delegates both) since it's genuinely the same kind of generation, just queued - and the same Pro license gate.
* Known simplification: Analytics attributes these calls to the "blog-writer" module (since the underlying AITK_API::call() context is unchanged from Blog Writer's own), not a separate "batch-pipeline" line item - accurate about what kind of call happened, just doesn't distinguish the bulk trigger from the one-at-a-time form.

= 4.0.0-rc8.11 =
* Added a further mobile CSS hardening pass targeting AI Toolkit Pro's own demo/landing pages specifically (pages that wrap the shortcode inside custom `.aitkp-demo-page`/`.aitkp-sales-page` content) - confirmed fixing the remaining horizontal-scroll issue on a real device after the general fixes below weren't quite enough on those specific pages.
* Note for future maintenance: rc8.7 through rc8.10 (below) each added a mobile media-query block addressing the same underlying horizontal-scroll bug without removing the previous attempt - all four still exist in the stylesheet, layered on top of each other. They don't conflict in a way that's currently breaking anything (confirmed working on a real device), but this is worth consolidating into one clean block in a future release rather than continuing to stack new attempts on top.

= 4.0.0-rc8.7 through rc8.10 =
* Four successive attempts at fixing the mobile horizontal-scroll bug in the `[aitk_pro_tools]` workspace, each refining the previous approach: a defensive `overflow-x:hidden` on `<html>`/`<body>` whenever the workspace is present (since the `overflow:visible` forced onto the theme's content wrapper, added to fix an earlier desktop layout issue, may have removed a safety net the theme relied on to silently clip minor overflow); then viewport-relative width recalculations; then viewport-centered margins. See rc8.11 above for the addition that confirmed fully resolving it.

= 4.0.0-rc8.5 =
* Fixed: the front-end AI Pro Tools workspace (`[aitk_pro_tools]`) required horizontal scrolling to view fully on narrow mobile screens (iPhone). Root cause: its width was calculated as `100vw - 48px`, which ignores any ancestor's padding - fine on a plain WordPress page, but breaks when the shortcode is nested inside extra wrapper divs (like a custom landing page with its own padding), where the computed width ends up a few pixels wider than what's actually available.
* Replaced with a percentage-based width (`width:100%` plus padding, both `box-sizing:border-box`) that correctly respects whatever container the widget is actually placed in, instead of fighting against the raw viewport.

= 4.0.0-rc8.4 =
* Fixed a real licensing gap before any actual sale happened: AITK_LS_PRODUCT_ID was still an empty placeholder, which meant the product-match check in AITK_License silently skipped itself - any valid LemonSqueezy license key from any of HiRizzi's other products (or, in principle, anyone else's) would have validated as an active Pro license for this plugin too.
* Hardcoded the real Store ID (#410767) and Product ID (#1165881) for "HiRizzi AI Toolkit Pro" directly into ai-toolkit-pro.php - a license key now only activates Pro features if it actually belongs to this specific product.
* Caught during pre-launch setup, before the product's Files were uploaded for real - the version previously attached to the Lifetime variant on LemonSqueezy was an early development build from before this entire RC6-RC8 phase and should not be sold; this is the version that should replace it.

= 4.0.0-rc8.3 =
* Added self-hosted auto-updates: hooks into WordPress's native update UI (Plugins page "update available" notice, the "View version details" popup) by checking a JSON manifest you host yourself - no wordpress.org listing needed.
* "Update available" is shown to every site regardless of license status (so an expired/unlicensed customer knows an update exists and that renewing unlocks it), but the actual download package is only ever supplied to a site with an active license - same pattern most self-hosted premium WP plugins use.
* Added a "Check for Updates Now" button and status panel under AI Toolkit → License.
* This is genuinely new code, fully independent of LemonSqueezy - it needs a JSON manifest hosted somewhere (default: hirizzi.com/wp-updates/ai-toolkit-pro/info.json, overridable via the AITKP_UPDATE_MANIFEST_URL constant), which is a one-time server setup task, not something further code can do.

