=== LensShift Form Monitor ===
Contributors: lensshift
Requires at least: 6.0
Requires PHP: 7.4
Stable tag: 0.2.0
License: GPLv2 or later

Authenticated browser-to-email monitoring for Contact Form 7, WPForms, and Gravity Forms.

== Setup ==
1. Add this WordPress website to your LensShift workspace.
2. Copy the website ID, shared secret (at least 32 characters), and monitoring mailbox into Settings > LensShift.
3. Select each form you want LensShift to test. No selected forms means monitoring is disabled.
4. Verify the connection in LensShift, map the test values, and run a manual check before enabling scheduled monitoring.

== What is verified ==
The ordinary form notification retains its primary recipient. A valid signed monitoring test adds a Bcc to the configured LensShift mailbox and a correlation reference in the notification. LensShift only marks delivery received after its inbound email provider receives that notification. This plugin never sends a callback claiming email delivery.

Receipt at the monitoring mailbox does not prove delivery to the primary recipient's inbox, nor that a person read the message. Authenticated tests suppress Contact Form 7 Mail (2) and Gravity Forms field-recipient autoresponders. Other plugin integrations may still create entries, send notifications, or trigger CRM/webhook actions: configure those integrations appropriately before enabling tests.

== Supported flows ==
Single-page forms using text, email, telephone, URL, number, date, textarea, select, checkbox, radio, and supported composite name/address controls. Discovery identifies unsupported field types. CAPTCHA, file uploads, payment fields, conditional and multi-page flows require a separately tested integration; visitor security controls must not be disabled for monitoring.

== Security ==
Test tokens bind site, provider-qualified form, check, correlation, expiry, and nonce. A database-unique nonce prevents concurrent replay. Discovery requests require a time-bound shared-secret signature. Secrets never appear in discovery responses. Rotate a secret by updating it in WordPress and reconnecting in LensShift.

== Changelog ==
= 0.2.0 =
* Provider-qualified form discovery and exact browser form targeting.
* Field type, required state, choices, and unsupported-flow metadata.
* Removed simulated receipt callbacks; delivery requires actual inbound email.
* Atomic one-time authorization consumption and explicit enabled-form selection.
* Site binding in signed status responses and synchronized release packaging.
