=== Bodholdt Atelier ===
Contributors: bodholdtlabs
Tags: ecommerce, art, music, prints, digital-downloads
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.10.7
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Sell art, music, prints, downloads and commissions from a storefront you own, with your own Stripe or PayPal keys. No platform cut, ever.

== Description ==

Bodholdt Atelier is a self-hosted storefront for one-person studios. List your work, take payment with your own Stripe or PayPal keys, and deliver it, physical or digital, without handing a cut to a marketplace. It runs entirely on your WordPress site.

There's a built-in **simulated checkout** (no keys needed) so you can click through the whole flow before you connect a real gateway.

**What's included**

* **11 Work types**: unique pieces, limited editions, made-to-order, open digital, music, photography, video/courses, tip / pay-what-you-want, and more. Each type carries its own pricing, inventory, and storefront call-to-action. Commissions and patronage subscriptions are two further work types.
* **Storefront + single-Work pages**: a catalog grid, edition meters, music tracklist previews, pay-what-you-want, and license pickers, all in a cyberpunk-dark, gamified design.
* **Checkout three ways**: simulated (offline, no keys), live **Stripe Checkout**, or live **PayPal**: drop in your own keys and pick a mode. Card and PayPal credentials never touch your site; the processor hosts the payment page.
* **Certificates of Authenticity + license PDFs**: auto-generated for every sale, with a public "scan to verify" page.
* **Tamper-evident provenance**: every certificate is SHA-256 fingerprinted and chained to the one before it; optionally anchored to Bitcoin for free via OpenTimestamps.
* **Per-buyer watermarking + signed, expiring downloads** for digital goods.
* **Commission workflow**: deposits and per-milestone payments, with a private buyer portal (no login required).
* **Patronage subscriptions** with content drip.
* **EU VAT / IOSS**: consumer-rate VAT, reverse-charge for valid business VAT numbers (VIES), and VAT invoices.
* **Music pipeline**: preview generation and per-format inventory.
* **Webcomic / serial scheduling**, **print-on-demand routing**, an **AR "view on your wall"** room viewer, **bundles & royalty splits**, **affiliate / referral codes**, **wholesale / trade pricing**, a **consignment ledger**, a **Maker's Proof** human-made / AI-disclosure panel, an installable buyer **"My Collection" PWA**, a **full CRM**, and a **WCAG 2.1 AA** accessibility pass.
* **Foundry (multi-artist) mode**: optionally host several artists on one install, each with their own works, profile, and a searchable on-site marketplace across them.

This is the free edition, and everything above that is not marked otherwise is in it and fully functional. A separately distributed paid edition exists (from Bodholdt Labs, not hosted here) and it does not add features. What a license adds is email support from the developer while it is active, and a site allowance of up to 127 activations.

== External services ==

This plugin can connect to the third-party services below. **All of them are optional and off until you configure them**: payments and print-on-demand do nothing until you enter keys/credentials; the newsletter integration only sends data if you connect a provider; VAT validation only runs if you enable EU VAT and a buyer supplies a VAT number; Bitcoin anchoring only runs if you turn it on. (Web fonts are bundled with the plugin and served locally, so no font request is made to any third party.)

**Stripe**: payment processing, used only if you choose Stripe as your checkout gateway. When a buyer checks out, order and line-item details (amounts, currency, your store's success/cancel URLs, and the buyer's email for the receipt) are sent to Stripe to create a hosted Checkout session; Stripe also calls back to a webhook to confirm payment. Card data never touches your site.
Terms: https://stripe.com/legal/ssa | Privacy: https://stripe.com/privacy

**PayPal**: payment processing, used only if you choose PayPal as your checkout gateway. When a buyer checks out, order amounts, currency, and return URLs are sent to PayPal to create and capture an order; PayPal calls back to a webhook to confirm payment.
Terms: https://www.paypal.com/us/legalhub/useragreement-full | Privacy: https://www.paypal.com/us/legalhub/privacy-full

**OpenTimestamps**: free public timestamping (Bitcoin-anchored), used only if you enable provenance anchoring. At sale time the plugin submits the certificate's SHA-256 digest, which is a hash only and contains no personal data, to public OpenTimestamps calendar servers to obtain a timestamp proof.
Service & docs: https://opentimestamps.org/ (open-source public infrastructure; the SHA-256 digest is the only data transmitted)

**Kit (formerly ConvertKit)**: email newsletter, used only if you configure a Kit/ConvertKit form. When a visitor subscribes (or opts in at checkout), their email address and name are sent to Kit to add them to your form.
Terms: https://kit.com/terms | Privacy: https://kit.com/privacy

**theprintspace**: print-on-demand fulfilment, used only if you enable PoD routing for theprintspace. When a qualifying physical order is paid, the order's product, quantity, and shipping address are sent to theprintspace to place the print order.
Terms: https://www.theprintspace.com/hubusertermsandconditions/ | Privacy: https://www.theprintspace.com/online-photo-and-giclee-printing-privacy-policy/