= 4.0.0-rc8.2.2 =
* Fixed the front-end AI Pro Tools workspace (`[aitk_pro_tools]`) rendering pushed to the right edge and cut off on Twenty Twenty-Five (and likely other block themes). Root cause: the old "full-bleed" CSS technique (`width:100vw` + negative margins to escape a constrained content column) silently breaks on any theme wrapper with its own positioning/overflow handling - it was fighting the theme instead of working with it.
* Replaced it with a `body:has(.aitk-pro-suite) ...` rule that directly widens the actual content container (`max-width:none; width:100%; overflow:visible`) - more robust, and also fixes a second bug it incidentally solved: the page title rendering twice, by hiding the theme's own title block whenever the workspace is present on the page.
* Centralized the workspace's shared CSS/JS into `frontend_assets_once()` (already printed exactly once per page load) instead of duplicating it across the suite and single-tool renderers - removes redundancy without losing functionality for either `[aitk_pro_tools]` or individual tool shortcodes like `[aitk_seo]`.
* Minor copy: license-required notices now say "AI Toolkit Pro" instead of "AI Pro Tools" for consistency with the rest of the plugin's naming.

= 4.0.0-rc8 =
* Added Demo Content: a "Load Demo Data" button on History and Analytics, shown only when each is genuinely empty, that seeds realistic-looking sample entries/usage records - built for the new public demo install (demo-aitoolkitpro.hirizzi.com) but works on any fresh install.
* Both AITKP_History::log() and AITKP_Analytics::log() gained an optional backdated-timestamp override (fully backward compatible) so seeded demo data shows a believable spread of dates instead of everything timestamped "right now."
* This closes out RC8's buildable items: Documentation (rc7.1), Security review (rc7.1), and now Demo Content. Screenshots and video tutorials are not something achievable without a live site to capture from and are out of scope here.

= 4.0.0-rc7.2 =
* Fixed: the Dashboard's Quick Launch grid never had cards for Chat Assistant or Comment Moderation - both were enabling correctly and working fine, they just weren't visible there. Found during real-world testing on the new demo install. Added both, with the same conditional Copy-button handling as the other admin-only/automatic-running modules.
* Updated the Release Progress / Launch Checklist panel, which still said "RC3" and stopped at "Final" - now reflects the real state through RC7 and into RC8.

= 4.0.0-rc7.1 =
* Documentation page updated for the first time since v3.0.1 - added a "Managing the Plugin" section covering History, Analytics, Module Manager, Role Permissions, and the Welcome Wizard (none of which were documented in-admin at all until now), and backfilled the "What's New" log with every RC1-RC6.4 entry
* Security review pass: found and closed a real XSS gap in the Blog Writer preview - the AI-generated article body was sent to the browser unsanitized and inserted via raw innerHTML for the preview; a successful prompt injection via the topic/keyword/context fields could have run script in an admin's browser before the post was ever saved. Now sanitized server-side with the same wp_kses_post() already used at save time.
* Hardened AITKP_History::get_page() to cast its own pagination inputs internally rather than relying on every future caller to pre-sanitize them - today's only caller was already safe, but the method itself wasn't self-defending
* Confirmed (no change needed): AI Pro Tools' rich-card rendering already inserts AI output via textContent rather than innerHTML; all public-facing AI endpoints are rate-limited per-IP per-feature; ajax_create_draft() already sanitized post content before saving

= 4.0.0-rc7 =
* Consolidates the four RC7 deliverables (Analytics, Welcome Wizard, Module Manager, Role Permissions - rc6.1 through rc6.4 below) as a completed phase

= 4.0.0-rc6.4 =
* Added Role Permissions (AI Toolkit → Role Permissions): delegate the AI Writer, AI Blog Writer, and AI Pro Tools workspaces to specific roles (Editor, Author, etc.) without making them an Administrator. Administrators always retain full access automatically - this system only ever adds access, never restricts.
* Settings, License, History, Analytics, Module Manager, and Role Permissions itself remain Administrator-only by design.
* The Dashboard now shows a scoped view for delegated users — only the workspace(s) they've been granted, with admin-only setup/roadmap panels hidden instead of left as dead-end links.
* While wiring this up, found and closed two pre-existing access-control gaps: the Blog Writer and AI Pro Tools admin pages had no explicit capability check of their own and were relying solely on the WordPress menu-level gate — loosening that gate for delegation would have left both pages open to any logged-in user without the fix that's now in place.

