=== Hypamoon Connect ===
Contributors: hypamoon
Tags: chat, contact form, ai assistant, migration, woocommerce
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.4.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Put the AI chat and contact forms of your Hypamoon project on your site, and move the data behind your WordPress login to Hypamoon. No code to paste.

== Description ==

Hypamoon Connect links your WordPress site to your Hypamoon project. It does two things.

**Hypamoon on your site.** Visitors get answers at night and in the weekend, and every message of your contact form lands in one place, with an email to you.

* The chat window of your Hypamoon project on every page. The assistant of your project answers, with your own business name.
* Contact forms that send their entries to your Hypamoon project, with an email for each entry, a bot check and a hidden spam trap. Add one to a page with the "Hypamoon form" block or a shortcode like `[hypamoon_form id="contact"]`.
* No code to paste. Ask your AI assistant connected to Hypamoon, for example "put the chat and a contact form on my WordPress site", then open Tools > Hypamoon, Site tools. Or turn the chat on there yourself.
* The chat and forms keep working when the connection of the plugin expires. Turn them off under Tools > Hypamoon.

**Moving your data.** Moving a site often stops at the login screen. Public pages are easy to copy, but drafts, private posts, form entries, orders and customers sit behind your WordPress login. Hypamoon Connect moves that data to your own Hypamoon project, without screenshots and without sharing a password in a chat.

You need a Hypamoon account to use this plugin. You can start with a free test project at https://app.hypamoon.com.

Two ways to work. Simple (the default for a new installation): the plugin only connects and shows what was sent; your chat with your AI assistant suggests what to move, asks you to confirm, and starts it. Full: every choice on this screen, with the suggestion of your chat shown on top so you can apply it. You can switch at any time; your selection stays.

How moving works:

1. Create a one-time code in your Hypamoon project under Sites, or ask your AI assistant connected to Hypamoon for one.
2. Enter the code under Tools > Hypamoon, Connection, and press Connect.
3. The plugin sends an overview of your site: counts, dates and field names only, never content.
4. Choose what moves: tell your chat what you want (for example "move my hours portal") and it suggests a selection with a reason per kind of data; or choose in your Hypamoon project, or in WordPress under Move data. For every kind of data you see the number of items, example fields with their type, an estimated size, whether it holds personal data and why, the collection it goes to and the links that become references. Personal data stays off until you turn it on, also with Select all.
5. Press Send. The data goes in small batches with a progress bar, so it works on shared hosting. If the connection drops, press Resume: nothing is sent twice.

What can move:

* Posts, pages and public custom post types, including drafts, pending, private and scheduled items
* Post types that are not public, like hours, applications or bookings of a member portal (off until you choose them, kept private)
* Custom fields from Advanced Custom Fields, ACF Pro or Secure Custom Fields, in full: repeaters, flexible content, groups, images, relationships, plus field group definitions and options pages
* Categories, tags and other terms
* Media, as URLs only (files are not copied)
* Menus
* Form entries from Contact Form 7 (through Flamingo), WPForms and Gravity Forms
* WooCommerce products and variations, orders with refunds and notes, customers, coupons, shipping zones, tax rates, product reviews and an overview of WooCommerce Subscriptions
* Users: name, email and role, never passwords. With "All fields" also the other user fields, like a client id
* Links between your data: a field that points to a user or a post (for example a client id on a timesheet) becomes a reference to that record in your project
* Tables that a plugin or theme made in your database, with their columns (off until you choose them, kept private; WordPress core tables are never offered)
* Settings from the options table that you tick one by one. Settings that look like a password, key or token are never listed and never sent

You can send again later. Records that were sent before are updated, never duplicated.

A WP-CLI command is included for large sites: `wp hypamoon connect <code>`, `wp hypamoon status`, `wp hypamoon inventory`, `wp hypamoon selection`, `wp hypamoon export` (with `--dry-run`, `--include`, `--users` and `--restart`) and `wp hypamoon disconnect`.

For developers: the filter `hypamoon_connect_record` lets you change or leave out a record before it is sent, `hypamoon_connect_post_types` changes the list of post types that are offered, `hypamoon_connect_private_post_types` and `hypamoon_connect_tables` narrow the post types that are not public and the database tables that are offered, and `hypamoon_connect_show_chat` decides per page view whether the chat window is shown (for example to wait for consent).

== Installation ==

1. Install the plugin through Plugins > Add New, or upload the `hypamoon-connect` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Go to Tools > Hypamoon and enter the one-time code from your Hypamoon project on the Connection tab.
4. For the chat and forms: ask your AI assistant to put them on your site, or press Turn chat on under Site tools. Add a form to a page with the "Hypamoon form" block.

