=== A1 Tools ===
Contributors: a1tools
Tags: site variables, contact info, business information, multi-site, shortcodes
Requires at least: 5.0
Tested up to: 6.9
Stable tag: 2.5.24
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Centrally manage contact information, social media links, and business details across your WordPress sites from the A1 Tools platform.
== Description ==
A1 Tools connects your WordPress site to the A1 Tools platform, enabling centralized management of business information that can be displayed anywhere on your site using simple shortcodes.
**Perfect for businesses with multiple websites** - update your phone number, address, or social media links once in the A1 Tools dashboard, and all your connected sites update automatically.
= Features =
* **Centralized Management** - Manage all your site variables from one dashboard
* **Simple Shortcodes** - Display any variable with `[a1tools_var key="phone_primary"]`
* **Address Formatting** - Multiple address display formats available
* **Operating Hours** - Display business hours as tables or lists
* **Social Media Links** - Output all social icons with one shortcode or widget
* **Social Icons Widget** - Customizable widget with style, shape, size, and hover effects
* **Elementor Support** - Dynamic tags for Elementor page builder
* **Performance Optimized** - Configurable caching (default 5 minutes)
* **Developer Friendly** - PHP functions available for theme developers
= Available Variables =
* Business name, city name, state/location name, tagline
* Google Maps URL for location
* Primary and secondary phone numbers
* Primary and secondary email addresses
* Full address (line 1, line 2, city, state, ZIP, country)
* Social media URLs (Facebook, Instagram, YouTube, Twitter, LinkedIn, TikTok, Yelp, Google Business)
* Operating hours for each day of the week
= Shortcode Examples =
`[a1tools_var key="phone_primary"]` - Display primary phone number
`[a1tools_var key="facebook_url" link="true"]` - Display Facebook URL as clickable link
`[a1tools_address format="full"]` - Display complete formatted address (multi-line)
`[a1tools_full_address]` - Display full address in a single line (e.g., "123 Main St, Suite 101, Miami, FL 30001")
`[a1tools_hours format="table"]` - Display operating hours as a table
`[a1tools_social_links]` - Display all configured social media icons
`[a1tools_social_links style="default" shape="circle" size="50"]` - Styled social icons
`[a1tools_city_name]` - Display the city name for geo-targeting
`[a1tools_state]` - Display the state name for geo-targeting
`[a1tools_google_map type="link"]` - Display Google Maps link
`[a1tools_google_map type="embed" width="100%" height="400"]` - Embed Google Maps iframe
= Requirements =
* Your WordPress site must be registered in the A1 Tools platform
* An active A1 Tools account with site variables configured
* Font Awesome 6 for social icons (most themes include this; if not, use a Font Awesome plugin)
== External Services ==
This plugin relies on a third-party service to retrieve site variables (business information, contact details, social media URLs, etc.) that you configure in the A1 Tools dashboard.
= A1 Tools API =
**What it is:** A1 Tools is a business management platform operated by A1 Chimney Service that allows businesses to centrally manage their contact information, addresses, operating hours, and social media links across multiple websites.
**What data is sent:** When this plugin is activated and the site loads (or when a shortcode is used), the plugin sends your WordPress site URL to the A1 Tools API to retrieve the site variables you have configured for that specific site.
**When data is sent:**
- When a page containing A1 Tools shortcodes is loaded
- When the plugin's admin settings page is accessed
- When the cache expires and fresh data is needed (configurable, default 5 minutes)
**What data is received:** The plugin receives only the site variables you have configured in your A1 Tools dashboard, such as business name, phone numbers, email addresses, physical address, operating hours, and social media URLs.
**Service Provider:** A1 Chimney Service
**API Endpoint:** https://tools.a-1chimney.com/api/website_variables.php
**Terms of Service:** https://a-1chimney.com/terms-of-service/
**Privacy Policy:** https://a-1chimney.com/privacy-policy/
= Google Maps Embed API =
**What it is:** Google Maps is a web mapping service developed by Google. This plugin can embed Google Maps iframes to display your business location.
**What data is sent:** When using the `[a1tools_google_map type="embed"]` shortcode, your visitor's browser loads an iframe from Google Maps containing your business address or place ID that you configured in the A1 Tools dashboard.
