v1.6.1 — widget embedding on other sites

Changed

• The bundled widget is now @escalated-dev/escalated 0.12.2. It hides its Check Status tab when /config returns status_lookup_enabled: false.

Added

• Embed the widget on other sites. List the sites under Settings > Widget > Embedding Sites, in the ESCALATED_WIDGET_ALLOWED_ORIGINS constant or with the escalated_widget_allowed_origins filter (https://shop.example.com, https://*.example.com), then load /wp-json/escalated/v1/widget/embed.js there. Listed origins get CORS headers on every /widget route, chat included, and always run as a guest; WordPress core's own CORS headers are turned off for those routes, so unlisted sites get no grant. Nothing changes until a site is listed. See docs/embedding-the-widget.md.
• Widget settings (enable, color, position, greeting, embedding sites) on the Escalated settings page. Invalid embedding sites are refused and the previous list is kept.
• Widget tickets and chats accept an optional metadata object of host parameters (order number, plan, page URL, ...). It is sanitised to at most 25 flat scalar entries; embedded_on is set from the request's Origin. /widget/config returns accepts_metadata: true. Chat sessions get a nullable metadata column through the normal schema upgrade.
• The widget API matches the shared widget (@escalated-dev/escalated 0.12). /widget/config adds enabled, departments, kb_enabled, guest_tickets_enabled and status_lookup_enabled: false, and a disabled widget answers 403 with enabled: false. /widget/articles?q= answers {articles: [...]} (the search parameter keeps the bare array), and /widget/articles/{slug} adds body. Widget tickets accept department_id and return guest_access_token. Chat start returns the chat ticket's random guest token as id (the numeric id moves to session_id), and new /widget/chat/{id}/messages (GET and POST), /typing, /end and /rate routes are keyed by it. The older numeric chat routes are unchanged. See docs/embedding-the-widget.md.
• Opt-in department visibility and account restrictions across ticket queries, child records, REST tokens, reports, widget lookups, assignment and notifications. Administrators retain access; existing installations default to unrestricted staff visibility.
• Nullable indexed ticket account identities with host requester/subject and agent resolver hooks. Escalation rules, workflows and automations support exact account and ticket-type conditions.
• Optional department/type SLA targets and settings controls. Department moves preserve SLA deadlines; explicit reselection uses the original creation time.

Fixed

• Satisfaction ratings are saved. The model wrote an updated_at column the table does not have, so every insert failed, including the front-end rating form.
• Install ticket links before their first API read and run schema updates on the configured package database. Upgrades preserve existing rows and support custom prefixes.
• Invoke the assignment service correctly from the token API and report ineligible assignees as validation errors.

What's Changed

• feat: add configurable ticket access, accounts and SLA targets by @mpge in #92
• feat(widget): allow embedding the widget on other sites by @mpge in #93
• feat(widget): align the widget API with the shared widget by @mpge in #94
• chore(widget): ship the widget bundle from @escalated-dev/escalated 0.12.2 by @mpge in #95
• chore(release): v1.6.1 by @mpge in #96

Full Changelog: v1.6.0...v1.6.1