=== mandate0 for WooCommerce ===
Contributors: agentsauthority
Tags: woocommerce, ai-agents, payments, stripe-connect, storefronts
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.5.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WooCommerce stores to mandate0 so AI agents can discover
products and use merchant-controlled checkout.

== Description ==

mandate0 lets AI agents shop your store autonomously while you keep
governance, compliance, and a full audit trail. Checkouts follow checkout
policy controls and audit-ready authorization — not prompts.

This plugin:

* **Connects** your store to the mandate0 platform with a mandate0 API key.
* **Publishes** agent endpoints and a storefront profile at `/.well-known/ucp`
  with auto-generated ES256 signing keys.
* **Advertises** a Stripe Connect checkout endpoint at
  `/wp-json/mandate0/v1/stripe-connect/checkout`, with synchronized
  request limits and POST response discovery (`createSession`,
  `completeSession`, `completeHeaders` with `Idempotency-Key`) in the
  storefront profile and endpoint.
* **Provisions** read-only WooCommerce REST credentials so the checkout proxy can
  read live catalog and inventory.
* **Syncs** your catalog to the platform in real time (on product save/delete)
  and on an hourly reconciliation schedule.
* **Enforces** a storefront visibility policy — hide out-of-stock items or whole
  categories from agents.
* **Shows** the same launch-readiness path as the Shopify app: connection,
  agent endpoints, checkout proxy, Stripe Connect checkout, and storefront
  visibility policy.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/mandate0` or install via the
   Plugins screen.
2. Activate it. WooCommerce 6.9+ is required (for the Store API).
3. Go to **mandate0 → Overview**.
4. Connect the WooCommerce storefront integration with the mandate0 API
   key (`m0_store_...`) from Storefronts > Connect store in the mandate0 dashboard, then click **Connect store**.

Upgrading from 1.4: install and activate the mandate0 ZIP. The known legacy
plugin entry hands off automatically without disconnecting the store; its old
copy becomes inactive. Replacing the contents of the existing plugin directory
also works through the compatibility entry file. Existing `aa_store_` keys
remain valid; do not deactivate or uninstall the active old copy before upgrading.

== Frequently Asked Questions ==

= Where do I get a mandate0 API key? =
From your mandate0 dashboard under Storefronts > Connect store. Use the
mandate0 API key that starts with `m0_store_` to publish the WooCommerce
launch surface.

= What data leaves my store? =
Product catalog data and the storefront profile served at `/.well-known/ucp`.
Payment is handled through mandate0's Stripe Connect checkout flow
after the buyer-authorized payment authorization is prepared and signed. The
public checkout endpoint only builds the synchronized session/completion payload
shape; it does not sign payment authorizations or submit payment-method charges
by itself.

= Does it work with HPOS (High-Performance Order Storage)? =
Yes. The plugin declares HPOS compatibility.

== External services ==

This plugin connects to the following external services.

= mandate0 platform =
Your store connects to the platform (default `https://app.mandate0.com`,
or the Platform URL you set) using your store API key. It sends product catalog
data, the storefront profile, and, once connected, a record of requests to
catalog pages (shop, product, category, search) that identify as AI agents:
path, search term and result count, user agent, declared agent profile, any
Web Bot Auth signature headers, and response status. Checkout, cart, account
and admin pages are never recorded. Agent records are sent in the background
after the page is served, authenticated with your store API key. Developers can
turn agent observation off with
`add_filter( 'm0_agent_observer_enabled', '__return_false' );`.
Terms: https://www.agentsauthority.ai/terms
Privacy: https://www.agentsauthority.ai/privacy

= PostHog (usage analytics, opt-in) =
Off by default. Only if you tick "Share anonymous usage data" under
mandate0 > Developer, the plugin sends product-usage
events (e.g. plugin activated, catalog sync) to PostHog at
`https://us.i.posthog.com`, with your store domain and the plugin, WooCommerce
and WordPress versions. No customer data is sent. Untick the box to stop.
PostHog terms: https://posthog.com/terms Privacy: https://posthog.com/privacy

= Stripe =
Agent checkouts are processed through Stripe Connect by the platform.
Stripe terms: https://stripe.com/legal Privacy: https://stripe.com/privacy

== Third-party assets ==

This plugin bundles the Instrument Sans webfont
(assets/fonts/instrument-sans/), Copyright 2022 The Instrument Sans Project
Authors, used under the SIL Open Font License v1.1. The full license text
ships alongside the font at assets/fonts/instrument-sans/OFL.txt.
Source: https://github.com/Instrument/instrument-sans

== Changelog ==

= 1.5.0 =
* Rename the plugin and its canonical identifiers to mandate0.
* Preserve existing store keys, signing identities, telemetry choices, checkout receipts, and queued jobs during upgrades.
* Keep legacy REST routes, class aliases, customization hooks, and admin bookmarks compatible.
* Fix: the agent observer now ships data on a default install, using the connected platform URL and store API key (Bearer auth).
* Fix: unsigned agent visits send a signature-component object accepted by the platform.
* Change: usage telemetry (PostHog) is now opt-in and off by default, with a settings checkbox.
* Fix: telemetry filters cannot enable tracking without the store owner's consent.
* Update: platform terms and privacy links use the canonical website address.

= 1.4.0 =
* Queue product, variation, inventory, image, and visibility changes through
  Action Scheduler with bounded retries and operational health reporting.
* Include WooCommerce source timestamps so delayed updates cannot overwrite
  newer platform catalog data.
* Run automatic full catalog reconciliation every 15 minutes.

= 1.3.0 =
* Rebuilt connect handshake against the mandate0 store connection API
  (`/api/v1/plugin/*`).
* Auto-provision read-only WooCommerce REST credentials for the proxy.
* Publish the storefront profile at `/.well-known/ucp` with ES256 signing keys.
* Real-time + scheduled catalog sync; storefront visibility policy controls.
* Added synchronized Stripe Connect checkout payloads and REST endpoint.
* Added launch-readiness admin UI aligned with the Shopify app.
