=== écentic for WooCommerce ===
Contributors: ecentic
Tags: woocommerce, ai, agentic-commerce, ucp, ai-commerce
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.0
Requires Plugins: woocommerce
WC requires at least: 7.0
Stable tag: 1.0.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Make your store discoverable and transactable by AI shopping agents via the Universal Commerce Protocol (UCP 2026-04-08), powered by écentic.

== Description ==

écentic for WooCommerce connects your store to the [Universal Commerce Protocol](https://ucp.dev) so AI shopping assistants (Google Gemini AI Mode, ChatGPT Shopping, and any UCP-compatible agent) can discover, browse, and purchase from your store — no screen-scraping, no custom integrations.

The heavy UCP protocol surface — capability negotiation, catalog search, cart and checkout sessions, payment handling, idempotency, RFC 9421 request/response signing, and order webhooks — is served by **[écentic](https://ecentic.ai)** on your store's behalf. This plugin is the store-side half:

**On your domain:**

* `/.well-known/ucp` — the UCP discovery profile (cached proxy of your hosted profile, so agents always discover you at your own URL)
* `/.well-known/oauth-authorization-server` — OAuth 2.0 metadata (RFC 8414) for UCP identity linking
* `/ucp-oauth/authorize|token|revoke` — the identity-linking authorization server: your customers log in and grant consent on *your* site, never on a third party
* `/ucp-connect/*` — the one-click écentic connection (OAuth 2.0 + PKCE; the API secret never travels through a browser)

**For the écentic backend (private, key-authenticated bridge):**

* Live cart math — quotes run on a real WooCommerce cart, so your tax tables, shipping zones, coupons, and any third-party pricing plugins all apply
* Order creation through the native WooCommerce checkout internals
* Optional server-side payment processing via the WooCommerce Stripe Gateway (your Stripe secret key never leaves this site)
* Order entity snapshots, user-token introspection, and store policy (legal pages, page URLs, payment handlers, access rules)

**Merchant controls (WooCommerce → UCP (AI Agents)):**

* Enable/disable the whole UCP surface
* Require RFC 9421 signed requests
* Store-level API key (`X-UCP-Key`)
* Allow-list of agent platforms permitted to transact (identity binding)
* Per-agent rate limit
* Include/exclude out-of-stock products from the agent catalog
* Google Pay payment handler declaration (merchant ID + PSP gateway)
* Server-side Stripe charging (off by default; payment otherwise defers to your trusted checkout)

Settings apply to the hosted endpoints immediately on save.

**Also included:**

* Order lifecycle webhooks to agent platforms (`order.created`, `order.updated`) with Standard Webhooks headers and RFC 9421 signatures, relayed through écentic
* Full support for variable products, coupon codes (with per-line discount allocations), and live shipping options
* HPOS (custom order tables) and cart/checkout blocks compatible
* Extensible: `ecentic_ucp_process_instrument` (custom payment processors), `ecentic_ucp_payment_handlers`, `ecentic_ucp_identity_scopes`, `ecentic_ucp_stripe_secret_key`

== Installation ==

1. Install and activate the plugin (WooCommerce must be active). Activating it on its own sends nothing anywhere and changes nothing about your storefront.
2. Go to *WooCommerce → UCP (AI Agents)*. The connection panel explains exactly what is shared with écentic.
3. Click **Connect to ecentic.ai** when you are ready. This is the point at which the store first contacts écentic; you approve the connection in your own wp-admin session.
4. Visit `https://yourstore.com/.well-known/ucp` to see your live discovery profile, and fine-tune the settings on the same screen.

To disconnect, revoke the plugin's key under *WooCommerce → Settings → Advanced → REST API* — écentic immediately loses all access to the store.

== External services ==

This plugin relies on the following third-party services. No data is transmitted to any of them until you explicitly connect the store (see Installation) or explicitly enable the feature described.

**écentic (ecentic.ai) — required**

écentic is the hosted backend that serves this store's UCP protocol surface: capability negotiation, catalog search, cart and checkout sessions, payment handling, RFC 9421 request signing, and order webhooks to AI agent platforms. The plugin is the store-side half of that service; the store cannot be served to AI agents without it.

