Changeset 3730094

emporiqa/tags/1.2.0/admin/css/emporiqa-admin.css

-              r3506790
+              r3730094
         color: #1d2327;
+}
+/* Ready-made rules: On / Not added */
+.emporiqa-rule-state {
+        display: inline-block;
+        padding: 2px 8px;
+        border-radius: 3px;
+        background: #f0f0f1;
+        color: #50575e;
+        font-weight: 600;
+        vertical-align: middle;
+}
+.emporiqa-rule-state.emporiqa-rule-on {
+        background: #edfaef;
+        color: #00701a;
+}

emporiqa/tags/1.2.0/admin/js/emporiqa-admin.js

-              r3601468
+              r3730094
         var syncRunning   = false;
         var currentXhr    = null;
+        // Consecutive waits for one batch before it counts as failed.
+        var MAX_BATCH_WAITS = 30;
         /**
 …
                                 var totalItems    = productCount + pageCount;
+                                // Build work queue: for each session, calculate pages.
+                                // Build work queue: one entry per session. Each entry is
+                                // paged by id (after_id) until the server says it is done,
+                                // so items changing mid-sync never shift the pages.
                                 var workQueue    = [];
                                 var sessionCount = sessions.length;
                                 var s, itemCount, totalPages, p;
+                                var s;
                                 for ( s = 0; s < sessionCount; s++ ) {
-                                        itemCount = 0;
-                                        if ( 'products' === sessions[ s ].entity ) {
-                                                itemCount = productCount;
-                                        } else if ( 'pages' === sessions[ s ].entity ) {
-                                                itemCount = pageCount;
+                                        }
-                                        totalPages = Math.ceil( itemCount / itemsPerBatch );
                                         addLogEntry(
                                                 sprintf(
 …
                                         );
+                                        for ( p = 1; p <= totalPages; p++ ) {
+                                                        workQueue.push(
+                                                                {
+                                                                        entity: sessions[ s ].entity,
+                                                                        language: sessions[ s ].language,
+                                                                        session_id: sessions[ s ].session_id,
+                                                                        page: p,
+                                                                        items_per_batch: itemsPerBatch
+                                                                }
+                                                        );
+                                        }
+                                        workQueue.push(
+                                                {
+                                                        entity: sessions[ s ].entity,
+                                                        language: sessions[ s ].language,
+                                                        session_id: sessions[ s ].session_id,
+                                                        after_id: 0,
+                                                        items_per_batch: itemsPerBatch,
+                                                        waits: 0
+                                                }
+                                        );
+                                }
 …
                                         var work = workQueue[ batchIndex ];
-                                        batchIndex++;
                                         currentXhr = $.post(
 …
                                                         language: work.language,
                                                         session_id: work.session_id,
                                                         page: work.page,
+                                                        after_id: work.after_id,
                                                         items_per_batch: work.items_per_batch
+                                                }
                                         ).done(
                                                 function ( batchResponse ) {
+                                                        var waitSeconds = batchResponse.success && batchResponse.data ? parseInt( batchResponse.data.retry_after, 10 ) || 0 : 0;
+                                                        if ( waitSeconds > 0 && work.waits < MAX_BATCH_WAITS ) {
+                                                                // Emporiqa asked to wait (its queue is full): send the
+                                                                // same batch again; the server holds it as pending.
+                                                                work.waits++;
+                                                                addLogEntry(
+                                                                        sprintf(
+                                                                                i18n.batchWait || 'Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds.',
+                                                                                work.entity,
+                                                                                waitSeconds
+                                                                        ),
+                                                                        'warning'
+                                                                );
+                                                                setTimeout( processBatch, waitSeconds * 1000 );
+                                                                return;
+                                                        }
+                                                        work.waits = 0;
                                                         if ( batchResponse.success && batchResponse.data ) {
                                                                 var batchProcessed = batchResponse.data.processed || 0;
 …
                                                         if ( totalItems > 0 ) {
+                                                                updateProgress( ( processed / totalItems ) * 100 );
+                                                                updateProgress( Math.min( 99, ( processed / totalItems ) * 100 ) );
+                                                        }
+                                                        var batchData = ( batchResponse.success && batchResponse.data ) || {};
+                                                        var lastId    = parseInt( batchData.last_id, 10 ) || 0;
+                                                        if ( batchData.done || lastId <= work.after_id ) {
+                                                                batchIndex++;
+                                                        } else {
+                                                                work.after_id = lastId;
+                                                        }
 …
                                                                 );
+                                                        }
+                                                        // Where the next batch starts is unknown, so the rest
+                                                        // of this session is skipped; the failure above keeps
+                                                        // the session from being finalized.
+                                                        batchIndex++;
                                                         processBatch();
+                                                }

emporiqa/tags/1.2.0/assets/js/emporiqa-cart.js

-              r3491860
+              r3730094
          * Automatically updates the nonce from each response to keep
          * long-lived browser sessions working beyond the default 24h expiry.
+         *
+         * @param {string}      action The WordPress AJAX action name.
+         * @param {Object|null} data   Additional key-value pairs for the request body.
+         * A nonce refusal is retried once with the fresh nonce it carries: a page
+         * served from a full-page cache can hold an expired nonce, or a guest's
+         * nonce for a signed-in shopper, and the refused request changed nothing.
+         *
+         * @param {string}      action  The WordPress AJAX action name.
+         * @param {Object|null} data    Additional key-value pairs for the request body.
+         * @param {boolean}     retried True on the retry after a nonce refusal.
          * @return {Promise<Object>} Parsed JSON response matching the EmporiqaCartHandler spec.
          */
         function emporiqaAjax( action, data ) {
+        function emporiqaAjax( action, data, retried ) {
                 var formData = new FormData();
                 formData.append( 'action', action );
 …
                                 config.nonce = result.nonce;
+                        }
+                        return result;
+                } );
+        }
+        /**
+         * Trigger WooCommerce mini-cart fragment refresh after cart changes.
+         */
+        function refreshCartFragments() {
+                        if ( ! retried && result && result.success === false && result.code === 'invalid_nonce' && result.nonce ) {
+                                return emporiqaAjax( action, data, true );
+                        }
+                        return result;
+                } );
+        }
+        /**
+         * Tell the page's mini-cart that the cart changed.
+         *
+         * Classic themes refresh their cart fragments on wc_fragment_refresh.
+         * The Mini-Cart block of block themes ignores that and refetches the
+         * cart on wc-blocks_added_to_cart / wc-blocks_removed_from_cart.
+         *
+         * @param {boolean} removed True when items were removed (remove, clear).
+         */
+        function refreshCartFragments( removed ) {
                 if ( typeof jQuery !== 'undefined' ) {
                         jQuery( document.body ).trigger( 'wc_fragment_refresh' );
+                }
+                if ( typeof document !== 'undefined' && document.body && typeof window.Event === 'function' ) {
+                        document.body.dispatchEvent(
+                                new window.Event( removed ? 'wc-blocks_removed_from_cart' : 'wc-blocks_added_to_cart', { bubbles: true } )
+                        );
+                }
+        }
 …
                 return emporiqaAjax( 'emporiqa_remove_from_cart', data ).then( function( result ) {
                         if ( result.success ) {
                                 refreshCartFragments();
+                                refreshCartFragments( true );
+                        }
                         return result;
 …
                 return emporiqaAjax( 'emporiqa_clear_cart' ).then( function( result ) {
                         if ( result.success ) {
                                 refreshCartFragments();
+                                refreshCartFragments( true );
+                        }
                         return result;

emporiqa/tags/1.2.0/changelog.txt

-              r3678094
+              r3730094
 Older Emporiqa releases. The two most recent versions are in readme.txt.
+= 1.1.9 =
+* Fix: a full sync now finalizes only when every batch succeeds, so a failed batch can no longer drop items still present in your store from the chat's index. Nothing in your WooCommerce store was ever modified.
+* Fix: variable products with parent-managed stock no longer over-report quantity, and decimal quantities are no longer truncated in the cart.
 = 1.1.8 =

