=== Agentic Commerce ===
Contributors: barrelmaker
Tags: woocommerce, ai, ai-agents, agentic-commerce, ecommerce
Requires at least: 6.2
Tested up to: 6.8
Requires PHP: 8.1
WC requires at least: 8.0
WC tested up to: 10.5
Stable tag: 2.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Get discovered by AI shopping agents. Free includes A2A discovery; Pro unlocks UCP, WebMCP, and checkout. ACP checkout is not in this release.

== Description ==

**Get your WooCommerce store discovered, evaluated, and bought by AI shopping agents.**

AI agents are already browsing catalogs, comparing offers, and completing purchases on behalf of buyers. **Sygentic AI Commerce** — this plugin's **Agentic Commerce** distribution — prepares your WooCommerce store for that channel. Free publishes A2A discovery on activate. UCP, WebMCP, delegated checkout, and managed AI require Pro. There is no Free onboarding wizard.

**Agentic Commerce Pro features (license required):**

*Protocol surfaces are available today in Beta — the agentic-commerce ecosystem is still evolving, so we recommend staging validation before relying on them for revenue-critical checkout paths. See the FAQ below for how delegated checkout stays under your control.*

* **Managed AI — zero API key configuration** — Pro subscribers use the Sygentic AI Commerce managed middleware; no vendor API key setup required.
* **A2A (Agent-to-Agent) protocol** — exposes `/.well-known/agent.json` and a JSON-RPC 2.0 webhook so AI agents can communicate with your store.
* **Universal Commerce Protocol (UCP)** — product discovery, quotes, and delegated (operator-controlled) checkout flows for AI agents.
* **WebMCP schema embedding** — deterministic interaction schemas in product page `<head>` for AI browser agents.
* **AI discoverability** — generates `llms.txt`, `agents.txt`, and AI-friendly `robots.txt` directives for major crawlers.
* **Agentic Checkout admin** — onboarding, diagnostics, smoke tests, and middleware health visibility for commerce operators.
* **Stripe-backed billing and checkout** — Pro subscription billing plus optional Stripe payment method for agentic checkout orders.
* Priority support and commerce-focused documentation.

The plugin communicates with the Sygentic AI Commerce service at `acommerce.app` to generate agentic commerce data and process managed AI requests. Pro-tier stores use managed service credentials; see our [Privacy Policy](https://acommerce.app/privacy-policy/) for details on data sent to the middleware and third-party processors.

== Installation ==

1. Upload the `agentic-commerce` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Free first-run is activate plus A2A discovery (`/.well-known/agent.json`). There is no BYOK settings tab.

License, Agentic Checkout, and the onboarding smoke test are Pro / after-upgrade — not Free install steps. Checkout is Pro.

== Frequently Asked Questions ==

= What is Agentic Commerce? =

Agentic Commerce is the emerging channel where AI agents discover, evaluate, and purchase products on behalf of shoppers. Sygentic AI Commerce's Agentic Commerce distribution makes your WooCommerce store visible and operable by those agents by implementing the A2A, UCP, and WebMCP surfaces they use — activated from your WordPress admin, no custom development required. ACP checkout is not in this release (roadmap).

= Does this package include ACP checkout? =

No. ACP checkout is not in this release — it is on the roadmap and is not enabled. Free includes A2A discovery; Pro unlocks UCP, WebMCP, and checkout.

= Is agent checkout fully autonomous — will orders happen without my approval? =

No. Agentic Commerce ships **delegated** checkout, not unattended autonomy. Every agent-initiated order runs through your own Stripe-backed payment configuration and your existing WooCommerce order pipeline, and you choose which protocol surfaces are enabled. Treat agent-initiated orders like any other WooCommerce order for fulfillment, refunds, and fraud review.

= Do I need a WooCommerce store to use this? =

Yes. Agentic Commerce is built specifically for WooCommerce — product discovery, quotes, and checkout flows read and write against your existing WooCommerce catalog and order system, so WooCommerce must be installed and active.

= Do I need an OpenAI API key? =

**Free: No.** The Free commerce ZIP has no BYOK settings tab. **Pro: No.** Pro subscriptions include fully managed AI through the Sygentic AI Commerce middleware — no vendor API key setup required.

= How much does Pro cost? =

Pro is available at [acommerce.app/pricing](https://acommerce.app/pricing/) — US$419/month or US$3,210/year (~36% annual savings). Managed AI usage per Pro site is subject to a US$110.93/month budget target. Free first-run is activate + A2A discovery (`/.well-known/agent.json`). Checkout is Pro. There is no BYOK settings tab. UCP, WebMCP, and checkout require Pro.

