{
  "name": "xpay for WooCommerce",
  "slug": "xpay-woocommerce",
  "version": "0.1.0",
  "download_url": "https://install.xpay.sh/woocommerce/xpay-woocommerce-0.1.0.zip",
  "latest_download_url": "https://install.xpay.sh/woocommerce/latest.zip",
  "changelog_url": "https://install.xpay.sh/woocommerce/CHANGELOG.md",
  "requires": "6.2",
  "requires_php": "7.4",
  "wc_requires": "7.0",
  "tested": "6.7",
  "wc_tested": "9.4",
  "homepage": "https://xpay.sh/sellers/woocommerce",
  "sections": {
    "description": "Put your WooCommerce catalog inside ChatGPT, Claude, Gemini, and Perplexity. Live prices, live stock, cart deeplinks into your existing checkout. Free until your first AI-driven sale.",
    "changelog": "## [0.1.0] — 2026-05-14\n\n### Added\n\n- WordPress plugin scaffold targeting WooCommerce 7.0+ on WP 6.2+ / PHP 7.4+.\n- Discovery files served on the merchant's domain:\n  - `/llms.txt` — plain-text guide for AI shopping agents\n  - `/.well-known/agentic-commerce.json` — structured handoff descriptor pointing at the xpay-hosted catalog and cart endpoints\n- JSON-LD injection on PDP / shop / homepage: `Product`, `Offer`, `BuyAction`, `ItemList`, with conflict detection against Yoast / Rank Math / WooCommerce core schemas.\n- `robots.txt` allowlist for GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Google-Extended, Applebot-Extended, CCBot — respects merchants' existing rules and never overrides explicit blocks.\n- Cart deeplink handler: `/?xpay_cart=<JWT>` validates the signed payload, populates `WC()->cart`, redirects to `wc_get_checkout_url()`. Orders are tagged with `_xpay_agent_attribution` meta on the WC order so merchants can attribute revenue.\n- Webhook resyncs on `woocommerce_update_product`, `woocommerce_new_product`, `woocommerce_delete_product`, stock changes — debounced via `wp_schedule_single_event` to avoid hammering the backend during bulk imports.\n- Admin page at **Settings → xpay**: nonce-protected Connect flow, status panel, \"Re-run audit\" button, audit-readiness checklist that mirrors the eight checks from `scripts/seller-audit/audit.py`.\n- Optional `[xpay-buy]` shortcode + Gutenberg block — gated by an admin toggle, default OFF in v1.\n- Configuration overrides for dev / InstaWP testing: `XPAY_WC_API_BASE_OVERRIDE`, `XPAY_WC_AGENT_COMMERCE_OVERRIDE`, `XPAY_WC_ONBOARD_URL_OVERRIDE`.\n\n### Distribution\n\n- Self-hosted via `https://install.xpay.sh/woocommerce/latest.zip` (S3 + CloudFront, isolated from `widget.xpay.sh` to protect the chat-widget publishers).\n- Downloads served with `Content-Disposition: attachment; filename=\"xpay_woocommerce_plugin_{version}.zip\"`, HSTS, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer`.\n\n### Known limitations (v0.1)\n\n- Cart-token HMAC uses `sha256(api_key)` as the shared secret. v0.2 will move to asymmetric signing so the backend never needs symmetric-key knowledge.\n- WC REST credentials are stored plaintext in DynamoDB. v0.2 wraps them with KMS-encrypted envelopes.\n- `audit.run` only queues a placeholder; v0.2 wires it to an SQS-driven worker that invokes `scripts/seller-audit/audit.py`.\n- Optional on-site widget is gated OFF by default — promote to ON once shaken-out on real themes.\n"
  },
  "released_at": "2026-05-14T05:51:31Z"
}