emporiqa/tags/1.2.0/cli/class-emporiqa-cli.php

-              r3601468
+              r3730094
                 $synced   = 0;
                 $errors   = 0;
                 $page     = 1;
+                $after_id = 0;
                 $per_page = 100;
+                // Keyset by id, not OFFSET: a product disabled mid-sync must not
+                // shift the pages and get a live one skipped (and then deleted from
+                // Emporiqa when the session completes).
                 while ( true ) {
                         $query_args = array(
+                                'status' => 'publish',
+                                'limit'  => $per_page,
+                                'page'   => $page,
+                                'type'   => Emporiqa_Admin::get_product_types(),
+                                'status'            => 'publish',
+                                'limit'             => $per_page,
+                                'orderby'           => 'ID',
+                                'order'             => 'ASC',
+                                'type'              => Emporiqa_Admin::get_product_types(),
+                                'emporiqa_after_id' => $after_id,
                         );
 …
+                        }
+                        $products = wc_get_products( $query_args );
+                        $products = Emporiqa_Sync::query_after_id(
+                                function () use ( $query_args ) {
+                                        return wc_get_products( $query_args );
+                                }
+                        );
                         if ( empty( $products ) ) {
                                 break;
 …
                         foreach ( $products as $product ) {
+                                $after_id  = max( $after_id, (int) $product->get_id() );
                                 $formatted = $formatter->format_product_consolidated( $product, $session_id );
                                 foreach ( $formatted as $item ) {
 …
                         wp_cache_flush();
-                        ++$page;
+                }
 …
                 $synced   = 0;
                 $errors   = 0;
                 $paged    = 1;
+                $after_id = 0;
                 $per_page = 100;
                 while ( true ) {
                         $query_args = array(
+                                'post_type'        => $post_types,
+                                'post_status'      => 'publish',
+                                'posts_per_page'   => $per_page,
+                                'paged'            => $paged,
+                                'suppress_filters' => false,
+                                'post_type'         => $post_types,
+                                'post_status'       => 'publish',
+                                'posts_per_page'    => $per_page,
+                                'orderby'           => 'ID',
+                                'order'             => 'ASC',
+                                'no_found_rows'     => true,
+                                'suppress_filters'  => false,
+                                'emporiqa_after_id' => $after_id,
                         );
 …
+                        }
+                        $pages = get_posts( $query_args );
+                        $pages = Emporiqa_Sync::query_after_id(
+                                function () use ( $query_args ) {
+                                        return get_posts( $query_args );
+                                }
+                        );
                         if ( empty( $pages ) ) {
                                 break;
 …
                         foreach ( $pages as $page ) {
+                                $after_id  = max( $after_id, (int) $page->ID );
                                 $formatted = $formatter->format_page_consolidated( $page, $session_id );
                                 if ( ! empty( $formatted ) ) {
 …
                         wp_cache_flush();
-                        ++$paged;
+                }

emporiqa/tags/1.2.0/emporiqa.php

-              r3678232
+              r3730094
  * Plugin Name: Emporiqa
  * Description: Integrates WooCommerce with Emporiqa chat assistant.
  * Version:     1.1.10
+ * Version:     1.2.0
  * Author:      Emporiqa
  * Author URI:  https://emporiqa.com
 …
  * Text Domain: emporiqa
  * Domain Path: /languages
  * Requires at least: 6.0
+ * Requires at least: 6.2
  * Tested up to: 7.1
  * Requires PHP: 7.4
  * Requires Plugins: woocommerce
  * WC requires at least: 8.0
  * WC tested up to: 10.9
+ * WC tested up to: 11.1
+ *
  * @package Emporiqa
 …
+}
 define( 'EMPORIQA_VERSION', '1.1.10' );
+define( 'EMPORIQA_VERSION', '1.2.0' );
 define( 'EMPORIQA_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'EMPORIQA_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 …
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-widget.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-tracking.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-signature.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-status.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-customer-prices.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-actions.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-cart-ajax.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-webhook.php';
 …
          */
         private Emporiqa_Order_Tracking $order_tracking;
+        /**
+         * Ready-made rules endpoints (Order status, customer prices, verify).
+         *
+         * @var Emporiqa_Actions
+         */
+        private Emporiqa_Actions $actions;
         /**
 …
                 $this->widget         = new Emporiqa_Widget();
                 $this->order_tracking = new Emporiqa_Order_Tracking();
+                $this->actions        = new Emporiqa_Actions();
                 $this->cart_ajax      = new Emporiqa_Cart_Ajax();
                 $this->order_webhook  = new Emporiqa_Order_Webhook();
 …
         private function init_hooks(): void {
                 add_action( 'woocommerce_init', array( $this, 'init_woocommerce_hooks' ) );
+                // Quantity tiers of the Tiered Price Table plugin, when it is active.
+                add_filter( 'emporiqa_price_tiers', array( 'Emporiqa_Formatter', 'tiered_price_table_tiers' ), 5, 2 );
                 // Page-save entry point. Inside the handler we skip when Polylang is
 …
                 add_action( 'woocommerce_new_product', array( $this, 'handle_product_created' ) );
                 add_action( 'woocommerce_update_product', array( $this, 'handle_product_updated' ) );
+                add_action( 'wp_trash_post', array( $this, 'handle_product_trashed' ) );
+                // Before WooCommerce's own wp_trash_post (priority 10) trashes the
+                // variations, so the variation deletes can still be found and sent.
+                add_action( 'wp_trash_post', array( $this, 'handle_product_trashed' ), 5 );
                 add_action( 'untrashed_post', array( $this, 'handle_product_untrashed' ) );
                 add_action( 'woocommerce_new_product_variation', array( $this, 'handle_variation_created' ) );
 …
          * wp_trash_post fires when a product is moved to trash. WooCommerce's
          * woocommerce_update_product does NOT fire on trash, so this is needed.
+         * Cannot go through format_product_consolidated because WooCommerce
+         * trashes child variations before this hook fires at priority 10.
+         * Runs at priority 5, before WooCommerce trashes the child variations at
+         * priority 10, so queue_product_delete() still sees them and deletes
+         * them too; afterwards get_children() no longer returns them.
+         *
          * @since 1.0.0