* **What is sent, and when.** Nothing is sent on installation or activation. When you click **Connect to ecentic.ai** on the settings screen, your store URL, REST API URL, and site name are sent to start the OAuth 2.0 connection. If you approve it, écentic receives a WooCommerce REST API key that you issued, and from then on it reads your product catalog and store policy (currency, shipping options, legal page URLs, payment handler declarations, and your UCP settings) as agents request them, and receives the orders that AI agents place through it (line items, totals, and the buyer's shipping and contact details needed to fulfil the order). Your store also serves écentic's copy of your discovery profile at `/.well-known/ucp`, refreshing it about every 5 minutes.
* **What is never sent.** Payment secrets (such as your Stripe secret key), customer passwords, and the WooCommerce database itself stay on your site.
* Service provided by écentic: [Terms of Service](https://ecentic.ai/terms), [Privacy Policy](https://ecentic.ai/privacy-policy).

**Stripe (api.stripe.com) — optional, off by default**

Only used if you tick **Server-side Payments (Stripe)** on the settings screen *and* have the WooCommerce Stripe Gateway configured. When an AI agent completes a checkout, the plugin calls Stripe's PaymentIntents API from your server to charge the payment method the buyer authorised, sending the payment token, the order amount and currency, and the order number. The call is made with the Stripe secret key already configured on your own site — the key never leaves your server, and no request is made to Stripe while the setting is off.

* Service provided by Stripe: [Terms of Service](https://stripe.com/legal/ssa), [Privacy Policy](https://stripe.com/privacy).

**Google Pay — optional, declaration only**

If you enter a Google Pay merchant ID in the settings, the store advertises a Google Pay payment handler in its UCP profile, referencing Google's published handler schema URL. The plugin itself makes no request to Google and sends Google no data; any Google Pay interaction happens between the buyer's AI agent and Google.

* Service provided by Google: [Terms of Service](https://payments.developers.google.com/terms/sellertos), [Privacy Policy](https://policies.google.com/privacy).

== Frequently Asked Questions ==

= Does the plugin contact écentic on its own? =
No. Installing and activating the plugin transmits nothing. The store contacts écentic for the first time only when a store administrator clicks **Connect to ecentic.ai** on the settings screen, and it stops the moment you revoke the API key.


= Does this affect my existing checkout or storefront? =
No. The plugin adds `.well-known` URLs, the identity-linking endpoints, and a private REST bridge. Your storefront, theme, and checkout are untouched, and agent orders are created through the same WooCommerce internals as regular orders (`created_via = ucp`, so you can tell them apart).

= What data is shared with écentic? =
Your product catalog, store policy needed to serve the protocol (currency, shipping options, legal page links, payment handler declarations, your UCP settings), and the orders created through agent checkouts. The connection uses a WooCommerce REST API key you approve explicitly and can revoke at any time. Payment secrets (e.g. your Stripe secret key) and customer passwords never leave your site.

= Do agents charge cards through my store? =
Only if you turn on server-side Stripe processing and have the WooCommerce Stripe Gateway configured. Otherwise agent checkouts create the order unpaid and the buyer pays on your own order-pay page — you remain the Merchant of Record either way.

= What is identity linking? =
An optional OAuth 2.0 flow (built into this plugin) that lets a customer link their account on your store to their AI assistant, so the agent can access user-gated operations such as order history. Consent happens on your domain; you control which scopes are gated via the `ecentic_ucp_identity_scopes` filter.

= How do I restrict which AI platforms can transact? =
In *WooCommerce → UCP (AI Agents)*: set an API key, list allowed agent platforms, require signed requests, or set a rate limit. Leave everything open for permissionless onboarding.

= How do I test it? =
Visit `https://yourstore.com/.well-known/ucp` — it returns your UCP profile with the hosted endpoint agents will call. The settings page links both.

= What UCP version does this support? =
UCP 2026-04-08.

== Changelog ==

= 1.0.0 =
* Initial release — full in-plugin UCP 2026-04-08 implementation
