=== Vixns Commerce Profile for Universal Commerce Protocol ===
Contributors: vixns
Tags: woocommerce, ucp, well-known, discovery, ai-agents
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Static Universal Commerce Protocol business profile, optional catalog REST, and signing keys[] for WooCommerce. Not affiliated with the UCP project.

== Description ==

Vixns Commerce Profile for Universal Commerce Protocol writes an honest business profile JSON to a static file at `/.well-known/ucp`, can expose UCP catalog REST (search / lookup / product), and can publish `keys[]` (JWK Set) with rotation for Web Bot Auth `type=jwks_uri` interop.

This is a third-party WooCommerce integration by Vixns. It is not an official Universal Commerce Protocol product.

* Spec target: 2026-08-25
* Never advertises checkout, cart, or payment handlers
* Private keys stored under `uploads/vixns-commerce-profile-ucp/private/` (Apache/IIS deny files are written automatically; block the path on nginx)
* Optional product feed (JSONL), not linked from the profile
* Catalog REST is intentionally open to agents that send a valid `UCP-Agent` header (same visibility as a public product catalog)

== Installation ==

1. Install and activate WooCommerce.
2. Upload the `vixns-commerce-profile-ucp` folder to `/wp-content/plugins/` (or install the ZIP via Plugins → Add New).
3. Activate **Vixns Commerce Profile for Universal Commerce Protocol**.
4. Configure your web server to serve `/.well-known/ucp` as static JSON with `Cache-Control: public, max-age≥60` and **no redirects**.
5. Open WooCommerce → Settings → **Vixns UCP**, set the canonical HTTPS host if needed, then **Generate now**.

Example nginx location (adjust `root`):

`
location = /.well-known/ucp {
    default_type application/json;
    add_header Cache-Control "public, max-age=300" always;
    add_header Access-Control-Allow-Origin "*" always;
    add_header Access-Control-Allow-Methods "GET, HEAD" always;
    try_files /.well-known/ucp =404;
}

# Deny private key material (nginx ignores .htaccess):
location ^~ /wp-content/uploads/vixns-commerce-profile-ucp/private/ {
    deny all;
    return 403;
}
`

== Frequently Asked Questions ==

= How do I serve /.well-known/ucp? =

See the nginx example under Installation. Do not apply www↔apex redirects to this URI — UCP platforms do not follow 3xx on the profile URL.

= Web Bot Auth =

Use: `Signature-Agent: sig1="https://yoursite/.well-known/ucp";type=jwks_uri`

Omitting `type` defaults to `directory`, which does not read this static profile.

= Catalog REST =

Base: `/wp-json/ucp/v1` — POST `/catalog/search`, `/catalog/lookup`, `/catalog/product`.
Requires header: `UCP-Agent: profile="https://yoursite/.well-known/ucp"`.
There is no WordPress cookie auth on these routes (agent discovery). Disable Catalog REST in settings if you do not want them.

= Where are private keys stored? =

Default: `wp-content/uploads/vixns-commerce-profile-ucp/private/`. Prefer a path outside the document root via the `vixns_ucp_private_key_dir` filter. On nginx, always deny the default directory explicitly.

= Is this an official Universal Commerce Protocol plugin? =

No. It is developed by Vixns as a third-party WooCommerce integration.

== Changelog ==

= 0.4.0 =
* Renamed for WordPress.org trademark clarity (slug vixns-commerce-profile-ucp).
* Private keys and feed default under uploads/{slug}/; tightened write allowlist to .well-known + uploads plugin dir.

= 0.3.0 =
* Signing keys[] (EdDSA/ES256), rotate/revoke, WBA jwks_uri documentation.
* Path allowlist for profile/feed writes; HTTPS-only canonical host / probe.
* Test-only failure filters gated behind VIXNS_UCP_TESTING.

= 0.2.0 =
* Catalog REST: search, lookup, product; profile advertises services + catalog capabilities.

= 0.1.0 =
* Initial release: profile generation, dual scheduler, WP-CLI, admin status/probe, optional JSONL feed.
