=== SettleBolt for WooCommerce ===
Contributors: settlebolt
Tags: woocommerce, payments, stablecoin, crypto, usdc
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.1.18
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept stablecoin and native ETH payments in WooCommerce through SettleBolt hosted checkout.

== Description ==

SettleBolt for WooCommerce adds a hosted checkout payment method to WooCommerce.

At checkout, the plugin creates a SettleBolt payment link for the WooCommerce order total and redirects the customer to SettleBolt hosted checkout. SettleBolt watches the chain. When the on-chain payment confirms, SettleBolt sends a signed webhook back to WordPress and the plugin marks the WooCommerce order paid.

SettleBolt is non-custodial software. The plugin never stores private wallet keys and never touches customer funds.

== External services ==

This plugin connects to the SettleBolt API at `https://api.settlebolt.com` to create hosted crypto payment links, connect the WooCommerce store, register webhook endpoints, verify plugin keys, and simulate demo payments.

During connection setup, the plugin sends the store URL, webhook URL, plugin version, WordPress version, WooCommerce version, and a short-lived connection code to SettleBolt. SettleBolt returns a merchant-specific plugin key and webhook signing secret that are saved in WordPress admin settings.

During checkout, the plugin sends order metadata needed to create a payment link: WooCommerce order number, order amount, currency, selected asset and chain, admin order URL, customer billing email, and customer billing name. SettleBolt returns a hosted checkout URL.

When an on-chain payment is confirmed, SettleBolt sends a signed webhook to the store webhook URL. The plugin verifies the signature before updating the WooCommerce order.

Service provider: SettleBolt

Service URL: https://settlebolt.com

API URL: https://api.settlebolt.com

Privacy policy: https://settlebolt.com/privacy/

Terms: https://settlebolt.com/terms/

== Requirements ==

* WordPress with WooCommerce.
* Store currency must be EUR.
* A SettleBolt Pro or Business account with API access and webhooks.
* A verified receiving wallet in SettleBolt on the chain you select.
* A SettleBolt Pro or Business dashboard login. The Connect SettleBolt button creates the plugin key with these scopes:
  * payment_links:create
  * webhooks:write
* A public HTTPS WordPress site so the plugin can register its webhook endpoint automatically.

== Installation ==

1. Zip the `settlebolt-for-woocommerce` folder.
2. In WordPress Admin, go to Plugins, Add New, Upload Plugin.
3. Upload the zip and activate it.
4. Click Settings on the SettleBolt plugin row, or go to WooCommerce, Settings, Payments, SettleBolt.
5. Click Connect SettleBolt.
6. Approve the store in the SettleBolt dashboard.
7. WordPress saves the plugin key and webhook signing secret automatically.
8. Enable the gateway, then pick a default asset and chain.
9. Confirm the SettleBolt settings page says the gateway is linked to the correct merchant account and webhook configured.

== Security notes ==

* Prefer the Connect SettleBolt button so the plugin key and webhook secret are saved automatically through a one-time code exchange.
* Store the SettleBolt plugin key and webhook secret only in WordPress admin settings.
* Every WooCommerce store must use its own merchant-specific SettleBolt plugin key.
* The gateway is hidden until SettleBolt verifies the plugin key through `/api/agent/me`.
* The verified key must belong to an active merchant account with verified owner email, an active paid subscription, and the `payment_links:create` and `webhooks:write` scopes.
* Do not place the plugin key in JavaScript, theme files, or frontend code.
* The plugin verifies SettleBolt webhook signatures using the raw request body.
* The plugin rejects stale webhook timestamps.
* Orders are not marked paid until a signed `payment.confirmed` webhook arrives.
* Underpaid payments are recorded as an order note and do not mark the order paid.

== Screenshots ==

1. SettleBolt gateway settings with one-click connection, mode, asset, chain, and diagnostics.
2. WooCommerce checkout with SettleBolt selected as the payment method.
3. SettleBolt hosted checkout showing the exact crypto amount and destination wallet.
4. WooCommerce order sidebar showing SettleBolt checkout and webhook details.

== Changelog ==

= 0.1.18 =
* Lock live stablecoin checkout amounts to EUR/USD instead of treating EUR and USD as equal.
* Credit quote-matched stablecoin payments using the locked raw amount and EUR value.
* Keep the gateway available while refreshing merchant verification in the background.
* Clear pending connection refresh work when the plugin is deactivated.
* Ignore signed merchant payment events that do not belong to a WooCommerce order.
* Regenerate checkout links when an order total changes and retain older link-to-order mappings.
* Require payment identity, asset, and chain fields before completing an order.
* Make one-click reconnect activation atomic with the successful code exchange.
* Support payment-link lookup with both HPOS and legacy WooCommerce order storage.
* Declare WordPress 6.5 and WooCommerce 10.9.4 compatibility in the plugin headers.

