docs(links): point Connector repo references at WordPress.org

`getting-started.md` installation step now links to the WordPress.org
plugin page + the WP.org direct ZIP download instead of a pinned
GitHub releases URL. The pinned-version URL had drifted to a
1.1.1.0 build; the WP.org ZIP always serves the latest stable.

`flows.md` deep-link references replace `github.com/.../blob/<sha>/...`
URLs with `plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/...`
equivalents. Line anchors re-derived against current trunk — several
symbols moved (notably `Encryption::createIdentityNonce` from L399 to
L863) and `TrustedLoginService::envelopeToUrl()` was renamed to
`envelope_to_url()`.

Author: zackkatz

docs/flows.md

@@ -41,7 +41,7 @@ The public key is fetched by default from the [URL defined in the `vendor/websit
 
 ### Step 3: Public Key is Generated {#step-3-public-key-is-generated}
 
-The public key request is handled by [`\TrustedLogin\Vendor\Endpoints\PublicKey::get()`](https://github.com/trustedlogin/trustedlogin-connector/blob/aac75e18d21728155b76537f908031fc17cd562a/php/Endpoints/PublicKey.php#L20), which uses [`\TrustedLogin\Vendor\Encryption::generateKeys()`](https://github.com/trustedlogin/trustedlogin-connector/blob/aac75e18d21728155b76537f908031fc17cd562a/php/Encryption.php#L100) to generate two sets of encryption keys (`crypto_sign` and `crypto_box` key pairs) but only returns the `crypto_box` public key.
+The public key request is handled by [`\TrustedLogin\Vendor\Endpoints\PublicKey::get()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Endpoints/PublicKey.php#L19), which uses [`\TrustedLogin\Vendor\Encryption::generateKeys()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Encryption.php#L222) to generate two sets of encryption keys (`crypto_sign` and `crypto_box` key pairs) but only returns the `crypto_box` public key.
 
 ### Step 4: Envelope Created & Encrypted {#step-4-envelope-created--encrypted}
 
@@ -81,11 +81,11 @@ The **unsuccessful** response is:
 
 ![Site Access Key login form](/img/flows/login/step-01.png)
 
-The form submits a `POST` HTTP request via AJAX that is received by the [`TrustedLogin\Vendor\AccessKeyLogin::handle()`](https://github.com/trustedlogin/trustedlogin-connector/blob/main/php/AccessKeyLogin.php#L106) method.
+The form submits a `POST` HTTP request via AJAX that is received by the [`TrustedLogin\Vendor\AccessKeyLogin::handle()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/AccessKeyLogin.php#L171) method.
 
-Receiving that request, [`TrustedLogin\Vendor\AccessKeyLogin::verifyGrantAccessRequest()`](https://github.com/trustedlogin/trustedlogin-connector/blob/main/php/AccessKeyLogin.php#L200) verifies that the nonce is valid and that the request is coming from inside the site.
+Receiving that request, [`TrustedLogin\Vendor\AccessKeyLogin::verifyGrantAccessRequest()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/AccessKeyLogin.php#L305) verifies that the nonce is valid and that the request is coming from inside the site.
 
-In addition, [`TrustedLogin\Vendor\Traits\VerifyUser::verifyUserRole()`](https://github.com/trustedlogin/trustedlogin-connector/blob/develop/php/Traits/VerifyUser.php#L17) checks to make sure the user is logged-in and has one or more of the roles that are required to access the site.
+In addition, [`TrustedLogin\Vendor\Traits\VerifyUser::verifyUserRole()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Traits/VerifyUser.php#L17) checks to make sure the user is logged-in and has one or more of the roles that are required to access the site.
 
 ### Step 2: Vendor Requests List of Matching Site IDs {#step-2-vendor-requests-list-of-matching-site-ids}
 
@@ -129,10 +129,10 @@ An array of Secret IDs is returned. These are not the envelope itself; Secret ID
 
 The Connector plugin uses the Secret IDs to retrieve the envelopes from the Vault.
 