= Which LLM models are supported? =

Managed Pro requests use operator-approved models on the Sygentic AI Commerce middleware. Supported vendors are OpenAI and DeepSeek behind the managed service.

= Does the plugin modify my products automatically? =

No. Agentic protocol generation and checkout flows operate on explicit admin configuration and agent-initiated requests. Database product content is not silently rewritten by protocol modules.

= What data is sent to the middleware? =

Store metadata, product context required for protocol generation, checkout session data, and license validation signals are sent over HTTPS. See our [Privacy Policy](https://acommerce.app/privacy-policy/) for full details.

= Does this plugin use Stripe? =

Yes. Stripe processes payments for Pro subscription billing and — when enabled — for AI-agent-initiated (agentic) checkout orders. The plugin sends order amount, currency, customer email, and payment method references required to create Stripe Customers, PaymentMethods, and PaymentIntents. Stripe webhook events confirm payment success, failure, refunds, and disputes on matching WooCommerce orders. See Stripe's [Privacy Policy](https://stripe.com/privacy) and [Terms of Service](https://stripe.com/legal).

= Does the AI Agent Overlay track visitors? =

When the AI Agent Overlay (Pro) is active, its snippet always sends your page's URL and a public site ID to `acommerce.app` so it can return AI-readable structured data for that page — no visitor-identifying data is involved in that request. Separately, and **only with your visitors' explicit consent**, the snippet additionally computes a browser fingerprint (from your visitor's user agent, screen/canvas/audio signals) and stores a persistent visitor identifier in their browser's `localStorage`, which is then included in requests to `acommerce.app` for cross-session visitor recognition. Without a granted consent signal — via a WP Consent API-compatible consent management plugin, or the site's own consent configuration — none of this fingerprinting, `localStorage` writing, or visitor-ID transmission happens. See our [Privacy Policy](https://acommerce.app/privacy-policy/) for details.

== Screenshots ==

1. Agentic Commerce dashboard — setup status, middleware diagnostics, and next actions.
2. Agentic Checkout settings — Stripe, protocol, and smoke-test configuration.
3. AI Visibility — generate llms.txt, agents.txt, robots.txt, and sitemap additions for AI crawlers.

== Changelog ==

= 2.2.0 =
* Security: Fixed critical authentication bug where A2A, UCP, and WebMCP modules were sending incorrect auth headers — all middleware calls now correctly use X-Plugin-Token
* Security: Agent API Key for UCP checkout authentication is now a dedicated admin-managed key (Settings → API Keys → Agent API Key)
* Security: Google OAuth tokens (access token, refresh token, client secret) are now encrypted at rest using AES-256-CBC
* Changed: All middleware endpoints now point to acommerce.app (bodut.com is retired)
* Changed: Internal vendor label renamed from 'bodut' to 'ecai' in the database (auto-migrated on update)
* Changed: Minimum PHP version enforced by compatibility check raised to 8.1
* New: ecai_get_plugin_token() global helper for accessing the plugin registration token from any context
* New: Agentic Commerce onboarding, diagnostics, and smoke-test surfaces
* Note: ACP checkout is not enabled in this release (roadmap).
* New: GET / middleware endpoint returns JSON service metadata (fixes broken unit tests)
* Fixed: E2E tests no longer use placeholder assertions
* Fixed: Hardcoded staging credentials removed from provision script

= 2.1.0 =
* New: Agentic Commerce protocols (A2A, UCP, WebMCP)
* New: AI Visibility tools for llms.txt, agents.txt, robots.txt, and sitemap additions
* New: Settings hub with License and Agentic Checkout tabs
* New: PostgreSQL persistence for overlay and visitor analytics data
* New: Rate limiting and security headers on middleware API
* Improved: Security hardening — fixed critical auth bypasses on middleware routes
* Fixed: Stripe webhook now sends license email after generation

= 2.0.0 =
* New: improved content optimization engine for higher-quality product copy
* New: Per-request API key model — middleware never stores vendor credentials
* Improved: Security hardening (nonce verification, capability checks, input sanitization)
* Improved: Admin UI with loading states and confirmation dialogs

= 1.3.0 =
* Initial release with single-call LLM architecture

== Upgrade Notice ==

= 2.2.0 =
Critical security fixes and Agentic Commerce readiness: correct A2A/UCP/WebMCP auth, acommerce.app middleware domain, and onboarding/diagnostics. ACP checkout is not in this release. Update immediately.

= 2.1.0 =
Agentic Commerce protocols (A2A, UCP, WebMCP), AI Visibility tools, and commerce-focused admin navigation. Update to enable agent-ready store surfaces.

= 2.0.0 =
Major upgrade with improved managed-service architecture. Existing license settings are preserved.
