=== ShopRelay Connector for WooCommerce ===
Contributors: raviswa
Tags: woocommerce, abandoned-cart, whatsapp, cart-recovery, connector
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

ShopRelay connects WooCommerce carts to Autom8 for WhatsApp abandoned-cart recovery. Order packing uses native WooCommerce webhooks (not this plugin).

== Description ==

**Who this is for:** Stores running **WooCommerce on WordPress**. If you sell on **Shopify**, do **not** install this plugin — connect Autom8 from [Autom8 Settings → Integrations → Shopify](https://app.autom8.works) (install the Autom8 Shopify app / Partner install link). Other storefronts (Wix, Dukaan, custom) also use Autom8 Settings integrations, not this WordPress plugin.

**Service dependency:** This plugin requires an [Autom8](https://autom8.works) account ([Terms](https://autom8.works/terms), [Privacy](https://autom8.works/privacy)). Cart snapshots and contact data are sent to the Autom8 API URL you configure (default `https://api.autom8.works`). The plugin itself has no license key, trial, or feature paywall — all built-in connector features are available once you enter your Autom8 credentials in wp-admin.

**ShopRelay Connector for WooCommerce** is a thin connector between your WooCommerce store and [Autom8](https://autom8.works). It helps you recover abandoned carts via WhatsApp and keeps Autom8 in sync with cart activity.

**What this plugin does**

* Debounced cart snapshots sent to Autom8 after the cart is idle (default ~2.5 minutes)
* Captures checkout phone/email (checkout blur, logged-in customer)
* Marks carts converted on thank-you / payment complete
* Signed cart recovery links (`autom8_cart_token` + `autom8_sig`) restore the shopper's cart

**What this plugin does NOT do**

* Work with Shopify, Wix, Dukaan, or non-WooCommerce storefronts (use the matching Autom8 Settings integration instead)
* Order packing or fulfillment — configure **native WooCommerce webhooks** (Order created / Order updated) in WooCommerce → Settings → Advanced → Webhooks pointing to your Autom8 API URL
* Product catalog sync — managed in Autom8 Settings separately (WooCommerce REST keys in Autom8, not in this plugin)
* Storefront branding — no “powered by” links are injected on the public site

You need an Autom8 account, restaurant (tenant) UUID, and the **order/cart webhook HMAC secret** from Autom8 Settings → Integrations → WooCommerce.

= Requirements =

* WordPress **6.0+** (covers WordPress 6.x and 7.x — the large majority of installs; tested through **7.1**)
* WooCommerce **6.0+** (HPOS / Cart & Checkout Blocks declared when WooCommerce exposes FeaturesUtil; typically WC 7.1+)
* PHP 7.4+
* Products with **SKUs** set (Autom8 maps SKU to catalog items)

= Which WordPress versions are supported? =

**Requires at least 6.0**, **Tested up to 7.1**. WordPress 7.x currently has the highest install share; WordPress 6.x remains widely used. This plugin supports both. WordPress 5.x is outside the supported range (WooCommerce itself has largely moved on).

== Installation ==

1. Install from **Plugins → Add New** (WordPress.org) or upload the plugin folder to `/wp-content/plugins/`.
2. Activate **ShopRelay Connector for WooCommerce** (WooCommerce must be active).
3. Go to **WooCommerce → ShopRelay** and enter:
   * Autom8 API base URL (default `https://api.autom8.works`)
   * Restaurant / tenant UUID from Autom8 Settings
   * **Order webhook secret (HMAC)** — must match Autom8 `order_webhook_secret` (NOT the WooCommerce Consumer Secret)
4. Enable cart capture and set idle debounce if needed.
5. In Autom8 Settings, enable **Abandoned cart WhatsApp recovery** for the same tenant.
6. For order packing: in **WooCommerce → Settings → Advanced → Webhooks**, create `order.created` and `order.updated` webhooks to Autom8's `/webhook` URL using the same HMAC secret.

== Frequently Asked Questions ==

= Do I need a paid Autom8 plan for the plugin to activate? =

No. The WordPress plugin has no license gate. You need Autom8 API credentials for the *service* to receive cart events. Without credentials, the plugin simply does not send data.

= What is the difference between the HMAC secret and the Consumer Secret? =

This plugin stores only the **HMAC secret** (order/cart webhook secret) in WordPress. WooCommerce **Consumer Key / Consumer Secret** (`cs_…`) are configured in **Autom8 Settings** for REST API calls (stock push, SKU reconcile). Do not paste `cs_…` into the plugin HMAC field.

= Why do recovery links include autom8_sig? =

When the webhook secret is configured, every cart recovery URL must include a valid HMAC signature. Links without `autom8_sig` or with a wrong signature are rejected — this prevents guessing cart tokens.