emporiqa/tags/1.2.0/includes/class-emporiqa-admin.php

-              r3678094
+              r3730094
          */
         private string $option_name = 'emporiqa_options';
+        /**
+         * Option holding what Emporiqa last said about ready-made rules.
+         */
+        public const RULES_STATUS_OPTION = 'emporiqa_rules_status';
         /**
 …
+                }
+                // The checkbox is on the page only where ready-made rules are offered;
+                // elsewhere a save keeps the stored value (on by default).
+                if ( isset( $input['order_tracking_shown'] ) ) {
+                        $sanitized['order_tracking'] = ! empty( $input['order_tracking'] );
+                } else {
+                        $existing                    = get_option( $this->option_name, array() );
+                        $sanitized['order_tracking'] = ! is_array( $existing ) || ! isset( $existing['order_tracking'] ) || (bool) $existing['order_tracking'];
+                }
                 $batch_size = absint( $input['batch_size'] ?? 25 );
                 if ( $batch_size < 1 || $batch_size > 100 ) {
 …
                                         <?php $this->render_connection_section( $options ); ?>
+                                        <?php $this->render_rules_section( $options ); ?>
                                         <?php $this->render_advanced_section( $options ); ?>
 …
+                }
+                $this->render_order_tracking_row();
+                // Where ready-made rules are offered, order tracking moves under
+                // Advanced as the old way; elsewhere it stays here as before.
+                if ( ! self::rules_status()['available'] ) {
+                        $this->render_order_tracking_row();
+                }
                 $this->render_section_close();
+        }
+        /**
+         * Render the Ready-made rules section: shown once Emporiqa has said, at
+         * connect or on Test connection, that this store has them.
+         *
+         * @since 1.2.0
+         *
+         * @param array $options Current options.
+         */
+        private function render_rules_section( array $options ): void {
+                $status = self::rules_status();
+                if ( ! $status['available'] ) {
+                        return;
+                }
+                $live          = in_array( 'order_status', $status['live'], true );
+                $address       = Emporiqa_Actions::base_url();
+                $platform_base = rtrim( (string) apply_filters( 'emporiqa_connect_base_url', 'https://emporiqa.com' ), '/' );
+                $this->render_section_open( 'emporiqa-section-rules', __( 'Ready-made rules', 'emporiqa' ), true );
+                ?>
+                <p style="margin:0 0 12px 0;color:#50575e;">
+                        <?php esc_html_e( 'Rules tell the chat what to do when a shopper asks for something specific. The rule below reads your WooCommerce orders through this plugin. Click Open in Emporiqa to test it and switch it on there. Rules that do not need your shop, such as return requests, are added in Emporiqa under Settings > Rules.', 'emporiqa' ); ?>
+                </p>
+                <?php if ( $live && ! empty( $options['order_tracking'] ) ) : ?>
+                        <div class="notice notice-info inline" style="margin:0 0 12px 0;">
+                                <p><?php esc_html_e( 'The Order status rule is on, so the old order tracking under Advanced is no longer needed. First remove its address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick Order tracking under Advanced and click Save Changes.', 'emporiqa' ); ?></p>
+                        </div>
+                <?php endif; ?>
+                <table class="form-table" role="presentation">
+                        <tr>
+                                <th scope="row"><label for="emporiqa_order_status_address"><?php esc_html_e( 'Order status address', 'emporiqa' ); ?></label></th>
+                                <td>
+                                        <?php if ( '' !== $address ) : ?>
+                                                <div class="emporiqa-readonly-field">
+                                                        <input type="text" id="emporiqa_order_status_address" value="<?php echo esc_attr( $address ); ?>" class="regular-text" readonly />
+                                                        <button type="button" class="button emporiqa-copy-btn" data-copy-target="emporiqa_order_status_address">
+                                                                <?php esc_html_e( 'Copy', 'emporiqa' ); ?>
+                                                        </button>
+                                                </div>
+                                                <p class="description"><?php esc_html_e( 'Emporiqa fills this in for you when you add the Order status rule. If it ever asks for the address, use this one.', 'emporiqa' ); ?></p>
+                                        <?php else : ?>
+                                                <p class="description"><?php esc_html_e( 'Your site is not served over https, so Emporiqa cannot call it. Switch the site to https (Settings > General), then come back here.', 'emporiqa' ); ?></p>
+                                        <?php endif; ?>
+                                </td>
+                        </tr>
+                        <tr>
+                                <th scope="row"><?php esc_html_e( 'Order status', 'emporiqa' ); ?></th>
+                                <td>
+                                        <?php if ( $live ) : ?>
+                                                <span class="emporiqa-rule-state emporiqa-rule-on"><?php esc_html_e( 'On', 'emporiqa' ); ?></span>
+                                        <?php else : ?>
+                                                <span class="emporiqa-rule-state"><?php esc_html_e( 'Not added', 'emporiqa' ); ?></span>
+                                        <?php endif; ?>
+                                        <a href="<?php echo esc_url( $platform_base . '/platform/rules/?add=order_status' ); ?>" class="button" target="_blank" rel="noopener noreferrer" style="margin-left:8px;">
+                                                <?php esc_html_e( 'Open in Emporiqa', 'emporiqa' ); ?>
+                                                <span class="dashicons dashicons-external" style="vertical-align:middle;font-size:14px;line-height:1;margin-left:2px;"></span>
+                                        </a>
+                                        <p class="description">
+                                                <?php esc_html_e( 'Answers "Where is my order?" from your WooCommerce orders. A shopper signed in to your shop only gives the order number; a guest also gives the email used for the order.', 'emporiqa' ); ?>
+                                        </p>
+                                        <p class="description">
+                                                <?php esc_html_e( 'On and Not added show what Emporiqa said at your last connect or Test connection (Sync tab). Run Test connection after changing a rule to refresh them.', 'emporiqa' ); ?>
+                                        </p>
+                                </td>
+                        </tr>
+                </table>
+                <?php
+                $this->render_section_close();
+        }
+        /**
+         * The old order tracking under Advanced, where ready-made rules are
+         * offered: its address and an on/off checkbox, labelled as replaced.
+         *
+         * @param array $options Current options.
+         */
+        private function render_legacy_order_tracking_rows( array $options ): void {
+                $tracking_url = rest_url( 'emporiqa/api/order/tracking' );
+                ?>
+                <tr>
+                        <th scope="row"><?php esc_html_e( 'Order tracking (old)', 'emporiqa' ); ?></th>
+                        <td>
+                                <input type="hidden" name="<?php echo esc_attr( $this->option_name ); ?>[order_tracking_shown]" value="1" />
+                                <label>
+                                        <input type="checkbox" name="<?php echo esc_attr( $this->option_name ); ?>[order_tracking]" value="1"
+                                                <?php checked( ! empty( $options['order_tracking'] ) ); ?> />
+                                        <?php esc_html_e( 'Answer order lookups at the old order tracking address.', 'emporiqa' ); ?>
+                                </label>
+                                <div class="emporiqa-readonly-field" style="margin-top:8px;">
+                                        <input type="text" id="order_tracking_url" value="<?php echo esc_attr( $tracking_url ); ?>" class="regular-text" readonly />
+                                        <button type="button" class="button emporiqa-copy-btn" data-copy-target="order_tracking_url">
+                                                <?php esc_html_e( 'Copy', 'emporiqa' ); ?>
+                                        </button>
+                                </div>
+                                <p class="description">
+                                        <?php esc_html_e( 'Replaced by the Order status rule above. Leave it on while your Emporiqa dashboard still has this address. To switch it off, first remove the address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick this and click Save Changes.', 'emporiqa' ); ?>
+                                </p>
+                        </td>
+                </tr>
+                <?php
+        }
+        /**
+         * What Emporiqa last said about ready-made rules.
+         *
+         * @since 1.2.0
+         *
+         * @return array{available: bool, live: string[]}
+         */
+        public static function rules_status(): array {
+                $stored = get_option( self::RULES_STATUS_OPTION, array() );
+                $live   = is_array( $stored ) && isset( $stored['live'] ) && is_array( $stored['live'] ) ? $stored['live'] : array();
+                return array(
+                        'available' => is_array( $stored ) && ! empty( $stored['available'] ),
+                        'live'      => array_values( array_filter( $live, 'is_string' ) ),
+                );
+        }
+        /**
+         * Keep what Emporiqa said about ready-made rules: whether this store is
+         * offered them, and which are live. Both /connect/exchange and the Test
+         * connection dry run carry it; an answer without the key (an older
+         * platform) changes nothing.
+         *
+         * Kept in its own option, not in emporiqa_options, so saving the
+         * settings form never drops it.
+         *
+         * @since 1.2.0
+         *
+         * @param array $answer Decoded Emporiqa answer.
+         */
+        public static function store_rules_status( array $answer ): void {
+                if ( ! array_key_exists( 'rules_available', $answer ) ) {
+                        return;
+                }
+                $live = array();
+                if ( isset( $answer['live_rules'] ) && is_array( $answer['live_rules'] ) ) {
+                        foreach ( $answer['live_rules'] as $key ) {
+                                if ( is_string( $key ) && preg_match( '/^[a-z_]{1,40}$/D', $key ) ) {
+                                        $live[] = $key;
+                                }
+                        }
+                }
+                $available = (bool) $answer['rules_available'];
+                update_option(
+                        self::RULES_STATUS_OPTION,
+                        array(
+                                'available' => $available,
+                                'live'      => $available ? $live : array(),
+                        ),
+                        false
+                );
+        }
 …
                                 </td>
                         </tr>
+                        <?php
+                        if ( self::rules_status()['available'] ) {
+                                $this->render_legacy_order_tracking_rows( $options );
+                        }
+                        ?>
                         <tr>
                                 <th scope="row"><label for="webhook_url"><?php esc_html_e( 'Emporiqa server URL', 'emporiqa' ); ?></label></th>
 …
                                         /* translators: %s: entity type */
                                         'batchFailed'     => __( 'Batch failed for %s', 'emporiqa' ),
+                                        /* translators: 1: entity type (products/pages), 2: seconds */
+                                        'batchWait'       => __( 'Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds.', 'emporiqa' ),
                                         /* translators: %s: entity type (products/pages) */
                                         'sessionComplete' => __( 'Completed %s sync session', 'emporiqa' ),
 …
                         'page_post_types'   => array( 'page' ),
                         'batch_size'        => 25,
+                        'order_tracking'    => true,
                 );
+        }