= 4.0.0-rc6.3 =
* Added Module Manager (AI Toolkit → Module Manager): every registered module in one place, with a live on/off switch, its shortcode, and a real running/not-running status check (catches a module whose file or class didn't load, not just whether it's toggled on)
* Submodules that share one underlying toggle (the AI Pro Tools sub-features: SEO, Image Studio, Reply Generator, Prompt Library, Dating Profile Builder) are shown nested under that toggle rather than implying each has its own independent switch
* Toggling a Pro module on without an active license is blocked with a clear message instead of silently doing nothing
* Module registry gained lightweight health tracking (file/class load success per module) so this page can show real status rather than decoration

= 4.0.0-rc6.2 =
* Added a 5-step Welcome Wizard, shown automatically on first plugin activation (single-plugin activation only, never on bulk/network activation): overview → connect AI provider (with live key testing) → enable features → activate license → finish with shortcodes to drop onto a page
* Every step is skippable; nothing in the wizard is a one-time gate — all of it can be revisited later under Settings/License, and the wizard itself is reachable anytime via a "Setup Wizard" link on the Dashboard
* Wizard steps save only the fields they show, merged into existing settings via a dedicated handler — reusing the full Settings-page save handler here would have silently zeroed out checkboxes from whichever step wasn't currently on screen

= 4.0.0-rc6.1 =
* Added Analytics (AI Toolkit → Analytics): usage tracking across every AI feature in the plugin, broken down by module, by surface (admin / front-end / automated), and by day, with success rate, average response time, and a recent-errors list
* Metadata-only logging (counts and timing, never the actual input/output text), hooked from a single choke point in the API layer so every existing and future module is covered automatically
* Analytics table created defensively on first use (same pattern as History) with automatic 90-day pruning so it doesn't grow unbounded on busy sites

= 4.0.0-rc6 =
* Completed Dynamic Forms per tool on the admin AI Pro Tools page (the front-end shortcode already had this; the admin workspace was still using one generic Input/Tone/Context box for every tool regardless of which was selected)
* Added Rich Result Cards: SEO, Image Studio, Dating Profile, and AI Style Check now render as individual labeled cards (each with its own Copy button) instead of one wall of text. Their prompts were tightened to a strict, parseable delimiter format rather than relying on the model's loose natural-language formatting.
* Added a real loading animation (spinner) shared identically by the admin page and the front-end shortcode, replacing plain "Working..." text
* Added History (AI Toolkit → History): every admin-side Pro Tools generation is now logged with full input/output, with view/favorite/delete/clear-all and pagination. Front-end shortcode usage by site visitors is not logged.
* Added Save Templates: custom prompt templates can now be saved from the admin workspace and reused alongside the built-in ones, with their own delete control

= 4.0.0-rc5.1 =
* Rebuilt [aitk_pro_tools] as a universal front-end AI Workspace with left navigation and large focused tool panels.
* Replaced the cramped card launcher UI with a professional SaaS-style workspace.
* Preserved all existing front-end shortcodes and AJAX behavior.


= 4.0.0-rc2 =
* Upgraded AI Image Studio to generate complete WordPress image publishing packages: AI prompt, negative prompt, SEO filename, alt text, title, caption, media description, keywords, OG copy, and social post text.

= 4.0.0-rc2 =
* Rebuilt AI Pro Tools as a modular front-end suite.
* The [aitk_pro_tools] tabs now switch complete tool modules, not just titles.
* Each tool has its own proper fields, labels, and prompt structure.
* Individual shortcodes remain available for focused pages.

= 2.2.2 =
* Dashboard now shows the complete AI Pro Tools shortcode list.