= Does this plugin send order webhooks? =

No. Orders are delivered by **native WooCommerce webhooks** you create in WooCommerce admin. This plugin only sends **cart-event** payloads for abandoned-cart recovery.

= What data is sent to Autom8? =

See the **Privacy** section below. Summary: cart contents (SKU, qty, name), contact info when captured, cart token, recovery URL, and conversion events.

= Do I need SKUs on products? =

Yes. Autom8 matches WooCommerce line items to your catalog by SKU (`retailer_id` or external SKU map).

= Will this work on WordPress 6.x stores? =

Yes. Minimum WordPress is 6.0. We also test against WordPress 7.1 (currently the most common major line). Use WooCommerce 6.0 or newer.

= I sell on Shopify — should I install this? =

**No.** This WordPress.org plugin is **only for WooCommerce**. Shopify merchants should open [Autom8 Settings → Integrations → Shopify](https://app.autom8.works) and install the **Autom8 Shopify app** (Partner / App Store install link). Do not paste Shopify credentials into this plugin.

= What about Wix, Dukaan, or a custom storefront? =

Use the matching integration under **Autom8 Settings → Integrations**. This plugin only runs inside WordPress + WooCommerce.

== Privacy ==

This plugin transmits **personal and order-related data** from your WordPress site to a **third-party service** (Autom8) at the API base URL you configure (default `https://api.autom8.works`).

**Data that may leave your site**

* Customer **phone number** and **email address** (when entered at checkout or available from the logged-in customer)
* Customer **name** (when available)
* **Cart contents**: product SKUs, quantities, product names, cart total
* **Cart token** and **signed recovery URL** (for WhatsApp recovery links)
* **Conversion events** when an order completes (cart token only)

**When data is sent**

* After the cart is unchanged for the configured idle period (cart snapshot)
* When checkout contact fields are captured (stored locally in session, included in the next snapshot)
* When the customer completes checkout (converted event)
* When the customer opens a signed recovery link (processed on your site; no new outbound call for the click itself)

**Third-party processing**

Autom8 processes this data to run abandoned-cart WhatsApp messaging and (via separate native WooCommerce order webhooks you configure) order fulfillment workflows. Autom8 is operated separately from your WordPress host.

**Your responsibility as store owner**

* Disclose in your **store privacy policy** that customer contact and cart data are shared with Autom8 for WhatsApp recovery and order processing
* Ensure you have a lawful basis to contact customers via WhatsApp (consent / legitimate interest per your jurisdiction)
* Configure only the Autom8 API URL and credentials you trust

This plugin does **not** send full payment card numbers or raw payment gateway payloads to Autom8.

== Development ==

Source code (human-readable PHP/JS, no obfuscation) ships in this plugin ZIP. Plugin details: [autom8.works/faqs](https://autom8.works/faqs/). Author / company: [autom8.works](https://autom8.works).

This plugin does **not** download or execute remote PHP/JS from Autom8. Outbound calls are JSON cart-event POSTs over HTTPS with HMAC signatures only. All storefront scripts ship inside the plugin ZIP (`assets/js/checkout-capture.js`).

== Changelog ==

= 1.0.4 =
* Distinct Plugin URI (https://autom8.works/faqs/) and Author URI (https://autom8.works)

= 1.0.3 =
* Directory listing name: ShopRelay Connector for WooCommerce (requested slug shoprelay-connector-for-woocommerce)
* Plugin URI and development URL point to https://autom8.works
* Declare Requires Plugins: woocommerce

= 1.0.2 =
* Broader version compatibility: WordPress 6.0+ required, tested through WordPress 7.1 (highest install share)
* WooCommerce requires at least 6.0; tested up to WooCommerce 11.1
* Harden cart total calculation for older WooCommerce APIs
* Enforce HTTPS-only Autom8 API base URL; document source code and that no remote executable code is loaded
* Clarify audience: WooCommerce/WordPress only; Shopify and other platforms use Autom8 Settings integrations

= 1.0.1 =
* WordPress.org submission prep: readme compliance, version alignment, service-dependency disclosure
* Fix missing `<?php` opening tag in the main plugin file (source was printed on every page)

= 1.0.0 =
* Initial release
* Abandoned-cart cart-event sync to Autom8
* Signed cart recovery links (HMAC required when secret configured)
* Checkout contact capture and converted suppression on thank-you
* HPOS and Cart/Checkout Blocks compatibility declarations

== Upgrade Notice ==

= 1.0.4 =
Plugin URI and Author URI are now separate pages on autom8.works.

= 1.0.3 =
Renamed for WordPress.org listing. Settings move to WooCommerce → ShopRelay. Existing Autom8 API credentials are unchanged.

= 1.0.2 =
Compatibility update for WordPress 6.x–7.1 and WooCommerce 6.0–11.1. Recommended before WordPress.org review.