**When data is sent:**
- Only when a page containing the `[a1tools_google_map type="embed"]` shortcode is loaded
- The embed is loaded client-side by the visitor's browser directly from Google
**What data is received:** Google Maps returns the embedded map showing your business location. Google may collect visitor data according to their privacy policy.
**Service Provider:** Google LLC
**Embed URL:** https://www.google.com/maps/embed/v1/place
**Terms of Service:** https://www.google.com/intl/en_us/help/terms_maps/
**Privacy Policy:** https://policies.google.com/privacy
== Installation ==
1. Upload the `a1-tools` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Ensure your site is registered in your A1 Tools dashboard under Integrations > WordPress Sites
4. Configure your site variables in A1 Tools under Marketing Tools > Web Management > Site Variables
5. Use the shortcodes in your pages, posts, or widgets
== Frequently Asked Questions ==
= How do I get an A1 Tools account? =
A1 Tools is a business management platform. Contact A1 Chimney Service for access information.
= Why are my variables not showing? =
1. Verify your site URL in A1 Tools matches your WordPress site URL exactly (including https://)
2. Check that you have saved variables for this site in A1 Tools
3. Go to A1 Tools in your admin menu and click "Clear Cache Now" to fetch fresh data
= How often do variables update? =
Variables are cached based on your settings (default 5 minutes). You can configure the cache duration or disable caching entirely in the A1 Tools settings page. To force an immediate update, use the "Clear Cache Now" button on the settings page.
= Can I use this with Elementor? =
Yes! The plugin registers dynamic tags that appear under the "A1 Tools" group in Elementor. You can also use the Shortcode widget with any of the available shortcodes.
= Is this plugin free? =
The plugin is free and open source. However, it requires an A1 Tools account to function, as it retrieves data from the A1 Tools platform.
= What data does this plugin send to external services? =
See the "External Services" section above for complete details. In summary, the plugin sends your site URL to the A1 Tools API to retrieve the site variables you have configured. No personal user data from your visitors is collected or transmitted.
== Screenshots ==
1. Site Variables management in A1 Tools dashboard
2. Using shortcodes in the WordPress editor
3. Elementor dynamic tags integration
== Changelog ==
= 2.5.24 =
* New: Web Form widget → Title & Subtitle style section gains per-breakpoint Alignment controls (Desktop / Tablet / Mobile, with Left / Center / Right options). Lets editors center the hero title on desktop while keeping it left-aligned on mobile (or any combination). Default empty inherits whatever the parent column dictates, so existing forms render unchanged.
= 2.5.23 =
* New: Web Form widget → Container style section gains a "Border color (hover)" control, sitting directly below the normal Border group. Pairs a fade transition (`border-color 180ms ease`) on the wrap so the swap is smooth instead of snapping. Matches the existing Submit Button's Normal / Hover pattern so editors expecting hover states on bordered elements get a consistent experience.
= 2.5.22 =
* Fix: Web Form widget — Submit Button "Full width" alignment now actually renders full-width. The 2.5.2 implementation used `justify-content: stretch` (which isn't a valid value for `justify-content` — only `align-items`/`align-content` accept it, so browsers silently dropped it and fell back to `flex-end`) paired with a `[data-align="full"]` attribute selector for the `width: 100%` rule (which never matched in Elementor's live editor preview because the editor only re-injects CSS, not HTML, until you save + reload). Both alignment and width now flow through CSS variables (`--submit-justify`, `--submit-width`) that Elementor emits on the `.a1tools-web-form__actions` wrapper, so the button responds in real time to the alignment toggle in the editor sidebar AND on the published page. Left / Center / Right also pick up the same variable plumbing for consistency.
= 2.5.21 =
* New: Web Form widget — Custom Fields type whitelist gains a "Time" option (renders an ``). Useful alongside the existing Date type for appointment-preference or booking-window forms. Server-side validator in the A1 Tools CRM API extended in lock-step so the new type round-trips into `crm_web_form_submissions.custom_fields` cleanly.
* New: Web Form widget — per-field responsive Column Width control on BOTH Standard Fields and Custom Fields repeaters. Each row exposes a Desktop / Tablet / Mobile dropdown (100% / 75% / 66% / 50% / 33% / 25%) so editors can lay out e.g. First Name + Last Name side-by-side on desktop while remaining stacked on mobile. Tablet inherits Desktop, Mobile inherits Tablet, unless explicitly set. Under the hood the form switches from single-column flex to a 12-column CSS grid; existing forms render unchanged (each field defaults to full-width).