-In addition to the Bearer token, the request generates a signed nonce in [`TrustedLogin\Vendor\Encryption::createIdentityNonce()`](https://github.com/trustedlogin/trustedlogin-connector/blob/develop/php/Encryption.php#L399). The method:
+In addition to the Bearer token, the request generates a signed nonce in [`TrustedLogin\Vendor\Encryption::createIdentityNonce()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Encryption.php#L863). The method:
 
-- Generates a cryptographic nonce (in [`TrustedLogin\Vendor\Encryption::generateNonce()`](https://github.com/trustedlogin/trustedlogin-connector/blob/develop/php/Encryption.php#L485) using `random_bytes()`), 
-- Signs the nonce with the `sign_private_key` pair (in [`TrustedLogin\Vendor\Encryption::sign()`](https://github.com/trustedlogin/trustedlogin-connector/blob/develop/php/Encryption.php#L512), using `sodium_crypto_sign_detached()`), and 
+- Generates a cryptographic nonce (in [`TrustedLogin\Vendor\Encryption::generateNonce()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Encryption.php#L953) using `random_bytes()`), 
+- Signs the nonce with the `sign_private_key` pair (in [`TrustedLogin\Vendor\Encryption::sign()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/Encryption.php#L979), using `sodium_crypto_sign_detached()`), and 
 - Verifies that the signed nonce has been properly generated (using `sodium_crypto_sign_verify_detached()`)
 
 The nonce and signed nonce are both sent in the request, helping to verify that this site is indeed the sender of the data.
@@ -155,13 +155,13 @@ The envelope with encrypted credentials is returned to the Vendor.
 
 The Connector plugin receives the envelope. It includes the Site URL associated with the Site Access Key but not the endpoint, which is required to log in.
 
-The Connector plugin decrypts the envelope and extracts the credentials, then cryptographically generates the URL to access Client site (using [`TrustedLogin\Vendor\TrustedLoginService::envelopeToUrl()`](https://github.com/trustedlogin/trustedlogin-connector/blob/a62ec370bb5e715eed3524bf92c77482e785d273/php/TrustedLoginService.php#L395)).
+The Connector plugin decrypts the envelope and extracts the credentials, then cryptographically generates the URL to access Client site (using [`TrustedLogin\Vendor\TrustedLoginService::envelope_to_url()`](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/php/TrustedLoginService.php#L808)).
 
 The site URL and the access parts are returned as an AJAX response, completing the request started in Step 1.
 
 ### Step 7: Connector Plugin `POST`s to Client Site {#step-7-connector-plugin-posts-to-client-site}
 
-A temporary form [is created using JavaScript](https://github.com/trustedlogin/trustedlogin-connector/blob/a62ec370bb5e715eed3524bf92c77482e785d273/src/components/AccessKeyForm.js#L259-L281) with the Client Site URL set as the form `action` property. A `POST` request is submitted, preventing the submitted data from being logged. 
+A temporary form [is created using JavaScript](https://plugins.trac.wordpress.org/browser/trustedlogin-connector/trunk/src/components/AccessKeyForm.js#L253) with the Client Site URL set as the form `action` property. A `POST` request is submitted, preventing the submitted data from being logged. 
 
 The form submits the following to the Client Site URL:
 

docs/getting-started.md

@@ -67,7 +67,7 @@ Don't close the tab! We'll be coming back here to grab the Account ID, Public Ke
 
 The TrustedLogin Connector plugin is a WordPress plugin that you host on your own site. The Connector plugin is what makes TrustedLogin so secure: secrets are encrypted and decrypted using keys that are generated by the Connector plugin.
 
-1. [Download the Connector plugin](https://github.com/trustedlogin/trustedlogin-connector/releases/download/v1.1.1.0/trustedlogin-connector-1.1.1.zip)
+1. Get the plugin from the [WordPress.org plugin page](https://wordpress.org/plugins/trustedlogin-connector/) — or [download the latest ZIP directly](https://downloads.wordpress.org/plugin/trustedlogin-connector.zip)
 2. Upload the plugin to your WordPress installation
 3. Click the new "TrustedLogin" menu item in the sidebar menu