=== MercatorOS for WooCommerce ===
Contributors: mercatoros
Tags: woocommerce, b2b, credit, net-30, checkout, mercatoros
Requires at least: 6.0
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 2.0.2
License: GPL-2.0+

The MercatorOS commerce-intelligence runtime for WooCommerce — ships with the creditOS module and loads additional product modules as your account unlocks them.

== Description ==

MercatorOS for WooCommerce is a single plugin that hosts every MercatorOS product module your store subscribes to. On boot it calls the MercatorOS API for the list of modules enabled on your account and only lights those up — keeping your store's hook surface minimal.

Bundled today:

* **creditOS** — B2B credit scoring + prepay / block gates at checkout.
  * Real-time decision on every checkout (allow / require prepay / block).
  * Forces a prepay gateway (hides Net-30 / BACS) for higher-risk customers.
  * Blocks C4-tier customers with a configurable message.
  * **Fails OPEN** on any network error (500 ms hard timeout) so the store keeps converting during MercatorOS outages.

Future modules (inventoryOS, catalogOS, …) install automatically via plugin updates — you don't re-install anything when a new product ships; the registry picks them up as soon as your account includes them.

Order and customer events stream to MercatorOS via signed REST calls so the score always reflects the freshest behavior.

== Requirements ==

* WooCommerce 8.0+
* PHP 7.4+
* A MercatorOS account with a WooCommerce store provisioned (API key + API secret available under **Settings → Stores** in your MercatorOS dashboard).

== Installation ==

1. Upload the `mercatoros-woo` folder to `/wp-content/plugins/` or install via the admin Plugins screen.
2. Activate "MercatorOS for WooCommerce".
3. Open **WooCommerce → MercatorOS**. The **API base URL** defaults to `https://api.mercatoros.com`; add your **API key** and **API secret**.
4. Click **Test connection**. You should see a green check.
5. (Optional) Click **Sync now** to pull dashboard commands or run a full local backfill when the queue is empty.

== Module architecture ==

The plugin ships with a **module registry**. Each module declares:

* Its id (e.g. `creditos.customers`, `creditos.orders`, `creditos.checkout_gate`).
* The WooCommerce hooks it subscribes to (data modules).
* The REST endpoints it accepts inbound decisions on (decision modules).

On each plugin load, the registry calls `GET /v1/modules/enabled` (cached for 1 hour) and activates only modules in the response. A store subscribed to creditOS gets the creditOS modules; a store that later adds inventoryOS automatically picks up inventoryOS modules on the next cache cycle — no plugin reinstall.

== Security ==

* All outbound requests are signed with HMAC-SHA256 over `"${timestamp}.${body}"` using your API secret.
* The secret is stored in `wp_options` and never leaves your server.
* Inbound decision webhooks from MercatorOS are verified with HMAC-SHA256 before any customer metafield is updated.

== Changelog ==

= 2.0.2 =
* **Update channel no longer HMAC-gated.** `GET /v1/plugins/mercatoros-woo/latest` is now public (matches WordPress norms and the pre-existing public zip URL). "Check for updates now" works before the merchant has configured any credentials, and transient network blips no longer blame the API key.
* **Updates card error copy:** now points at the actual culprit (outbound HTTPS + host firewall) instead of telling the merchant to re-verify their key.
* **Settings lock-with-edit pattern:** API base URL, API key, and API secret render read-only when a value is saved, behind a small "Edit" button. First install stays frictionless (empty fields are editable); post-save the fields can't be clobbered by a stray paste.
* **Admin layout:** Subscription card moved below Updates so the most-used controls (API settings → Connection → Sync → Updates) stay at the top.

= 2.0.1 =
* Fix: the admin "Open Dashboard" button's fallback URL pointed at `dashboard.mercatoros.com/login`, a host that does not exist. When the SSO handshake failed for any reason, the browser hit a DNS error. Fallback now goes to `https://mercatoros.com/dashboard/login` (the real dashboard login page).

= 2.0.0 =
* Rebranded from "creditOS for WooCommerce" to the umbrella "MercatorOS for WooCommerce" plugin.
* New module-registry architecture. CreditOS behaviour ships as three modules (`creditos.customers`, `creditos.orders`, `creditos.checkout_gate`) that the registry activates when the MercatorOS API reports the account subscribes to creditOS. Future products plug in under `inventoryos.*`, `catalogos.*`, etc.
* Option keys, cron hooks, transients, REST routes, HMAC headers renamed `creditos_*` → `mercatoros_*` / `X-Mercatoros-*` / `mercatoros/v1`. Slug + directory now `mercatoros-woo`; upgrading from v1.x requires uninstall + install.
* Decision responses are now read from the Phase-1 `{ product_id, decision }` envelope; other-product envelopes are rejected inside the creditOS CheckoutGate module.

= 1.0.6 (legacy creditos-woo) =
* Final release of the creditos-woo branch. Superseded by mercatoros-woo v2.0.0.

= 1.0.0 (legacy creditos-woo) =
* Initial release — Session 12, April 2026.