= 2.5.20 =
* Maintenance: WP.org publish baseline catch-up. The wordpress.org SVN tags had drifted behind by 9 versions (2.5.11–2.5.19 were never tagged on the public plugin marketplace; sites updating from wordpress.org therefore still saw 2.5.10 as the latest available build). 2.5.20 republishes the current trunk so customer sites pick up everything between 2.5.10 and current in a single update. No behavioral changes vs 2.5.18 — see prior entries below for what shipped over the catch-up window (Web Leads / Live Chat overhaul, multi-tenant CRM scoping, franchise grid stabilization, etc.).
= 2.5.18 =
* Improve: Franchise grid shortcode — when a franchise card has no street/city/state/zip fields populated, the embedded map now falls back to `lat,lng` coordinates instead of using the franchise name as the search query (which would otherwise resolve to an unrelated "A1 Chimney" listing in another state). If neither address nor coordinates exist, the map is omitted entirely.
* Fix: Franchise grid card layout — cards become flex columns with `min-height: 2.5em` + `line-height: 1.25` on the title and `margin-top: auto` on the directions link. Stops the map iframe from jumping rows when one card has a single-line title and the neighbor has two lines.
= 2.5.17 =
* Tweak: Live Chat default greeting copy — "Hi! Thanks for reaching out — a team member will be with you in just a moment." → "Hi! Thanks for reaching out, a team member will be with you as soon as possible." Dropped the em-dash for a comma-joined single thought, and softened the "moment" promise into "as soon as possible." Per-widget override still wins — existing Elementor placements that already saved the old wording need to be edited (or cleared) in the widget admin to pick up the new default. A one-time migration on plugin activation also rewrites any saved Elementor postmeta values still carrying the old phrase to the new one.
= 2.5.16 =
* Fix: Live Chat pre-chat form — name + phone-or-email fields rendered with the customer site's theme-default "dark form" styling (black background, white text) instead of the plugin's intended white-with-dark-text. Some Astra / Hello-Elementor child themes ship a `body input { background: #000; color: #fff }` rule that loads after the plugin's stylesheet and wins on cascade order. Hardened `.a1tools-web-chat-window__prechat input, textarea` with `!important` on background + color + border to defeat the theme cascade (same pattern as the 2.5.7 SVG-fill fix). The new "How can we help?" textarea was visually correct out of the box in 2.5.15 only because no theme had targeted a bare `textarea` element yet; it's now under the same shield for safety.
= 2.5.15 =
* New: Live Chat pre-chat form — added a third field, "How can we help?" (label + required-flag + placeholder all configurable in the Elementor widget admin). The visitor types their first question or message before starting the chat. Server-side: the question is stored as the first `sender='visitor'` message in the conversation, between "Chat started by …" and the auto-greeting, so the flow reads as: (1) system header, (2) visitor's question, (3) auto-reply / "team member will be with you shortly." Dispatchers viewing the chat in the CRM Web Leads inbox see the visitor's intent immediately instead of having to ask "what brings you here?" once they pick up.
= 2.5.14 =
* Improve: Live Chat — pre-chat greeting now renders as a real left-aligned chat bubble (matching the look of an actual dispatcher message), instead of the centered italic system notice 2.5.12 used. The visitor's eye reads it immediately as "someone is replying" rather than as session metadata. The hairline divider between session metadata and the conversation now lands directly under "Chat started by …", with the greeting on the *conversation* side of the divider where it belongs.
* New: server-side `auto` sender type added to `crm_web_chat_messages.sender` ENUM. Distinct from `system` so the dispatcher's CRM inbox and the visitor widget can both render auto-replies as chat bubbles while keeping the centered-italic styling exclusively for true session metadata ("Chat started by …", "Chat marked resolved by …", etc.).
= 2.5.13 =
* Fix: Live Chat — business-hours cutoff was 4:00 PM in 2.5.12 but should have been 5:00 PM Florida time. Widget now renders 9:00 AM – 5:00 PM (`$hour >= 9 && $hour < 17`).