= 0.1.17 =
* Prefix plugin classes for WordPress.org Plugin Check compatibility.
* Escape checkout description output after paragraph formatting.
* Limit plugin tags to five and document intentional atomic database mutexes.

= 0.1.16 =
* Add a formal external services disclosure for WordPress.org review.
* Add WordPress.org screenshot captions for the plugin listing.
* Expand settings diagnostics with WordPress, WooCommerce, HPOS, HTTPS, and tunnel status.

= 0.1.15 =
* Add an atomic per-order checkout creation lock to prevent duplicate SettleBolt links on double-submit or retry.
* Hide live checkout on temporary tunnel hostnames while still allowing demo-mode local testing.
* Mark compatibility with WordPress 7.0 and WooCommerce 10.9.3 after validation.

= 0.1.14 =
* Add one-click WooCommerce connection support with dashboard approval and automatic plugin key/webhook setup.
* Add health and diagnostics hardening for live WooCommerce webhook delivery.

= 0.1.13 =
* Add settings diagnostics for connection, webhook, last checkout, last webhook, and last API error.
* Add a SettleBolt order box with checkout details and a demo payment simulator.
* Send WooCommerce order and customer metadata to SettleBolt payment links.
* Show demo mode clearly in WooCommerce Blocks checkout.

= 0.1.12 =
* Add Live and Demo gateway modes for full checkout testing without moving funds.
* Send the selected mode to SettleBolt when creating WooCommerce payment links.
* Require webhook mode to match the order mode before marking an order paid.
* Label demo order notes clearly so test purchases stay separate from live payments.

= 0.1.11 =
* Register the Connect SettleBolt and webhook entrypoints at plugin load time so WordPress admin-post and wc-api requests cannot miss the handler.

= 0.1.10 =
* Allow signed confirmed or overpaid native ETH events to complete when SettleBolt intentionally omits amount_eur_cents.
* Keep underpaid events fail-safe when amount_eur_cents is absent.
* Replace the webhook event claim with a direct database insert mutex.

= 0.1.9 =
* Store one-click connection error notices in per-admin transients instead of URL text.
* Add an atomic webhook event claim before mutating WooCommerce orders.
* Add fail-safe amount validation to signed payment webhook handling.
* Avoid live SettleBolt API calls during checkout availability rendering by using cached verified connection state.

= 0.1.8 =
* Harden plugin reliability so checkout, settings, webhook, and Blocks paths fail safely instead of crashing WordPress.
* Restrict API calls to SettleBolt API hosts by default and validate returned checkout URLs.
* Add bounded HTTP response sizes, no redirect following, stricter webhook signatures, and safer connect-result validation.

= 0.1.7 =
* Add one-click Connect SettleBolt setup from WooCommerce to the SettleBolt dashboard.
* Exchange a short-lived one-time code so plugin keys and webhook secrets are never placed in browser URLs.

= 0.1.6 =
* Add automatic WooCommerce webhook endpoint creation after saving a valid plugin key.
* Require the webhooks:write scope for WooCommerce plugin keys.

= 0.1.5 =
* Rename the WooCommerce credential to SettleBolt plugin key.
* Show active subscription validation in the settings screen.
* Read explicit subscription status from SettleBolt connection checks.

= 0.1.4 =
* Add a Settings link to the WordPress Plugins screen for direct key and webhook setup.

= 0.1.3 =
* Gate checkout behind live SettleBolt plugin key verification.
* Require each store to use a merchant-specific plugin key with payment_links:create.
* Show linked merchant and key name in WooCommerce settings.

= 0.1.2 =
* Fix WooCommerce Blocks compatibility by matching the base class settings property visibility.

= 0.1.1 =
* Hide checkout until the webhook secret, HTTPS webhook URL, valid API base, and supported asset/chain pair are configured.
* Match Checkout Block availability to classic checkout availability.
* Verify webhook signature timestamps and bind payment events back to the order asset and chain.
* Narrow the required Agent API scope to payment_links:create.

= 0.1.0 =
* Initial hosted checkout gateway.
* Classic WooCommerce checkout support.
* WooCommerce Checkout Block support.
* Signed SettleBolt webhook verification.
* Idempotent order payment handling.