**FinerWorks**: print-on-demand fulfilment, used only if you enable PoD routing for FinerWorks. When a qualifying physical order is paid, the order's product, quantity, and shipping address are sent to FinerWorks to place the print order.
Terms: https://www.finerworks.com/terms.aspx | Privacy: https://www.finerworks.com/privacy.aspx

**EU VIES (European Commission VAT validation)**: VAT-number checking, used only if you enable EU VAT and a buyer enters a business VAT number at checkout. The VAT number (and the buyer's country code) is sent to the European Commission's VIES service to confirm it is valid for reverse-charge.
Service: https://ec.europa.eu/taxation_customs/vies/ | Legal notice & privacy: https://commission.europa.eu/legal-notice_en

== Installation ==

1. Upload the plugin to `/wp-content/plugins/bodholdt-atelier`, or install it from Plugins → Add New.
2. Activate it through the Plugins screen.
3. Open **Atelier** in the admin menu and follow the setup quest.
4. Add your first Work, then add the `[bodholdt_atelier]` shortcode to a page to publish your storefront.
5. (Optional) Under **Atelier → Settings → Payments & Tax**, connect your own Stripe or PayPal keys. Leave them blank to use the built-in simulated checkout.

Going live with real money? The plugin folder carries `docs/TESTING.md` (sandbox
wiring for Stripe and PayPal), `docs/PAYMENTS.md` (what you are responsible for as
the seller), and `docs/PRIVACY.md` (a data inventory plus privacy and terms
starters you can adapt).

== Frequently Asked Questions ==

= Do I need a Stripe or PayPal account to try it? =
No. There's a simulated checkout that records orders, issues certificates, and runs the whole flow with no keys. Connect a real gateway when you're ready to take money.

= Does the plugin take a cut of my sales? =
No. Payments go straight to your own Stripe or PayPal account. The plugin never sits between you and your money.

= Where do card payments happen? =
On the processor's hosted page (Stripe Checkout or PayPal). Card and PayPal credentials never touch your site, which keeps you in the lightest PCI scope (SAQ-A).

= Can I sell both physical and digital work? =
Yes. Physical pieces (with shipping and optional print-on-demand), digital downloads (watermarked, with signed expiring links), music, photography, and tips, all from one storefront. Commissions and patron subscriptions are included too.

= Is there a paid version? =
Yes, distributed separately from Bodholdt Labs (not hosted on WordPress.org). It does not add features. Commissions with deposits and milestones, patron subscriptions with content drip, the multi-artist Foundry and its cross-artist marketplace, and the Adobe Lightroom publishing pipeline are all in this edition and fully functional, and updates arrive in your dashboard on both editions. What a license adds is email support from the developer while it is active, and a site allowance of up to 127 activations.

== Screenshots ==

1. The gamified studio dashboard.
2. A single-Work storefront page.
3. Checkout with a generated Certificate of Authenticity.
4. The public scan-to-verify provenance page.

== Security ==

Found a security problem in this plugin? Please tell us before you publish it, and we
will tell you what we found and when a fix will ship.

Email support@bodholdtlabs.com with "Security" in the subject line. We acknowledge
within five business days. Full policy, including what is in scope and what we ask of
you, is at https://bodholdtlabs.com/security/

We do not run a bug bounty and cannot pay for reports. We would rather say so up front
than have you find out afterwards.

== Changelog ==

= 1.10.7 (2026-09-05) =
* Two notices counted down to something that never happens. If a license could not be confirmed, the plugin said the features it unlocks would keep working for so many more days, which reads as a warning that they will then stop. They will not. Every feature in this plugin works on every install whether or not a license is active, and it always has. What a license actually carries is email support and a site allowance, so that is what the notices now count down to.

= 1.10.6 (2026-09-05) =
* The readme in this download described a paid edition that does not exist. It said a license adds commissions, patron subscriptions, the Foundry, the marketplace, the Lightroom pipeline, priority support and managed updates. Six of those seven are in the edition you already have, and the seventh, priority support, was retired everywhere on the same day this was written, because nothing ever delivered it. Nothing about the plugin changes here. It only stops describing itself wrongly. What a license actually adds is email support from the developer while it is active, and a site allowance of up to 127 activations.

= 1.10.5 (2026-09-05) =
* Wording only. Seven notices and hints used a dash where a full stop or a comma belongs. House style here is plain sentences, and a dash standing in for punctuation is the one thing our own writing rules single out. Nothing about behaviour changes. Dashes that stand in for "no value yet" in a table cell or an empty dropdown are left exactly as they are, because there they are not punctuation.

= 1.10.4 (2026-09-04) =
* Wording only, and some of it you will see. The setup checklist no longer claims this build can only run a simulated checkout: live Stripe and PayPal are in every copy, including this one. The notice shown when no license is activated no longer says that activating "unlocks updates", because your copy already updates itself from your dashboard. Two headings lost a stray dash.

= 1.10.3 (2026-09-04) =
* Nothing changes in this edition. The fix in 1.10.3 is on the License screen, which only the licensed edition has: it was describing updates and support wrongly. This release keeps both editions on the same version number so the two are easy to tell apart at a glance. Your copy already updates itself from your dashboard, and it always has.