= 2.5.12 =
* Improve: Live Chat — pre-chat greeting (the "Hi! Thanks for reaching out — a team member will be with you in just a moment." message configured per-widget) is now persisted on the server as a system message immediately after "Chat started by …", instead of being a local-only bubble in the visitor's browser. Two consequences: (1) the greeting always renders AFTER the session header in proper chronological order (the 2.5.10 local bubble raced the polling loop and frequently won, putting the greeting ABOVE "Chat started by …"); (2) dispatchers viewing the chat in the CRM Web Leads inbox now see the exact same flow the visitor sees — previously the dispatcher saw only "Chat started by …" and had no idea what auto-reply the visitor had already received.
* New: Live Chat — business-hours gate. The chat widget now only renders between 9:00 AM and 5:00 PM Florida time (America/New_York, automatically respecting EST/EDT DST). Outside those hours visitors don't see the chat option at all (no button, no JS init, no `.a1tools-web-chat` placement), so they fall through to the contact form / phone instead of pinging an unstaffed inbox. The cutoff is hard-coded for now — if you need configurable hours per widget, let us know.
= 2.5.11 =
* Cache-bust re-tag of 2.5.10. No functional changes — the 2.5.10 fixes (greeting-as-dispatcher-bubble, system-message divider, raised floating button) were correct, but Elementor's "Improved Asset Loading" experiment had baked the widget's CSS/JS inline into per-page generated CSS files at the time those pages were first rendered (under 2.5.9), and those cached snapshots weren't regenerating when the plugin updated. Bumping the version forces a new `?ver=` query string on the asset URLs so browsers fetch the new JS/CSS, alongside an Elementor CSS-cache flush + SiteGround dynamic-cache purge as part of this deploy.
= 2.5.10 =
* Improve: Live Chat — pre-chat greeting (the "Hi! Thanks for reaching out — a team member will be with you in just a moment." message configured per-widget) now renders as a dispatcher-style chat bubble instead of an italic system notice at the top of the thread. Reads as an instant auto-reply so the visitor gets immediate "someone heard me" feedback before a real dispatcher picks up.
* Improve: Live Chat — visual divider between system metadata lines (like "Chat started by Visitor (5551234567)") and the actual conversation. A faded hairline now draws automatically at the boundary between the last system message and the first real message, separating session metadata from the conversation flow without adding manual UI clutter.
* Improve: Live Chat — floating button raised 50px on bottom-corner placements (br/bl) from `bottom: 20px` to `bottom: 70px` so it doesn't collide with sticky footers, floating CTAs, or mobile safe-area indicators. Top-corner placements unchanged.
= 2.5.9 =
* Fix: A1 City List widget on customer sites only listed pages by authors with "city" in their display name (e.g., "Single City", "Location City"), silently dropping pages authored by "Single Location" users. Mirrors the same broadening that landed server-side in 2.5.8 for the CRM Cities tab: `a1tools_get_wp_city_pages()` now matches `display_name LIKE '%city%' OR LIKE '%location%'` (still excluding `%seo%`). Sites that use the `Single Location` naming convention (e.g., ct.a-1chimney.com) will now surface ~all location pages alongside city pages. The page-type detection further down keys off "location" in the name, so the `location_city` vs `single_city` classification still works correctly regardless of which keyword matched.
= 2.5.8 =
* Fix: Live Chat — "Jose Demasi is helping you" banner persisted even after the dispatcher resolved/abandoned the session. The 2.5.7 fix correctly hid the banner inside `handleSessionClosed()`, but the same poll payload that signals the close ALSO carries the `attended_by_dispatcher` field (the server keeps it populated on the row for record-keeping), and the subsequent `updateAttended()` call would immediately un-hide the banner that was just hidden. Now `updateAttended()` is gated on `session_status === 'open'`; when the session is closed the banner is forcibly cleared and stays cleared.
* Fix: Live Chat — visitor-facing strings now show the dispatcher's **first name only** ("Jose is helping you" / "Jose • 12:42 PM") instead of the full "Jose Demasi". The CRM dispatcher view (Flutter app) is unchanged — it keeps the full display name. Applied to the attended-by banner AND every dispatcher message bubble's meta line.