emporiqa/tags/1.2.0/includes/class-emporiqa-cart-ajax.php

-              r3601468
+              r3730094
          * Nonce action used for all cart AJAX requests.
+         *
+         * Starts with "woocommerce" because WooCommerce binds a guest's nonce to
+         * their cart session only for such actions; any other guest nonce is the
+         * same for every signed-out visitor.
+         *
          * @since 1.0.0
          * @var string
          */
+        private const NONCE_ACTION = 'emporiqa_cart_nonce';
+        public const NONCE_ACTION = 'woocommerce-emporiqa-cart';
+        /**
+         * Error code sent when a cart change comes from another site.
+         *
+         * @since 1.2.0
+         * @var string
+         */
+        public const CROSS_SITE_CODE = 'cross_site';
+        /**
+         * Error code sent when the nonce check fails.
+         *
+         * @since 1.2.0
+         * @var string
+         */
+        public const INVALID_NONCE_CODE = 'invalid_nonce';
         /**
 …
          */
         public function add_to_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function update_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function remove_from_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function clear_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
         private function verify_nonce(): void {
                 if ( ! check_ajax_referer( self::NONCE_ACTION, 'nonce', false ) ) {
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ) );
+                }
+                        // The code lets emporiqa-cart.js retry once with the fresh nonce:
+                        // a page served from a full-page cache can carry an expired one.
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ), self::INVALID_NONCE_CODE );
+                }
+        }
+        /**
+         * Refuse a cart change that another site's page sent.
+         *
+         * @since 1.2.0
+         */
+        private function refuse_cross_site(): void {
+                if ( self::is_cross_site( $_SERVER, array( home_url(), site_url() ) ) ) {
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ), self::CROSS_SITE_CODE );
+                }
+        }
+        /**
+         * Whether a request says it came from another site: Sec-Fetch-Site (when
+         * the browser sends it) is neither same-origin nor none, or Origin (when
+         * sent) is not one of the site's own hosts.
+         *
+         * @since 1.2.0
+         *
+         * @param array    $server   $_SERVER.
+         * @param string[] $own_urls The site's own URLs (home_url(), site_url()).
+         * @return bool
+         */
+        public static function is_cross_site( array $server, array $own_urls ): bool {
+                $fetch_site = isset( $server['HTTP_SEC_FETCH_SITE'] ) ? strtolower( (string) $server['HTTP_SEC_FETCH_SITE'] ) : '';
+                if ( '' !== $fetch_site && 'same-origin' !== $fetch_site && 'none' !== $fetch_site ) {
+                        return true;
+                }
+                $origin = isset( $server['HTTP_ORIGIN'] ) ? (string) $server['HTTP_ORIGIN'] : '';
+                if ( '' === $origin ) {
+                        return false;
+                }
+                $host = Emporiqa_Widget::host_of( $origin );
+                return '' === $host || ! in_array( $host, array_map( array( 'Emporiqa_Widget', 'host_of' ), $own_urls ), true );
+        }
 …
                                 'name'         => $product->get_name(),
                                 'quantity'     => self::parse_quantity( $item['quantity'] ),
                                 'unit_price'   => (float) $product->get_price(),
+                                'unit_price'   => $this->displayed_unit_price( $product ),
                                 'image_url'    => $image_url ? $image_url : null,
                                 'product_url'  => get_permalink( $item['product_id'] ),
 …
                         'currency'    => emporiqa_get_active_currency(),
                 );
+        }
+        /**
+         * A cart line's unit price as the cart page shows it.
+         *
+         * Same rule as WC_Cart::get_product_price(): including or excluding tax
+         * per the shop's "Display prices during cart and checkout" setting. Read
+         * as the shopper whose cart it is, at their tax address, because this is
+         * the price they will pay, unlike the synced catalogue price, which is a
+         * guest's.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product $product The cart line's product.
+         * @return float
+         */
+        private function displayed_unit_price( \WC_Product $product ): float {
+                $price = WC()->cart->display_prices_including_tax()
+                        ? wc_get_price_including_tax( $product )
+                        : wc_get_price_excluding_tax( $product );
+                return round( (float) $price, wc_get_price_decimals() );
+        }
 …
+         *
          * @param string $message The error message.
+         */
+        private function send_error( string $message ): void {
+         * @param string $code    Machine-readable reason, '' when there is none.
+         */
+        private function send_error( string $message, string $code = '' ): void {
                 wp_send_json(
                         array(
                                 'success'     => false,
                                 'error'       => $message,
+                                'code'        => $code,
                                 'checkoutUrl' => $this->get_checkout_url(),
                                 'unit_price'  => 0,

emporiqa/tags/1.2.0/includes/class-emporiqa-connect.php

-              r3601468
+              r3730094
         /**
+         * How long a claimed state stays "exchanging". Emporiqa proves the shop
+         * origin during /connect/exchange by asking actions/verify for
+         * HMAC(verifier, nonce), so the verifier must outlive the claim until the
+         * exchange returns; the TTL only bounds a request that never returned.
+         */
+        private const EXCHANGING_TTL = 120;
+        /**
+         * /connect/exchange waits on the origin proof (at most 4 s on Emporiqa's
+         * side) and on the secret rotation; past this timeout the plugin would
+         * keep its old secret while Emporiqa already rotated to the new one.
+         */
+        private const EXCHANGE_TIMEOUT = 15;
+        /**
          * Constructor — wires the admin_init handler that routes
          * ?emporiqa_action= requests.
 …
                         $this->base_url() . '/connect/exchange',
                         array(
                                 'timeout' => 10,
+                                'timeout' => self::EXCHANGE_TIMEOUT,
                                 'headers' => array(
                                         'Content-Type'        => 'application/json',
 …
                                 'body'    => wp_json_encode(
                                         array(
+                                                'code'          => $code,
+                                                'code_verifier' => $verifier,
+                                                'shop_origin'   => $shop_origin,
+                                                'code'             => $code,
+                                                'code_verifier'    => $verifier,
+                                                'shop_origin'      => $shop_origin,
+                                                'actions_base_url' => Emporiqa_Actions::base_url(),
+                                        )
                                 ),
+                        )
                 );
+                // The exchange has returned: the origin proof can no longer be asked for.
+                $this->finish_nonce( $state );
                 if ( is_wp_error( $resp ) ) {
 …
                 $status = (int) wp_remote_retrieve_response_code( $resp );
                 $body   = json_decode( wp_remote_retrieve_body( $resp ), true );
+                // A 409 carries a sentence for the merchant (a move or a reconnect
+                // waiting for an owner's email confirmation); show it as it is.
+                if ( 409 === $status && is_array( $body ) && ! empty( $body['error'] ) && is_string( $body['error'] ) ) {
+                        $this->set_error( 'exchange_409', sanitize_text_field( $body['error'] ) );
+                        $this->redirect_to_settings();
+                }
                 if ( 200 !== $status || ! is_array( $body ) || empty( $body['webhook_secret'] ) || empty( $body['store_id'] ) ) {
 …
                         $this->redirect_to_settings();
+                }
+                // Whether Emporiqa offers ready-made rules to this store, and which are live.
+                Emporiqa_Admin::store_rules_status( $body );
                 $this->persist_credentials(
 …
         /**
+         * Atomically read + delete the state→verifier transient. Returns the
+         * verifier on hit, null on miss/expired/already-used.
+         * Claim a pending state for the exchange and return its verifier; null on
+         * miss, expiry or a state already claimed (a double callback cannot
+         * replay). The row is kept, marked exchanging, until finish_nonce(), so
+         * the origin proof can be answered while the exchange is in flight.
+         *
          * @param string $state Public state from the callback.
 …
                 $key  = self::NONCE_PREFIX . hash( 'sha256', $state );
                 $data = get_transient( $key );
                 if ( ! is_array( $data ) || empty( $data['verifier'] ) ) {
+                if ( ! is_array( $data ) || empty( $data['verifier'] ) || ! empty( $data['exchanging_at'] ) ) {
                         return null;
+                }
+                // Delete first so a double-callback can't replay.
+                delete_transient( $key );
+                $data['exchanging_at'] = time();
+                if ( ! set_transient( $key, $data, self::EXCHANGING_TTL ) ) {
+                        return null;
+                }
                 return (string) $data['verifier'];
+        }
+        /**
+         * The verifier of an exchange in flight for $state, else null. Pending
+         * states never answer: only an exchange this site itself started can.
+         *
+         * @since 1.2.0
+         *
+         * @param string $state Public state sent by Emporiqa's origin proof.
+         * @return string|null
+         */
+        public static function exchanging_verifier( string $state ): ?string {
+                $data = get_transient( self::NONCE_PREFIX . hash( 'sha256', $state ) );
+                if ( ! is_array( $data ) || empty( $data['verifier'] ) || empty( $data['exchanging_at'] ) ) {
+                        return null;
+                }
+                if ( time() - (int) $data['exchanging_at'] > self::EXCHANGING_TTL ) {
+                        return null;
+                }
+                return (string) $data['verifier'];
+        }
+        /**
+         * Drop the state once the exchange has returned.
+         *
+         * @param string $state Public state from the callback.
+         */
+        private function finish_nonce( string $state ): void {
+                delete_transient( self::NONCE_PREFIX . hash( 'sha256', $state ) );
+        }