== Frequently Asked Questions ==

= Is anything sent automatically? =

Only after you connect the site. Your WordPress server then contacts Hypamoon when an administrator acts: Connect, Refresh inventory, Load latest selection, Save selection, Send, Disconnect, the chat and form buttons, or opening Tools > Hypamoon (which loads the latest chat and form settings, at most once every five minutes), or a WP-CLI command.

There is one scheduled task: while the site is connected, a light WP-Cron check every five minutes asks Hypamoon whether you asked your chat to send your selection. Only then is the selection sent, the one you confirmed in your chat or on this screen, and personal data only when you said yes to it. The check stops when you disconnect or deactivate the plugin. There is no tracking and no usage data is collected.

When the chat window or a form is on your site, the browser of a visitor loads a script from Hypamoon and talks to Hypamoon directly. See External services.

= Where do the answers of the chat come from? =

From the assistant of your Hypamoon project: the same one that can answer your phone. You set what it knows and how it talks in your Hypamoon project or in your chat with your AI assistant. Without an assistant the chat has nothing to say, so set that up first.

= Where do form entries go? =

Into a collection of your Hypamoon project, and you get an email for each entry. A field named email becomes the reply address of that email. The form has a bot check (Cloudflare Turnstile, shown in a small frame from Hypamoon) and a hidden spam trap.

= Does the chat need a cookie banner? =

The chat window sets no cookies. It keeps the open conversation in the session storage of the browser until the tab is closed, and loads its settings from Hypamoon when the page loads, which sends the address of the visitor to Hypamoon like any other request. If your site waits for consent before loading services from others, use the filter `hypamoon_connect_show_chat` to show the chat only after consent. Mention Hypamoon in your privacy policy as a processor of chat messages and form entries.

= Are passwords sent? =

Never. User passwords, password hashes, sessions, activation keys, application passwords, post passwords, payment details, IP addresses and user agents are never sent. Meta keys, table columns and settings that look like a secret (password, token, key, nonce, hash, salt, auth) are left out. Meta keys that start with an underscore are only sent when you choose "All fields", and never when they look like a secret.

= Do the users get a password on Hypamoon? =

No passwords move. When your Hypamoon project turns the users into users of an app, they sign in with a link or a code by email.

= My Contact Form 7 entries are missing =

Contact Form 7 does not store entries itself. Install Flamingo to keep entries from then on; the plugin reads them from there.

= What happens with WooCommerce Subscriptions? =

The overview moves: who is still subscribed, plan, amount, interval and next payment date. The recurring payments themselves do not move: they run at the payment provider and must be set up again. Hypamoon can help with paid access with an interval.

= My hosting has short time limits. Will it work? =

Yes. Every batch is a separate request of at most 200 records, so each request stays short. If a request fails, press Resume.

= How do I disconnect? =

Press Disconnect under Tools > Hypamoon, or run `wp hypamoon disconnect`. The access is revoked and the local settings for moving data are deleted. Data that was already sent stays in your Hypamoon project. The chat window and forms stay on your site until you turn the chat off or remove the form blocks; uninstalling the plugin removes them too.

== Privacy ==

Moving data. What is sent: only the data you select, plus an overview of your site (counts, oldest and newest dates, statuses, form field names and custom field definitions, never content). Personal data (form entries, orders, customers, subscriptions, reviews, users, post types that are not public and database tables of plugins) is off by default. Settings from the options table move only by name, when you tick them.

To whom: Hypamoon, the Netherlands, into your own Hypamoon project.

When: when an administrator presses Connect, Refresh inventory, Load latest selection, Save selection, Send, Apply suggestion and Save, Dismiss or Disconnect, or runs a WP-CLI command of this plugin. While the site is connected, a light check every five minutes (WP-Cron) asks Hypamoon whether you asked your chat to send your selection; only then is the selection sent, the one you confirmed in your chat or here. Personal data only goes when you said yes to it.

Where it goes: into collections in your own project, such as wp_posts, wp_pages, wp_media, wp_menus, wp_terms, wp_acf, wp_form_<name>, wp_products, wp_orders, wp_customers, wp_shop_settings, wp_reviews, wp_subscriptions, wp_users, wp_table_<name> and wp_options. Collections with personal data are always private. Everything is private by default; the project owner decides what is published.

Never sent: passwords, password hashes, sessions, keys and tokens, application passwords, post passwords, payment details, IP addresses and user agents.