* Fix: Live Chat — "Start chat" (pre-chat submit) and "Start a new chat" (resolved-state restart) rendered as thin yellow strips instead of proper buttons. Caused by 2.5.7's chat-window button reset (specificity 0,1,1) winning over those buttons' specific style rules (specificity 0,1,0) and zeroing their padding. Fixed by adding the `.a1tools-web-chat-window` parent prefix to both selectors so they reach specificity 0,2,0 and keep their padding + shadow + transitions. Restart button is now a primary orange button (was an outlined secondary) to match the call-to-action role.
= 2.5.7 =
* Fix: Live Chat — pre-chat form, active thread, and "chat closed" banner all rendered stacked on top of each other on themes that override `[hidden]` (most do — `div { display: block }` etc. at higher specificity than HTML5's user-agent default). Visitor saw the "Start chat" button alongside an active conversation and the "Start a new chat" button at the same time. Fixed with a scoped `.a1tools-web-chat-window [hidden] { display: none !important }` rule so theme cascade can't defeat the state machine.
* Fix: Live Chat — close / attach / send icons rendered as solid yellow blocks (again) on sites where the theme also overrides `svg { fill: }` at higher specificity than our scoped `fill: currentColor`. Same-color-on-same-color = invisible icon. Strengthened the chat-window SVG rule with `!important` on `fill: currentColor`, `visibility`, and `opacity`.
* Fix: Live Chat — stale "Jose is helping you" banner stayed visible after the dispatcher resolved/abandoned the session. `handleSessionClosed()` now clears the attended-by banner + typing-dots + `state.attendedBy` alongside flipping the resolved view on. The banner re-renders fresh if the visitor starts a new chat that gets attended.
= 2.5.6 =
* Fix: Live Chat / Web Form — widgets rendered with `data-company-id="0"` on every site that hadn't been manually configured, so the chat button did nothing and form submissions rejected. The CRM company id is now **auto-resolved from the server** when the WP-Admin option is still at the default 0. The plugin hits `tools.a-1chimney.com/api/website_variables.php?action=public&url=` (which already does the `wordpress_sites → wordpress_groups.company_id` JOIN), reads the returned `company_id`, and persists it back into the option so subsequent renders don't re-fetch. Admin overrides win — manual edits in the settings UI are never overwritten. The 41 customer sites running 2.5.5 were back-filled directly via wp-cli during this release; new installs from here on configure themselves on first widget render.
= 2.5.5 =
* Fix: Live Chat — page reload wiped the existing thread. The visitor saw an empty chat (or worse, the pre-chat form re-appeared with a "Start a new chat" button) even though the session was still open server-side. Caused by the bootstrap restoring `since_message_id` from `localStorage` and then polling `id > since_id`, which returned no rows because the watermark already covered every prior message. Resolved by forcing `since_message_id=0` + an in-memory `isInitialRestore` flag on the page-load fetch so the entire thread reloads — including the visitor's own bubbles (which were skipped during live polling as "already optimistically rendered" but ARE legitimately needed after a reload because the optimistic DOM is gone).
* Fix: Live Chat — empty white bar with a non-functional X above the composer. The attachment-preview wrapper used `display: flex` which beat HTML5's default `[hidden] { display: none }` when site themes overrode the hidden default. Added explicit `[hidden] !important` rule.
* Fix: Live Chat — visitor saw the raw dispatcher username ("Aghaji2025 is helping you" / "Aghaji2025 • 1:04 PM") instead of the dispatcher's real name. Server now resolves usernames to `first_name last_name` via a batched lookup against `a1tools_users` in poll / resume / list-sessions / session-messages responses (single SQL query per request, no N+1). Visitor JS prefers the new `sender_display_name` / `attended_by_dispatcher_display_name` fields and falls back to username transparently.
= 2.5.4 =
* Re-tag of 2.5.3 to force the WordPress.org plugin directory to re-index after the 2.5.3 hotfix landed. No functional changes between 2.5.3 and 2.5.4 — the chat-window icon visibility fix and cross-origin CORS fix from 2.5.3 are the substantive changes shipping here. Bumping the version forces customer-site auto-updaters to re-pull cleanly.
= 2.5.3 =
* Fix: Live Chat — missing icons in the chat window (close / attach / send buttons rendered as solid color blocks with the SVG icons invisible). Caused by site themes overriding the chat window's button styles (e.g. theme rule `button { background: gold; color: gold; }` made every SVG with `fill: currentColor` disappear into the same-coloured background). Resolved by introducing a chat-window-scoped CSS reset and bumping selector specificity on the close / attach / send buttons so theme styles can't leak in.