= 2.2.2 =
* Added front-end AI Pro Tools shortcodes: [aitk_pro_tools] full suite plus individual tools including [aitk_humanize], [aitk_rewrite], [aitk_expand], [aitk_shorten], [aitk_simplify], [aitk_grammar], [aitk_tone], [aitk_seo], [aitk_reply], [aitk_proofread], [aitk_image_prompt], [aitk_dating_profile], and [aitk_ai_style_check]
* Added front-end AJAX generation for Pro Tools with nonces, per-visitor rate limiting, license gating, guest support, and optional require_login shortcode attribute
* Updated dashboard/documentation so buyers understand AI Pro Tools are not admin-only

= 2.1.0 =
* Added AI Pro Tools admin workspace (Pro): Humanize, Rewrite, Expand, Shorten, Simplify, Fix Grammar, Change Tone, SEO Assistant, AI Reply Generator, Proofreader, AI Image Studio, Dating Profile Generator, Prompt Templates, and AI Style Check
* Added dashboard, settings, and documentation entries for AI Pro Tools
* Added backward-compatible settings defaults so existing installs automatically see the new feature toggle

= 2.0.0 =
* Added OpenAI (ChatGPT) as a second AI provider alongside Anthropic. Choose the active provider under Settings → AI Provider; both providers' keys/models can be saved at once, and switching doesn't require re-entering a key. Every feature (Writer, Translate, Assistant, Moderation, Blog Writer, AI Pro Tools) works unchanged regardless of which provider is active.
* "Test API Key" now has an independent button per provider
* This is an architectural change (a real second API integration, not just a settings option), hence the major version bump

= 1.4.0 =
* Added an in-admin Documentation page (AI Toolkit → Documentation) showing the Free vs Pro breakdown, Getting Started steps, and What's New — readme.txt is never rendered inside WP Admin for plugins distributed outside WordPress.org, so this gives customers the same information without needing to open a separate text file
* Linked from the Dashboard

= 1.3.2 =
* No functional changes - documentation corrections only. Readme's Blog Writer description was stale (still described the old fixed 1500-1800 word range instead of the Short/Medium/Long presets), the plugin's own header description didn't mention Blog Writer at all, and a stray empty directory left over from an earlier build step was removed from the package.

= 1.3.1 =
* Added a "Need a Custom AI Feature?" card to the Dashboard - admin-only upsell pointing existing customers to hirizzi.com for custom feature requests (does not affect anything customer-facing, since the chat widget/translate button/etc. shown to site visitors stay fully white-labeled)

= 1.3.0 =
* Added: a proper Dashboard landing page (AI Toolkit's top-level menu now opens an overview of every feature with its shortcode and a usage tip, instead of dropping straight into Settings)
* Settings moved to its own distinct menu entry (separate from Dashboard)
* Fixed: a "Activate a license" link on the locked Assistant notice pointed to Settings instead of the License page

= 1.2.1 =
* Fixed: Generated Post panel sat empty with no visible feedback while an article was being written - now shows a spinner and "AI is writing your blog post..." while waiting

= 1.2.0 =
* AI Blog Writer upgraded: two-column layout with a Tips/Post-Includes sidebar, Word Count selector (Short/Medium/Long), Additional Context field, and Copy HTML / Copy Text buttons alongside Create WP Draft
* Word-count target now adapts to the selected length preset, with the self-check/auto-correction pass adjusting accordingly

= 1.1.2 =
* Fixed: AI Blog Writer failing with "Network error" on every attempt - the underlying API call used a 30-second timeout meant for short responses, which a full 1500-1800 word article generation can easily exceed. Blog Writer now uses a 150-second timeout (other features are unaffected), and the PHP execution time limit is raised to match.

= 1.1.1 =
* Fixed: AI Blog Writer's menu page showed "Sorry, you are not allowed to access this page" for actual administrators, caused by the submenu registering before its parent menu existed (a load-order bug, not a real permissions issue)

= 1.1.0 =
* Added: AI Blog Writer (Pro) — generates complete 1500-1800 word articles from a topic, with heading structure, AdSense content-guideline awareness, automatic word-count verification with one expand/trim pass, and a one-click "Create Draft Post" button

= 1.0.0 =
* Initial release: AI Writer, Conversational Assistant, Translation, Content Moderation
* Free/Pro split: Writer + Translation free, Assistant + Moderation require a license
* LemonSqueezy license gating with test-mode override for development
* Bring-your-own-key settings with live key testing, per-feature rate limiting