Chat window and forms. When they are on your site, the browser of a visitor sends chat messages and form entries straight to your Hypamoon project, together with the address of the page and, as with any request, the IP address and browser of the visitor. Hypamoon uses them to answer, to store the entry, to email it to you, and to stop abuse with limits and a bot check (Cloudflare Turnstile). They go to Hypamoon, the Netherlands, as a processor for you. Your WordPress server sends nothing about visitors.

The plugin stores its connection details in the WordPress options table, without autoload, and the chat and form settings in one small option, also without autoload. Uninstalling the plugin deletes them.

Privacy policy: https://hypamoon.com/privacy
Terms: https://hypamoon.com/terms

== External services ==

This plugin connects to the Hypamoon API (https://api.hypamoon.com), a service of Hypamoon, to move your data into your Hypamoon project.

* When you press Connect, the one-time code, the site address, the site name, the WordPress version and the plugin version are sent, and an access token is received.
* Right after connecting and when you press Refresh inventory, an overview of your site is sent: counts, dates, statuses, form field names, custom field definitions, the names of user fields and of meta fields of custom post types, the names and columns of database tables of plugins, and the names of settings (never their values), no content.
* When you load or save the selection, the selection (which kinds of data, periods, statuses, fields to leave out, whether all fields go, and which settings) is read or written.
* When you press Send or run `wp hypamoon export`, the data you selected is sent in batches.
* When you press Disconnect, the access token is revoked.
* When you open Move data, or the simple screen, the suggestion of your chat is read (which kinds of data, with a reason each) and whether your chat asked to send. When you apply and save it, or dismiss it, Hypamoon is told.
* While the site is connected, WP-Cron checks every five minutes whether your chat asked to send your selection. If so, the selected data is sent in batches, for at most about 20 seconds per check. The check is removed when you disconnect or deactivate the plugin.
* When you open Tools > Hypamoon (at most once every five minutes), press Refresh, Turn chat on, Turn chat off or Set up forms, the chat and form settings for your site are read or changed: whether the chat is on, its colour, position, title and welcome text, the forms with their fields, and the public token of your project.

Every request from your WordPress server carries the access token and the address of your site. Apart from the five minute check above, no request is made from your server without an action of an administrator, and none while other admin pages load.

The chat window and forms load scripts from the Hypamoon API in the browser of your visitors:

* The chat window loads https://api.hypamoon.com/widget.js on every page while the chat is on. It reads the chat settings from Hypamoon, and sends the messages a visitor types to your Hypamoon project, where the assistant of your project answers.
* A form loads https://api.hypamoon.com/form.js on the pages with a Hypamoon form. When a visitor sends the form, the fields are sent to your Hypamoon project.
* Both show a bot check from Hypamoon in a small frame, which uses Cloudflare Turnstile. Cloudflare terms: https://www.cloudflare.com/website-terms/ and privacy policy: https://www.cloudflare.com/privacypolicy/

These requests carry the public token of your project. It is public by design: it can only chat and add form entries, only from your site, with limits.

Terms of service: https://hypamoon.com/terms
Privacy policy: https://hypamoon.com/privacy

== Screenshots ==

1. Connection: link your site with a one-time code from your Hypamoon project or your chat.
2. Move data: every kind of data grouped, with counts, size, last change and the collection it goes to. Select all per group or for the whole list; personal data only with an extra tick.
3. The details of one kind of data: fields with their type, why it holds personal data, and the links that become references.
4. Sending in small batches with a progress bar. If the connection drops, press Resume.
5. Site tools: the chat window and the forms of your project on your site, with their shortcodes.
6. The Hypamoon form block in the editor.
7. Your chat suggested a selection: every kind of data with the reason, what changes, and Apply suggestion or Dismiss.
8. The simple mode: connect, see what was sent, and let your chat do the rest.

== Changelog ==

= 1.4.1 =
* Readme: the scheduled check of 1.4.0 is now described in the FAQ as well, and the license is written as GPLv2 or later. No change in what the plugin does.

= 1.4.0 =
* New: your chat can suggest a selection. Move data shows "Your chat suggested a selection" with every kind of data, the reason, and what differs from your current selection. Apply suggestion ticks the boxes; personal data only with "Include personal data". Then Save or Send as before. Dismiss removes it.
* New: two modes. Simple, the default for a new installation, only connects and shows what was sent; your chat suggests, asks you to confirm and starts sending. Full is the screen you know, with every choice. Existing installations stay on Full after the update. Switching keeps your selection.
* New: when your chat asks to send, the plugin starts the next time you open Tools > Hypamoon, or within about five minutes through a light WP-Cron check.
* Tables and post types of other plugins that are rarely worth moving (cookie banners, importers, mail logs, search indexes, caches, logs) are marked "Usually not needed" and left out of Select all. You can still tick them one by one.
* The message after sending is short: how much was sent, how many groups were skipped (details can be opened), and what to tell your chat next.