* Fix: Live Chat / Web Form — cross-origin requests blocked by the server's CORS allowlist on every customer site except `a-1chimney.com` (and its `www.` subdomain). The widget POSTs to `tools.a-1chimney.com/api/web_chat.php` / `web_forms.php` from `dc.a-1chimney.com`, `ct.a-1chimney.com`, and ~40 other A1 Chimney subdomain sites, plus the 14 portfolio sites; none were on the static allowlist, so the browser refused to read responses → "Network error — please try again" on Start Chat / form submit. Resolved by introducing `handlePublicWidgetCors()` in `api/config.php` (echoes any origin with `Access-Control-Allow-Credentials: false`) and opting the two widget endpoints into permissive CORS via a new `$publicCors` parameter on `initApi()`. Safety preserved by the HMAC form-secret (Web Form) and visitor_token + Bearer-token authentication (Web Chat) — neither relies on cookies, so allowing any origin doesn't open a CSRF surface.
= 2.5.2 =
* New: Web Form widget — full visual styling controls. Container background + border (style/width/color) + border radius + box-shadow + padding. Label typography (family/size/weight/color). Input typography + separate placeholder vs user-typed colors + input background + input border + focus border. Required-asterisk color (default red `#dc2626`) + weight. Submit button alignment (left / center / right / full-width).
* New: Web Form widget — Standard Fields repeater. Toggle, relabel, reorder the ten CRM lead-intake fields (First Name, Last Name, Phone, Email, Address, City, State, Zip, Commentary, Preferred Contact). Hidden fields are no longer sent to the server; the server in turn accepts missing fields and defaults them to empty string (soft-requires at least one of phone / email / commentary so a contentless submission still rejects).
* New: Web Form widget — Custom Fields repeater. Add arbitrary user-defined fields beyond the ten standard ones. Types: text, textarea, email, tel, url, number, date, dropdown (select), checkbox, radio. Per-field label / placeholder / help text / required-flag / options. Stored as a self-describing JSON array on the submission row (new `custom_fields` column on `crm_web_form_submissions`) so each submission carries its own field schema and the CRM detail card renders the exact labels the visitor saw at submit time.
* New: Web Form widget — SMS Consent section. Toggle-gated; WYSIWYG consent text with `{{privacy_url}}`, `{{sms_terms_url}}`, `{{help_phone}}` placeholders auto-resolved to site-relative defaults when the URL fields are left blank. Optional Help phone field. "Require check to submit" toggle. The verbatim consent text the visitor saw plus the checked/unchecked flag are stored as first-class columns (`consent_text`, `consent_checked`) for downstream Twilio / SMS pipeline TCPA-compliance audits.
* New: Web Form widget — Optional "I'm not a robot" checkbox gate. Simple in-form click-through (no external CAPTCHA service); blocks naive automation alongside the existing honeypot + minimum-fill-time guards.
* New: Web Chat widget — Pre-chat Form section. Configurable label + required-flag for the Name and Phone-or-Email fields, plus the Start-chat button label.
* New: Web Chat widget — Window container styling. Background color, border color/width, border radius, box-shadow, plus body typography (matches the Web Form widget's level of control).
= 2.5.1 =
* Fixed: A1 Web Form and A1 Web Chat widgets read the wrong WordPress option for the CRM company ID (`a1tools_form_company_id` instead of `a1tools_form_crm_company_id` — the latter being the option the existing admin UI + form pipeline have always used). On any site that had configured the legacy contact-form CRM integration, both new widgets rendered with `data-company-id="0"`. The chat widget's JS module bailed at the `if (!config.companyId)` check, leaving the floating Live Chat button visible but completely unresponsive — clicks did nothing, no errors in the WP admin, just silence. Both widgets now read the same option the rest of the plugin uses.
* Improved: "CRM Integration" section heading and description in the admin Settings page now explicitly mention BOTH the contact form AND the Live Chat widget. Same Company ID drives both; setting it to 0 disables both. Visual styling for the chat widget (button color, padding, placement, dispatcher/visitor bubble colors) lives in Elementor's edit panel, not in WP admin — the admin page only carries the global Company ID + form secret.
