*** WooCommerce Fraud Protection Changelog ***

2026-08-03 - version 0.1.6
* Added - Merchant allow and block rules matched on a shopper's email address or IP address, with no management screen yet; block rules apply even in learning mode.
* Added - Session log recording every checked session with the decision received and the outcome applied, pruned automatically after 30 days.
* Fixed - A blocked checkout attempt no longer follows the shopper for the rest of their session; each attempt is checked again, so a false positive is recoverable.
* Fixed - Orders are verified even when the cart holds a value the request cannot encode; the value is left out instead of the check.
* Fixed - Cart item quantities are recorded as WooCommerce supplies them regardless of their type.
* Updated - PayPal express and card-fields decisions are bound to the PayPal order they were made for, so one decision cannot answer for another order or be reused more than one time.
* Updated - Resolved payment data classes and the blocked-session message moved to the public API, so payment gateway integrations no longer depend on internal classes.
* Updated - Verify requests send the visitor IP and headers on every check, and the session ID the service returns is used for later reporting.
* Dev - The decision filter is renamed from woocommerce_fraud_protection_decision to woocommerce_fraud_protection_automated_decision, since it overrides the automated verdict only and never a merchant rule; the new woocommerce_fraud_protection_rule_applied action reports rule-decided outcomes.
* Dev - woocommerce_fraud_protection_skip_session_verify now requires a decision object to apply as its return value; any other value results in a normal check.
* Dev - FraudProtectionReporter::report() takes report_id (required) and occurred_at parameters, matching the new service contract.

2026-07-03 - version 0.1.5
* Fixed - Fatal error in cart event tracking on stores that allow decimal product quantities; quantity tracking now supports whole and fractional values.
* Updated - Cart event tracking callbacks now fail open and log unexpected errors instead of interrupting shopper requests.
* Updated - Require PHP 8.1 or newer; on older PHP versions the plugin safely skips loading instead of activating.
* Updated - Modernized the codebase with PHP 8.1 enums and readonly data objects; public interfaces and filters now use typed enums (e.g. FraudDecision) in place of decision strings.

2026-07-01 - version 0.1.4
* Added - Reporting interface for payment outcomes (payments, disputes, refunds).
* Fixed - Skip fraud verification on classic checkout submissions that already failed WooCommerce validation, avoiding unnecessary processing.
* Fixed - Throttle repeated plugin startup warnings (e.g. on unsupported WooCommerce versions) to once per day instead of once per request.
* Updated - Persist the fraud session identifier on guest orders placed without a browser session so outcomes track consistently.
* Updated - Substantial internal refactoring across the plugin, including a new dependency-injection architecture and WooCommerce-core-aligned namespaces, for long-term maintainability.

2026-05-17 - version 0.1.3
* Updated - Update init logic to match the latest changes in Blackbox SDK.
* Updated - Reduce Blackbox request timeouts to 3 seconds (browser SDK and server-side verify/report calls) to bound worst-case checkout latency.
* Updated - Harden plugin startup so missing dependencies (autoloader, WooCommerce Blocks classes, optional checkout schemas) fail open instead of producing a fatal.
* Added - Optional PHP error log forwarding for selected operational events (transport failures, response parsing failures, third-party filter failures) with a strict context-key allowlist.

2026-04-16 - version 0.1.2
* Fixed - Broken asset URLs when the plugin file is located outside of WP_CONTENT_DIR
* Updated - Switch to PSR-4 autoloading to load files only when needed

2026-03-30 - version 0.1.1
* Updated - Enable plugin by default (remove WC_FRAUD_PROTECTION_DISABLED kill-switch default)

2026-03-30 - version 0.1.0
* Added - Fraud protection via Blackbox API with session-based clearance management
* Added - Checkout protection for blocks, shortcode, pay-for-order, and add-payment-method flows
* Added - Subscriptions change-payment-method integration
* Added - Payment data resolution for WooPayments
* Added - Cart and checkout event tracking (add, remove, update, page load, field updates)
* Added - Blocked session notices and cart restrictions
* Added - Order event reporting with session ID persistence
* Added - Learning mode and no-session support for initial deployment
* Added - MU-plugin loader with WC_FRAUD_PROTECTION_DISABLED kill-switch