emporiqa/tags/1.2.0/includes/class-emporiqa-formatter.php

-              r3601468
+              r3730094
          */
         private array $excluded_post_ids = array();
+        /**
+         * How many as_shopper() calls are running; above 0, prices are already read as a shopper.
+         *
+         * @var int
+         */
+        private static int $shopper_depth = 0;
         /**
 …
                         $brand_data[ $channel ] = $this->get_product_brand( $product, $languages[0] );
+                        if ( $is_variable && ! empty( $published_variations ) ) {
+                                // Representative price for the parent. Emporiqa derives the
+                                // real "from–to" range from the variation events at read time,
+                                // so this single value only needs the right currency and a
+                                // sensible "from" price. Pick the cheapest variation and take
+                                // BOTH its current and regular price from that same variation —
+                                // mixing the min current price with another variation's regular
+                                // price would fabricate a discount the customer can't actually
+                                // get.
+                                $representative = $published_variations[0];
+                                $min_price      = null;
+                                foreach ( $published_variations as $v ) {
+                                        $vp = $v->get_price();
+                                        if ( '' === $vp ) {
+                                                continue;
+                                        }
+                                        $vp = (float) $vp;
+                                        if ( null === $min_price || $vp < $min_price ) {
+                                                $min_price      = $vp;
+                                                $representative = $v;
+                                        }
+                                }
+                                $price         = $min_price ?? 0.0;
+                                $regular_price = '' !== $representative->get_regular_price() ? (float) $representative->get_regular_price() : $price;
+                        } elseif ( $is_grouped ) {
+                                // C2: Grouped products — the cheapest child's price. Derived
+                                // from ALL children, not only in-stock ones, so an
+                                // all-out-of-stock grouped product still reports its real
+                                // lowest price instead of 0. current_price and regular_price
+                                // are both taken from the SAME (cheapest) child so we never
+                                // pair a low current price with a different child's higher
+                                // regular price and fabricate a discount. Unlike variable
+                                // products, grouped children sync as separate products, so
+                                // Emporiqa does not range-derive the parent — this value is
+                                // shown directly.
+                                $price         = null;
+                                $regular_price = null;
+                                foreach ( $grouped_children as $child ) {
+                                        $cp          = $child->get_price();
+                                        $child_price = '' !== $cp ? (float) $cp : null;
+                                        if ( null === $child_price ) {
+                                                continue;
+                                        }
+                                        if ( null === $price || $child_price < $price ) {
+                                                $price         = $child_price;
+                                                $cr            = $child->get_regular_price();
+                                                $regular_price = '' !== $cr ? (float) $cr : $child_price;
+                                        }
+                                }
+                                $price         = $price ?? 0.0;
+                                $regular_price = $regular_price ?? $price;
+                        } else {
+                                $price         = '' !== $product->get_price() ? (float) $product->get_price() : 0.0;
+                                $regular_price = '' !== $product->get_regular_price() ? (float) $product->get_regular_price() : $price;
+                        }
+                        $price_entry = array(
+                                'currency'      => $currency,
+                                'current_price' => $price,
+                                'regular_price' => $regular_price,
+                        // Prices are read as a guest at the shop's base location; see as_shopper().
+                        $price_entry = $this->as_shopper(
+,
+                                fn() => $this->headline_entry( $product, $published_variations, $grouped_children, $currency )
                         );
 …
                 $var_images = array_values( array_unique( $var_images ) );
+                $price         = '' !== $variation->get_price() ? (float) $variation->get_price() : 0.0;
+                $regular_price = '' !== $variation->get_regular_price() ? (float) $variation->get_regular_price() : $price;
+                $price_entry = $this->price_entry( $variation, $currency );
                 $names        = array();
-                $descriptions = array();
                 $links        = array();
                 $attributes   = array();
-                $cat_data     = array();
-                $brand_data   = array();
                 $price_data   = array();
                 $avail_data   = array();
 …
                 $max_qty_data = array();
+                // Descriptions, categories and brand are not built here: Emporiqa stores a
+                // variation as a lean row and reads them from the parent.
                 foreach ( $channels as $channel ) {
+                        $names[ $channel ]        = array();
+                        $descriptions[ $channel ] = array();
+                        $links[ $channel ]        = array();
+                        $attributes[ $channel ]   = array();
+                        $cat_data[ $channel ]     = array();
+                        $names[ $channel ]      = array();
+                        $links[ $channel ]      = array();
+                        $attributes[ $channel ] = array();
                         foreach ( $languages as $lang ) {
 …
                                 $names[ $channel ][ $lang ] = $title;
-                                $descriptions[ $channel ][ $lang ] = $this->get_translated_variation_description( $variation, $parent_product, $lang );
                                 $links[ $channel ][ $lang ] = $this->get_translated_link( $parent_product, $lang );
                                 $attributes[ $channel ][ $lang ] = empty( $clean_attributes ) ? new \stdClass() : $clean_attributes;
+                                $cat_data[ $channel ][ $lang ] = $this->get_product_categories( $parent_product, $lang );
+                        }
+                        $this->apply_translation_fallbacks( $cat_data[ $channel ], $languages );
+                        }
                         $this->apply_translation_fallbacks( $names[ $channel ], $languages );
-                        $this->apply_translation_fallbacks( $descriptions[ $channel ], $languages );
                         $this->apply_translation_fallbacks( $links[ $channel ], $languages );
+                        $brand_data[ $channel ] = $this->get_product_brand( $parent_product, $languages[0] );
+                        $price_data[ $channel ] = array(
+                                array(
+                                        'currency'      => $currency,
+                                        'current_price' => $price,
+                                        'regular_price' => $regular_price,
+                                ),
+                        );
+                        $price_data[ $channel ] = array( $price_entry );
                         $avail_data[ $channel ] = $this->get_availability_status( $variation );
 …
                         'channels'              => $channels,
                         'names'                 => $names,
-                        'descriptions'          => $descriptions,
                         'links'                 => $links,
                         'attributes'            => $attributes,
-                        'categories'            => $cat_data,
-                        'brands'                => $brand_data,
                         'prices'                => $price_data,
                         'availability_statuses' => $avail_data,
 …
                         'is_virtual'            => $variation->is_virtual(),
                         'parent_sku'            => $parent_sku,
-                        'is_parent'             => false,
-                        'variation_attributes'  => new \stdClass(),
                 );
 …
          * @return array List of channel identifiers.
          */
         private function get_product_channels( \WC_Product $product ): array {
+        public function get_product_channels( \WC_Product $product ): array {
                 /**
                  * Filter the product sales channels.
 …
                 return implode( ' > ', $names );
+        }
+        /**
+         * The `prices` entry for a product as a whole: its own price, or for a
+         * variable product its cheapest priced variation's and for a grouped
+         * product its cheapest priced child's (all children, so an all-out-of-stock
+         * group still shows its real lowest price). Current and regular price both
+         * come from that one item, so a low price is never paired with another
+         * item's higher regular price, which would fabricate a discount. Quantity
+         * tiers are kept only for the product's own price: a variation's or a
+         * child's tiers are not the parent's. Emporiqa shows a variable product's
+         * full range from its variations.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product   $product    The product.
+         * @param \WC_Product[] $variations Published variations (variable products).
+         * @param \WC_Product[] $children   Children (grouped products).
+         * @param string        $currency   Currency code.
+         * @return array
+         */
+        public function headline_entry( \WC_Product $product, array $variations, array $children, string $currency ): array {
+                if ( $product->is_type( 'variable' ) && ! empty( $variations ) ) {
+                        $pool = $variations;
+                } elseif ( $product->is_type( 'grouped' ) ) {
+                        $pool = $children;
+                } else {
+                        return $this->price_entry( $product, $currency );
+                }
+                $cheapest = null;
+                $lowest   = null;
+                foreach ( $pool as $item ) {
+                        $price = $item->get_price();
+                        if ( '' !== $price && ( null === $lowest || (float) $price < $lowest ) ) {
+                                $lowest   = (float) $price;
+                                $cheapest = $item;
+                        }
+                }
+                $entry = $this->price_entry( $cheapest, $currency );
+                unset( $entry['tier_prices'] );
+                return $entry;
+        }
+        /**
+         * Run price reads as one shopper: a signed-out visitor ($user_id 0) or a
+         * signed-in customer.
+         *
+         * A sync runs as whoever triggered it: the shop manager saving a product,
+         * a signed-in user whose request ran the queue, the WP-CLI user. Role,
+         * B2B, wholesale and dynamic pricing plugins filter the price getters by
+         * the current user, session or cart, and WooCommerce works out tax from
+         * the current customer's address, so without this a wholesale or staff
+         * price, or another country's tax, could be synced as the public price.
+         *
+         * For the duration of $read the current user is $user_id, WC()->customer
+         * is that customer (none for a guest, a copy read from the database, never
+         * a session, for a customer), WC()->session and WC()->cart are unset, and
+         * the tax location is fixed: $country when given, else the customer's own
+         * taxable address, else the shop's base address. Everything is put back
+         * afterwards, also when $read throws. Nested calls run $read as-is.
+         *
+         * @since 1.2.0
+         *
+         * @param int      $user_id 0 for a guest, else a WordPress user id.
+         * @param callable $read    Reads and returns the prices.
+         * @param string   $country ISO country for tax, '' for the default.
+         * @return mixed What $read returns.
+         */
+        public function as_shopper( int $user_id, callable $read, string $country = '' ) {
+                if ( self::$shopper_depth > 0 ) {
+                        return $read();
+                }
+                global $current_user;
+                $previous_user    = $current_user;
+                $previous_user_id = get_current_user_id();
+                $swap_user        = $previous_user_id !== $user_id;
+                $wc               = function_exists( 'WC' ) ? WC() : null;
+                $previous         = $wc ? array( $wc->customer, $wc->session, $wc->cart ) : array();