= 1.10.2 =
* **One number, everywhere.** The License screen's summary said a license adds "an unlimited site allowance", while the table directly beneath it, the storefront and the update notice all said up to 127 activations. 127 is the real figure and always has been: a license record stores the site allowance as a signed tinyint, so 127 is this plugin's unlimited rather than a placeholder. The summary now says it too, and the 1.10.1 and 1.10.0 notes below have been corrected for the same reason. Nothing about what a license does has changed.

= 1.10.1 =
* **The admin screens caught up with the change.** The License screen still showed a three-row plan table naming Solo, Pro and Agency with 5, 10 and 25 seats, and four screens could still say a feature was "available on Atelier Pro and above". None of it was reachable, because nothing is gated any more, but it was still there to read. The License screen now describes what a license actually adds: automatic updates, email support, and a site allowance of up to 127 activations.

= 1.10.0 =
* **Every feature is in this edition.** Commissions with milestone payments and booking, patron subscriptions with content drip, the multi-artist Foundry, the cross-artist Marketplace and the Adobe Lightroom publish API were previously removed from the free build. They are all here now.
* **Why.** The paid editions had been locking three of those features behind a tier while this build shipped with them open anyway, so paying could make the product worse. Atelier is one product now. A license buys automatic updates, support and a site allowance of up to 127 activations; it does not buy a feature.

= 1.9.8 =
* **Plainer writing in the storefront and the work editor.** Checkout messages, the maker's proof captions and every field label used long dashes where a full stop or a colon reads more easily.

= 1.9.7 =
* **Plainer writing.** A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.

= 1.9.6 =
* **Plainer writing.** The description, the feature list and the FAQ answers used long dashes where a colon, a comma or a full stop reads more easily. Nothing about the plugin changed, only how it is described.

= 1.9.5 =
* **The readme no longer contradicts itself.** It marked four features "(paid editions)" and then closed by saying everything above was in the free edition. It now says plainly what the free edition has and what the paid edition adds, and the storefront description no longer mentions a commission form this edition does not include.
* **The Stripe webhook instructions match this build.** The Payments screen asked you to subscribe to `invoice.paid` and `customer.subscription.deleted`. This edition has no subscriptions and no handler for either event, so it now names only `checkout.session.completed`.
* The setup steps point at the real **Payments & Tax** settings tab, and the three operator docs that ship in the plugin folder are now mentioned so you can find them.

= 1.9.4 =
* The arcade (XP, ranks, HUD, level-up effects) and the Trophy Case are now off by default. Turn them on any time under the Game Feel tab in Settings. The setup guide is now a plain step-by-step checklist. Nothing else changes.

= 1.9.0 =
A quality and safety release from a full pre release QA pass.
* Every studio section opens again. After an earlier menu change, opening Works, Orders, CRM, Shows, the License page, or the Setup Quest could show a "Sorry, you are not allowed to access this page" error. They are now fully reachable, so you can enter your license key and finish setup.
* Correct prices for yen and other zero decimal currencies. A yen price now shows the same amount your customer is charged, instead of appearing one hundred times too high.
* Fair EU VAT. A valid EU business buyer under reverse charge, and a buyer outside the EU, now pay the net price with the embedded VAT removed in tax inclusive mode.
* Download limits are enforced exactly, even when several downloads start at the same moment.
* Spam protection on the newsletter form. Signups now have rate limiting and a hidden honeypot, so the form cannot be used to flood your list or to send confirmation email to strangers.
* Safer PayPal handling. A returning payment is matched to the exact order and amount it paid for.
* Certificates follow the order. A license certificate now checks that its order is still paid and the license has not expired before it is shown.
* Accurate promo end time, parsed in your site timezone.
* Cleaner uninstall. Deleting the plugin removes its data on every site of a multisite network, while leaving your storefront page untouched.
* A translation template is now bundled.

= 1.4.0 =
* Web fonts are now bundled and served locally instead of from Google. No visitor IP is shared with a third party on page load.
* The "Powered by Bodholdt Atelier" storefront credit is now opt-in (Settings → Studio) and hidden by default.

= 1.3.0 =
* Certificate signature: optional artist-signature image composited onto the Certificate of Authenticity.

= 1.2.0 =
* Lossless audio: on-demand transcoding to MP3 320 / FLAC / ALAC / WAV (24-bit); buyers choose a download format at checkout.

= 1.1.0 =
* Tiered shipping: charge by destination zone + parcel weight, with the flat per-piece price as a fallback.

= 1.0.0 =
* First stable release.

== Upgrade Notice ==

= 1.9.0 =
Quality and safety fixes: all studio sections open again, correct yen and EU VAT pricing, exact download limits, newsletter spam protection, and a cleaner uninstall. No database changes.

= 1.4.0 =
Web fonts are now served locally (a privacy improvement) and the storefront credit is opt-in. No database changes.

= 1.3.0 =
Adds an optional artist-signature image on certificates. No database changes.