= 1.3.1 =
* Fix: Select all no longer ticks Settings. Settings move only by name: tick the ones you want in the list under Show details. Names that look like a password, key, token, salt or auth setting are never offered.
* Fix: a group that cannot move no longer stops the whole round. It is skipped with the reason, the rest is sent, and the end shows a summary like "Sent 483 of 483 items. Skipped: Settings (pick the settings you want by name first)."
* Fix: the progress bar of an earlier round is no longer shown as if it were the current one. Send always saves your selection first and starts with a fresh bar.
* The selected count counts settings per ticked name.

= 1.3.0 =
* Tools > Hypamoon now has a tab per task: Connection, Move data, Site tools and Privacy, each with a short explanation at the top.
* Move data groups your data (content, private post types, form entries, shop, users, database tables, settings) and shows per kind: the number of items, example fields with their type (text, number, date, relation, list), an estimated size, the last change, the collection it goes to in your project, and whether it holds personal data and why.
* Show details lists all fields, the links that become references (like opdrachtgever_id to wp_users) and the filters.
* Select all and Select none for the whole list, and a select all box per group. Personal data is left out of Select all unless you tick "Include personal data". The selected count updates while you choose.
* Nothing changes in what is sent or how: your connection and your selection stay as they are.

= 1.2.0 =
* New: post types that are not public, like hours or applications of a member portal. Off until you choose them, and private.
* New: "All fields" for content and users sends every other field too, and fields that point to a user or a post (like a client id) become links to those records.
* New: database tables of plugins and themes, with their columns, in batches. Only when you choose a table; WordPress core tables are never offered.
* New: settings from the options table, ticked one by one. Settings that look like a password, key or token are never listed or sent.
* Users are sent before other data, so links to users resolve in the same round.
* New filters: `hypamoon_connect_private_post_types` and `hypamoon_connect_tables`.

= 1.1.0 =
* New: the chat window of your Hypamoon project on every page of your site, turned on from your chat with your AI assistant, your Hypamoon project or Tools > Hypamoon.
* New: contact forms that send their entries to your Hypamoon project, with an email per entry, a bot check and a spam trap. Use the "Hypamoon form" block or the shortcode `[hypamoon_form id="..."]`.
* New: the filter `hypamoon_connect_show_chat`.
* The chat and forms keep working when the access of the plugin expires.
* The plugin never contacts Hypamoon while other admin pages load. On Tools > Hypamoon it loads the latest chat and form settings at most once every five minutes, with a short timeout.

= 1.0.2 =
* Fix: the inventory was refused when a post type had no posts, so the selection could not be saved.
* Saving the selection now shows the real reason when it fails, and only says it was changed elsewhere when that is true.

= 1.0.1 =
* Tested up to WordPress 7.1.
* Nonce checks directly in the handlers that read form data.
* Safer database queries for WPForms entries and post statuses.
* Uninstall also cleans up every site of a multisite network and the short-lived notices.

= 1.0.0 =
* First release: connect with a one-time code, inventory, selection from chat, project or WordPress, batched export with resume, WP-CLI command.

== Upgrade Notice ==

= 1.4.1 =
No change in what the plugin does; clearer readme.

= 1.4.0 =
Your chat can now suggest what to move, and you apply it with one click. Your screen stays as it is (Full); switch to Simple if you would rather let your chat do the choosing.

= 1.3.1 =
Fixes Send after Select all: settings are left out unless you pick them by name, and a group that cannot move is skipped instead of stopping the round.

= 1.3.0 =
A clearer screen: a tab per task, more detail per kind of data, and select all. Your connection and selection stay as they are; you do not need to connect again.

= 1.2.0 =
Moves the data of member portals too: post types that are not public, user fields, links between records, database tables of plugins and chosen settings. Nothing new is sent until you choose it.

= 1.1.0 =
Adds the chat window and contact forms of your Hypamoon project to your site. Nothing changes on your site until you turn them on.

= 1.0.2 =
Fixes saving the selection on sites with an empty post type.

= 1.0.1 =
Tested up to WordPress 7.1, with stricter checks on form data and a more complete uninstall.

= 1.0.0 =
First release.