= 2.5.0 =
* New: A1 Web Form Elementor widget — structured lead intake form (First name, Last name, Phone, Email, Address, City, State (searchable US-state dropdown with "Outside the US" fallback), Zip, Tell-us-about-your-project commentary, Preferred contact method radio). All fields required. Honeypot + minimum-fill-time anti-spam. Submissions land in `crm_web_form_submissions` and surface in the CRM's reworked Web Leads tab.
* New: A1 Web Chat Elementor widget — live chat with both floating-corner and inline placements. Multiple placements on the same page share one conversation via a `visitor_token` stored in `localStorage`. Pre-chat captures Name + Phone-or-Email before the conversation opens so the CRM has a usable identity even if the visitor closes the tab mid-conversation. Image attachments (JPEG/PNG/GIF/WEBP, 5 MB cap), typing indicator, read receipts, and an "Attended by X" indicator showing which dispatcher is currently working the thread. Chats only close when a CRM dispatcher resolves or abandons them — page reload, browser close, or device switch all restore the open session.
* New: Public REST proxy `/wp-json/a1-tools/v1/submit-web-form` that signs the form payload server-side (HMAC-SHA256) and forwards to `tools.a-1chimney.com/api/web_forms.php`. Visitor never sees the shared secret.
* Performance: Web Form + Web Chat assets are versioned with `A1TOOLS_VERSION` so a plugin upgrade busts the browser cache cleanly. Scripts only mount when a corresponding placement exists in the DOM.
= 2.4.3 =
* Fixed: A1 Franchise Location widget rendered the wrong map for franchises that had no street address — Google's iframe embed was being asked to resolve the franchise *name* alone (e.g. `q=A1+Chimney+-+Trenton`), and Google's first match was often an unrelated business with the same name in another state (Hallandale FL was a frequent culprit). Even franchises that had correct latitude/longitude in the database were affected, because the embed builder never actually used the stored coordinates. The widget now prefers `name + full address` when an address exists (rich Google business card), falls back to the stored `latitude,longitude` when only coordinates are available (deterministic pin), and renders no map at all when neither is available — better than misleading visitors with the wrong location.
* Fixed: Franchise grid alignment — when one card's title wrapped to two lines (e.g. "A1 Chimney - Mount Laurel Township") and the others were single-line, the map iframes shifted to different y-coordinates across the row. Cards are now flex columns with a 2-line `min-height` reserved for the title and the "Get Directions" button pinned to the bottom (`margin-top: auto`), so maps line up horizontally regardless of title length.
= 2.4.2 =
* Fixed: City List widget (and every other A1 Tools data widget) could be stuck rendering an outdated payload — most visibly, all city pages collapsing into a single "Ungrouped" section when their group assignments had changed in the A1 Tools dashboard. Root cause: `a1tools_cache_expiry` is stored in seconds by the settings page, but `a1tools_fetch_api_data()` was multiplying it by `MINUTE_IN_SECONDS` again, making every cached payload live 60× longer than the admin had configured. Worse, picking "No caching (always fresh)" stored `0`, which WordPress's `set_transient()` interprets as "no expiration" — so the transient persisted forever, forever serving stale data.
* Fixed: "No caching (always fresh)" now actually means no caching — the plugin no longer writes a transient when caching is disabled, and proactively deletes any pre-existing transient on the first request after the upgrade so legacy forever-caches are evicted.
* Migration: On upgrade, all `a1tools_*` transients are flushed automatically via `a1tools_clear_cache()` so any payload poisoned by the pre-2.4.2 TTL bug is replaced with a fresh fetch on the next page load. No admin action is required.
* Security: Blog-sync REST routes (`/blog-posts`, `/blog-sync/create`, `/blog-sync/update`) now authenticate against a dedicated `a1tools_blog_sync_secret` option, falling back to the legacy `a1tools_form_secret` only for backwards compatibility (with an error_log notice when the legacy secret is used). Operators should provision a fresh per-purpose secret in wp-admin → Settings → A1 Tools and then rotate the form secret; one leaked secret no longer grants read+write access to every post on every connected site.
= 2.4.1 =
* Fixed: X (Twitter) icon rendering as a blank tile in the Social Icons widget and the Elementor social-icons widget. The icon ships as inline SVG (since X's logo isn't in Font Awesome 5), but the render path was passing the markup through wp_kses_post() which strips