+                $location         = null;
+                ++self::$shopper_depth;
+                try {
+                        if ( $swap_user ) {
+                                wp_set_current_user( $user_id );
+                        }
+                        if ( $wc ) {
+                                $wc->session  = null;
+                                $wc->cart     = null;
+                                $wc->customer = $user_id > 0 ? new \WC_Customer( $user_id ) : null;
+                                $fixed = $this->tax_location( $wc, $country );
+                                if ( null !== $fixed ) {
+                                        $location = static function () use ( $fixed ) {
+                                                return $fixed;
+                                        };
+                                        add_filter( 'woocommerce_get_tax_location', $location, PHP_INT_MAX );
+                                }
+                        }
+                        return $read();
+                } finally {
+                        if ( null !== $location ) {
+                                remove_filter( 'woocommerce_get_tax_location', $location, PHP_INT_MAX );
+                        }
+                        if ( $wc ) {
+                                list( $wc->customer, $wc->session, $wc->cart ) = $previous;
+                        }
+                        if ( $swap_user ) {
+                                wp_set_current_user( $previous_user_id );
+                                $current_user = $previous_user; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Puts back the exact user object the caller had.
+                        }
+                        --self::$shopper_depth;
+                }
+        }
+        /**
+         * The tax location as_shopper() fixes, null when WooCommerce knows no countries.
+         *
+         * @param object $wc      WC().
+         * @param string $country ISO country, or ''.
+         * @return array|null array( country, state, postcode, city ).
+         */
+        private function tax_location( $wc, string $country ): ?array {
+                if ( '' !== $country ) {
+                        return array( $country, '', '', '' );
+                }
+                if ( $wc->customer ) {
+                        $own = $wc->customer->get_taxable_address();
+                        if ( is_array( $own ) && ! empty( $own[0] ) ) {
+                                return $own;
+                        }
+                }
+                $countries = $wc->countries;
+                if ( ! $countries ) {
+                        return null;
+                }
+                return array( $countries->get_base_country(), $countries->get_base_state(), $countries->get_base_postcode(), $countries->get_base_city() );
+        }
+        /**
+         * One `prices` entry for a product or variation, as the shop shows it.
+         *
+         * Its current_price and regular_price follow the shop's "Display prices in
+         * the shop" tax setting, so the chat quotes what the product page shows
+         * even when prices are entered the other way (entered excluding tax,
+         * shown including it, as many EU shops do). With taxes on and a taxable
+         * product, price_incl_tax and price_excl_tax carry both, for the tax
+         * location as_shopper() fixed. A missing price is 0, as before. Outside
+         * as_shopper() it is read as a guest.
+         *
+         * Quantity tiers come from the `emporiqa_price_tiers` filter (WooCommerce
+         * has none of its own): each tier is the unit price the cart charges at
+         * that quantity, with tax as current_price, at full precision.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product|null $source   The product or variation whose price is sent; null when none has one.
+         * @param string           $currency Currency code.
+         * @return array
+         */
+        public function price_entry( ?\WC_Product $source, string $currency ): array {
+                if ( 0 === self::$shopper_depth ) {
+                        return $this->as_shopper( 0, fn() => $this->price_entry( $source, $currency ) );
+                }
+                $raw         = $source ? (string) $source->get_price() : '';
+                $regular_raw = $source ? (string) $source->get_regular_price() : '';
+                if ( '' === $regular_raw ) {
+                        $regular_raw = $raw;
+                }
+                $entry = array(
+                        'currency'      => $currency,
+                        'current_price' => '' !== $raw ? (float) $raw : 0.0,
+                        'regular_price' => '' !== $regular_raw ? (float) $regular_raw : 0.0,
+                );
+                if ( '' === $raw ) {
+                        return $entry;
+                }
+                $taxed        = function_exists( 'wc_tax_enabled' ) && wc_tax_enabled() && $source->is_taxable();
+                $display_incl = $taxed && 'incl' === get_option( 'woocommerce_tax_display_shop', 'excl' );
+                $shown        = static function ( string $amount, int $qty ) use ( $source, $taxed, $display_incl ): float {
+                        if ( ! $taxed ) {
+                                return (float) $amount;
+                        }
+                        $args = array(
+                                'qty'   => $qty,
+                                'price' => $amount,
+                        );
+                        $line = $display_incl ? wc_get_price_including_tax( $source, $args ) : wc_get_price_excluding_tax( $source, $args );
+                        return (float) $line / $qty;
+                };
+                if ( $taxed ) {
+                        $decimals = function_exists( 'wc_get_price_decimals' ) ? (int) wc_get_price_decimals() : 2;
+                        $one      = array(
+                                'qty'   => 1,
+                                'price' => $raw,
+                        );
+                        $entry['price_incl_tax'] = round( (float) wc_get_price_including_tax( $source, $one ), $decimals );
+                        $entry['price_excl_tax'] = round( (float) wc_get_price_excluding_tax( $source, $one ), $decimals );
+                        $entry['current_price']  = $display_incl ? $entry['price_incl_tax'] : $entry['price_excl_tax'];
+                        $entry['regular_price']  = round( $shown( $regular_raw, 1 ), $decimals );
+                }
+                $tiers = $this->price_tiers( $source, $shown );
+                if ( ! empty( $tiers ) ) {
+                        $entry['tier_prices'] = $tiers;
+                }
+                return $entry;
+        }
+        /**
+         * Quantity tiers from the `emporiqa_price_tiers` filter, as the cart
+         * charges them: ascending, one per quantity, min_quantity 2 or more.
+         *
+         * @param \WC_Product $source The product or variation.
+         * @param callable    $shown  ( string $unit_price, int $qty ): float, the unit price with tax as shown.
+         * @return array<int, array{min_quantity: int, price: float}>
+         */
+        private function price_tiers( \WC_Product $source, callable $shown ): array {
+                /**
+                 * Filter the quantity price tiers of a product or variation.
+                 *
+                 * WooCommerce has no quantity pricing of its own; a plugin that adds it
+                 * returns its tiers here. Each tier is array( 'min_quantity' => int,
+                 * 'price' => unit price ), the price entered as the product's own price
+                 * is (with or without tax, per the shop's setting). Called while the
+                 * price is read as the shopper (a guest for the sync), so a role-aware
+                 * tier plugin answers for that shopper.
+                 *
+                 * @since 1.2.0
+                 *
+                 * @param array       $tiers   Tiers, empty by default.
+                 * @param \WC_Product $product The product or variation.
+                 */
+                $raw = apply_filters( 'emporiqa_price_tiers', array(), $source );
+                $tiers = array();
+                foreach ( is_array( $raw ) ? $raw : array() as $tier ) {
+                        if ( ! is_array( $tier ) || ! isset( $tier['min_quantity'], $tier['price'] ) || ! is_numeric( $tier['min_quantity'] ) || ! is_numeric( $tier['price'] ) ) {
+                                continue;
+                        }
+                        $qty   = (int) $tier['min_quantity'];
+                        $price = (float) $tier['price'];
+                        if ( $qty < 2 || $price <= 0 ) {
+                                continue;
+                        }
+                        $tiers[ $qty ] = array(
+                                'min_quantity' => $qty,
+                                'price'        => $shown( (string) $price, $qty ),
+                        );
+                }
+                ksort( $tiers );
+                return array_values( $tiers );
+        }
+        /**
+         * The `emporiqa_price_tiers` answer for the Tiered Price Table plugin
+         * (tier-pricing-table): each of its quantity rules as the unit price its
+         * cart charges, unrounded and with tax as the shop enters prices, for the
+         * shopper being read. The
+         * pricing type is passed so its per-request rule cache, which keys by
+         * product only, is not read: a rule cached for another shopper earlier in
+         * the request (its role-based rules) must not be sent as this one's.
+         *
+         * @since 1.2.0
+         *
+         * @param array       $tiers   Tiers so far.
+         * @param \WC_Product $product The product or variation.
+         * @return array
+         */
+        public static function tiered_price_table_tiers( $tiers, $product ): array {
+                $tiers   = is_array( $tiers ) ? $tiers : array();
+                $manager = '\\TierPricingTable\\PriceManager';
+                if ( ! $product instanceof \WC_Product || ! is_callable( array( $manager, 'getPricingRule' ) ) || ! is_callable( array( $manager, 'getPricingType' ) ) ) {
+                        return $tiers;
+                }
+                $id   = $product->get_id();
+                $rule = call_user_func( array( $manager, 'getPricingRule' ), $id, call_user_func( array( $manager, 'getPricingType' ), $id ) );
+                if ( ! is_object( $rule ) || ! is_callable( array( $rule, 'getRules' ) ) || ! is_callable( array( $rule, 'getTierPrice' ) ) ) {
+                        return $tiers;
+                }
+                foreach ( array_keys( (array) $rule->getRules() ) as $qty ) {
+                        $price = $rule->getTierPrice( (int) $qty, false, 'shop', false );
+                        if ( is_numeric( $price ) ) {
+                                $tiers[] = array(
+                                        'min_quantity' => (int) $qty,
+                                        'price'        => (float) $price,
+                                );
+                        }
+                }
+                return $tiers;
+        }
 …
         /**
-         * Get the translated variation description, falling back to parent description.
+         *
-         * @since 1.0.0
+         *
-         * @param \WC_Product_Variation $variation      The variation.
-         * @param \WC_Product           $parent_product The parent product.
-         * @param string                $language       The target language code.
-         * @return string
-         */
-        private function get_translated_variation_description( \WC_Product_Variation $variation, \WC_Product $parent_product, string $language ): string {
-                $translated_parent_id = $this->get_translation_id( $parent_product->get_id(), $language );
-                if ( $translated_parent_id && $translated_parent_id !== $parent_product->get_id() ) {
-                        $translated_parent = wc_get_product( $translated_parent_id );
-                        if ( $translated_parent && $translated_parent->is_type( 'variable' ) ) {
-                                // Find the matching translated variation by SKU or attribute combination.
-                                foreach ( $translated_parent->get_children() as $translated_var_id ) {
-                                        $translated_var = wc_get_product( $translated_var_id );
-                                        if ( ! $translated_var ) {
-                                                continue;
+                                        }
-                                        if ( $translated_var->get_sku() === $variation->get_sku() && '' !== $variation->get_sku() ) {
-                                                $desc = $translated_var->get_description();
-                                                if ( ! empty( $desc ) ) {
-                                                        return $desc;
+                                                }
-                                                break;
+                                        }
+                                }
-                                // Fall back to translated parent description.
-                                return $translated_parent->get_description();
+                        }
+                }
-                $var_desc = $variation->get_description();
-                return ! empty( $var_desc ) ? $var_desc : $parent_product->get_description();
+        }
-        /**
          * Get the translated product title.
+         *

emporiqa/tags/1.2.0/includes/class-emporiqa-order-tracking.php

-              r3506790
+              r3730094
  * order data. Requests are authenticated via HMAC-SHA256 using the same
  * webhook secret configured in Settings > Emporiqa.
+ *
+ * Replaced by the Order status ready-made rule (class-emporiqa-actions.php)
+ * since 1.2.0, and kept working unchanged for stores that use it: same
+ * request, same answers. It stays on unless the merchant switches it off
+ * (option `order_tracking`, default on).
+ *
  * @package Emporiqa
 …
         /**
+         * Whether the merchant left order tracking on (the default).
+         *
+         * @since 1.2.0
+         *
+         * @return bool
+         */
+        public static function is_enabled(): bool {
+                return (bool) Emporiqa_Admin::get_option( 'order_tracking', true );
+        }
+        /**
          * Verify HMAC signature and timestamp for the incoming request.
+         *
 …
          */
         public function handle_request( WP_REST_Request $request ): WP_REST_Response {
+                if ( ! self::is_enabled() ) {
+                        // Untranslated on purpose: Emporiqa reads this exact text as
+                        // "switched off", not as an unknown order.
+                        return new WP_REST_Response( array( 'error' => 'Order tracking is disabled.' ), 404 );
+                }
+                try {
+                        return $this->answer( $request );
+                } catch ( \Throwable $e ) {
+                        if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                                error_log( '[Emporiqa] order tracking failed: ' . $e->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+                        }
+                        return new WP_REST_Response( array( 'error' => 'Internal error.' ), 500 );
+                }
+        }
+        /**
+         * The answer to a signature-verified request.
+         *
+         * @param WP_REST_Request $request The REST request.
+         * @return WP_REST_Response
+         */
+        private function answer( WP_REST_Request $request ): WP_REST_Response {
                 // H8: Rate limiting per IP.
                 $rate_check = $this->check_rate_limit();
 …
+                }
+                $order_identifier        = sanitize_text_field( $payload['order_identifier'] );
+                $order_identifier        = is_scalar( $payload['order_identifier'] ) ? ltrim( sanitize_text_field( (string) $payload['order_identifier'] ), '#' ) : '';
+                if ( ! preg_match( '/^[0-9A-Za-z][0-9A-Za-z\-]{0,63}$/D', $order_identifier ) ) {
+                        return new WP_REST_Response(
+                                array( 'error' => __( 'Order not found.', 'emporiqa' ) ),
+                        );
+                }
                 $raw_verification        = $payload['verification_fields'] ?? array();
                 $verification_fields     = is_array( $raw_verification ) ? array_map( 'sanitize_text_field', $raw_verification ) : array();
 …
          */
         private function lookup_order( string $order_identifier, array $verification_fields ): WP_REST_Response {
+                $order = wc_get_order( $order_identifier );
+                // The typed value is an order number, never an internal id: "123"
+                // must not resolve to whichever order has id 123.
+                $order = Emporiqa_Order_Status::find_by_number( $order_identifier );
                 // Also try searching by order number (custom order number plugins).
 …
                         );
                         $order  = $orders[0] ?? null;
+                }
+                if ( ! $order ) {
+                        // WooCommerce ignores a query var it does not know, and then
+                        // returns the newest order: only an exact number match counts.
+                        if ( $order && 0 !== strcasecmp( (string) $order->get_order_number(), $order_identifier ) ) {
+                                $order = null;
+                        }
+                }
+                if ( ! $order instanceof WC_Order ) {
                         return new WP_REST_Response(
                                 array( 'error' => __( 'Order not found.', 'emporiqa' ) ),

emporiqa/tags/1.2.0/includes/class-emporiqa-order-webhook.php

-              r3549190
+              r3730094
                         $url,
                         array(
+                                'headers'  => array(
+                                        'Content-Type'        => 'application/json',
+                                        'X-Webhook-Signature' => hash_hmac( 'sha256', $payload, $secret ),
+                                ),
+                                'headers'  => Emporiqa_Webhook::signed_headers( $payload ),
                                 'body'     => $payload,
                                 'timeout'  => 5,
 …
                                 $this->log( "order.completed webhook failed for order #{$order_id}. Retry #{$attempt} in {$delay}s." );
                         } else {
+                                // Not marked as sent, so the order's next paid status
+                                // (processing to completed, say) tries once more.
+                                $order->delete_meta_data( self::TRACKED_META_KEY );
+                                $order->save();
                                 $this->log( "order.completed webhook permanently failed for order #{$order_id} after {$attempt} attempt(s)." );
+                        }

emporiqa/tags/1.2.0/includes/class-emporiqa-sync.php

-              r3601468
+              r3730094
          * AJAX handler: process a single batch of items.
+         *
+         * Queries N items for the given page, formats them, and sends them
+         * via the webhook.
+         * Queries the next N items after `after_id` (keyset, by id), formats
+         * them, and sends them via the webhook. The answer's `last_id` is the
+         * next call's `after_id`, and `done` says there is nothing after it.
+         * Paging by id instead of OFFSET means an item disabled or added
+         * mid-sync cannot shift the pages and make a live item skipped, which
+         * the session's completion would then delete from Emporiqa.
+         *
          * @since 1.0.0
 …
                 $entity          = sanitize_text_field( wp_unslash( $_POST['entity'] ?? '' ) );
                 $session_id      = sanitize_text_field( wp_unslash( $_POST['session_id'] ?? '' ) );
                 $page            = absint( $_POST['page'] ?? 1 );
+                $after_id        = absint( $_POST['after_id'] ?? 0 );
                 $items_per_batch = absint( $_POST['items_per_batch'] ?? self::ITEMS_PER_BATCH );
 …
                         'events'    => 0,
                         'success'   => true,
+                        'last_id'   => $after_id,
+                        'done'      => true,
                 );
                 if ( 'products' === $entity ) {
                         $result = $this->process_product_batch( $session_id, $page, $items_per_batch );
+                        $result = $this->process_product_batch( $session_id, $after_id, $items_per_batch );
                 } elseif ( 'pages' === $entity ) {
                         $result = $this->process_page_batch( $session_id, $page, $items_per_batch );
+                        $result = $this->process_page_batch( $session_id, $after_id, $items_per_batch );
+                }
                 // A failed batch reclassifies all of its items as errors — the
+                // per-session counters drive the completion guard below.
+                $this->record_batch_result( $session_id, $result['processed'], $result['success'] );
+                // per-session counters drive the completion guard below. A batch
+                // Emporiqa asked to wait for is held as pending instead: the browser
+                // sends the same batch again after the wait.
+                $this->record_batch_result( $session_id, $result['processed'], $result['success'], $after_id, isset( $result['retry_after'] ) );
                 wp_send_json_success( $result );
 …
+                }
+                if ( ! empty( $state['pending'] ) ) {
+                        wp_send_json_error(
+                                array(
+                                        'message' => sprintf(
+                                                /* translators: %s: entity type (products or pages). */
+                                                __( 'The %s sync session was not finalized because Emporiqa asked to wait and a batch was not sent again: items missing from this sync were NOT removed from Emporiqa. Re-run the sync.', 'emporiqa' ),
+                                                $entity
+                                        ),
+                                        'skipped' => true,
+                                )
+                        );
+                }
                 if ( $state['synced'] < 1 ) {
                         wp_send_json_error(
 …
          * Mirrors the Drupal reference: a failed batch send reclassifies the
          * whole batch's items as errors (no partial accounting inside a batch).
+         * A batch Emporiqa asked to wait for (429) is held as pending under the
+         * id it starts after, and released when that batch is sent; completion
+         * is refused while any is pending.
+         *
          * @since 1.1.9
 …
          * @param int    $processed  Items processed in this batch.
          * @param bool   $success    Whether the batch send succeeded.
+         */
+        private function record_batch_result( string $session_id, int $processed, bool $success ): void {
+         * @param int    $after_id   Id the batch starts after.
+         * @param bool   $wait       Whether Emporiqa asked to wait and resend.
+         */
+        private function record_batch_result( string $session_id, int $processed, bool $success, int $after_id = 0, bool $wait = false ): void {
                 $state = $this->get_session_state( $session_id );
                 if ( ! is_array( $state ) ) {
 …
+                }
+                $pending = isset( $state['pending'] ) && is_array( $state['pending'] ) ? $state['pending'] : array();
+                unset( $pending[ (string) $after_id ] );
+                if ( $wait ) {
+                        $pending[ (string) $after_id ] = true;
+                }
+                $state['pending'] = $pending;
                 if ( $success ) {
                         $state['synced'] += $processed;
                 } else {
+                } elseif ( ! $wait ) {
                         $state['errors'] += max( 1, $processed );
+                }
 …
+         *
          * @param string $session_id      Sync session ID.
          * @param int    $page            Page number (1-based).
          * @param int    $items_per_batch Items per page.
          * @return array{processed: int, events: int, success: bool}
          */
         private function process_product_batch( string $session_id, int $page, int $items_per_batch ): array {
+         * @param int    $after_id        Only items with a larger id.
+         * @param int    $items_per_batch Items per batch.
+         * @return array{processed: int, events: int, success: bool, last_id: int, done: bool, error?: string, retry_after?: int}
+         */
+        private function process_product_batch( string $session_id, int $after_id, int $items_per_batch ): array {
                 $formatter = emporiqa()->get_formatter();
                 $webhook   = emporiqa()->get_webhook();
                 $query_args = array(
+                        'status' => 'publish',
+                        'limit'  => $items_per_batch,
+                        'page'   => $page,
+                        'type'   => Emporiqa_Admin::get_product_types(),
+                        'status'  => 'publish',
+                        'limit'   => $items_per_batch,
+                        'orderby' => 'ID',
+                        'order'   => 'ASC',
+                        'type'    => Emporiqa_Admin::get_product_types(),
                 );
 …
+                }
+                $products  = wc_get_products( $query_args );
+                $query_args['emporiqa_after_id'] = $after_id;
+                $products  = self::query_after_id(
+                        function () use ( $query_args ) {
+                                return wc_get_products( $query_args );
+                        }
+                );
                 $events    = array();
                 $processed = count( $products );
+                $last_id   = $after_id;
                 foreach ( $products as $product ) {
+                        $last_id   = max( $last_id, (int) $product->get_id() );
                         $formatted = $formatter->format_product_consolidated( $product, $session_id );
                         foreach ( $formatted as $item ) {
 …
+                }
+                $success = true;
+                $error   = null;
+                $success     = true;
+                $error       = null;
+                $retry_after = null;
                 if ( ! empty( $events ) ) {
                         $success = $webhook->send_batch_events( $events );
                         if ( ! $success ) {
+                                $error = $webhook->get_last_error();
+                                $error       = $webhook->get_last_error();
+                                $retry_after = $webhook->get_last_retry_after();
+                        }
+                }
 …
                         'events'    => count( $events ),
                         'success'   => $success,
+                        'last_id'   => $last_id,
+                        'done'      => $processed < $items_per_batch,
                 );
                 if ( ! $success && $error ) {
                         $out['error'] = $error;
+                }
+                if ( null !== $retry_after ) {
+                        $out['retry_after'] = $retry_after;
+                }
                 return $out;
 …
+         *
          * @param string $session_id      Sync session ID.
          * @param int    $page            Page number (1-based).
          * @param int    $items_per_batch Items per page.
          * @return array{processed: int, events: int, success: bool}
          */
         private function process_page_batch( string $session_id, int $page, int $items_per_batch ): array {
+         * @param int    $after_id        Only items with a larger id.
+         * @param int    $items_per_batch Items per batch.
+         * @return array{processed: int, events: int, success: bool, last_id: int, done: bool, error?: string, retry_after?: int}
+         */
+        private function process_page_batch( string $session_id, int $after_id, int $items_per_batch ): array {
                 $post_types = Emporiqa_Admin::get_option( 'page_post_types', array( 'page' ) );
 …
                                 'events'    => 0,
                                 'success'   => true,
+                                'last_id'   => $after_id,
+                                'done'      => true,
                         );
+                }
 …
                         'post_status'      => 'publish',
                         'posts_per_page'   => $items_per_batch,
+                        'paged'            => $page,
+                        'orderby'          => 'ID',
+                        'order'            => 'ASC',
+                        'no_found_rows'    => true,
                         'suppress_filters' => false,
                 );
 …
+                }
+                $pages     = get_posts( $query_args );
+                $query_args['emporiqa_after_id'] = $after_id;
+                $pages     = self::query_after_id(
+                        function () use ( $query_args ) {
+                                return get_posts( $query_args );
+                        }
+                );
                 $events    = array();
                 $processed = count( $pages );
+                $last_id   = $after_id;
                 foreach ( $pages as $page_post ) {
+                        $last_id   = max( $last_id, (int) $page_post->ID );
                         $formatted = $formatter->format_page_consolidated( $page_post, $session_id );
                         if ( ! empty( $formatted ) ) {
 …
+                }
+                $success = true;
+                $error   = null;
+                $success     = true;
+                $error       = null;
+                $retry_after = null;
                 if ( ! empty( $events ) ) {
                         $success = $webhook->send_batch_events( $events );
                         if ( ! $success ) {
+                                $error = $webhook->get_last_error();
+                                $error       = $webhook->get_last_error();
+                                $retry_after = $webhook->get_last_retry_after();
+                        }
+                }
 …
                         'events'    => count( $events ),
                         'success'   => $success,
+                        'last_id'   => $last_id,
+                        'done'      => $processed < $items_per_batch,
                 );
                 if ( ! $success && $error ) {
                         $out['error'] = $error;
+                }
+                if ( null !== $retry_after ) {
+                        $out['retry_after'] = $retry_after;
+                }
                 return $out;
+        }
+        /**
+         * Run $query with `ID > after_id` added to the posts queries that carry
+         * the `emporiqa_after_id` query var (keyset paging). wc_get_products()
+         * and get_posts() have no "id after" argument, but both pass unknown
+         * query vars through to WP_Query, so it goes in through posts_where.
+         *
+         * @since 1.2.0
+         *
+         * @param callable $query Runs one posts query whose args include `emporiqa_after_id`.
+         * @return array
+         */
+        public static function query_after_id( callable $query ): array {
+                $filter = function ( $where, $wp_query ) {
+                        $after_id = $wp_query instanceof \WP_Query ? $wp_query->get( 'emporiqa_after_id', null ) : null;
+                        if ( null === $after_id ) {
+                                return $where;
+                        }
+                        global $wpdb;
+                        return $where . $wpdb->prepare( " AND {$wpdb->posts}.ID > %d", absint( $after_id ) );
+                };
+                add_filter( 'posts_where', $filter, 10, 2 );
+                try {
+                        $result = $query();
+                } finally {
+                        remove_filter( 'posts_where', $filter, 10 );
+                }
+                return is_array( $result ) ? $result : array();
+        }
+}

emporiqa/tags/1.2.0/includes/class-emporiqa-webhook.php

-              r3560454
+              r3730094
         /**
+         * Seconds Emporiqa asked us to wait (429, or 503 with Retry-After) on the
+         * most recent failed send_batch_events call, or null. Emporiqa sheds sync
+         * batches this way when its queue is full; the batch is meant to be sent
+         * again after the wait, not counted as failed.
+         *
+         * @var int|null
+         */
+        private ?int $last_retry_after = null;
+        /**
+         * Longest wait honoured from Retry-After (seconds).
+         *
+         * @since 1.2.0
+         */
+        public const MAX_RETRY_AFTER = 300;
+        /**
+         * Wait used when a 429 names none (seconds).
+         *
+         * @since 1.2.0
+         */
+        public const DEFAULT_RETRY_AFTER = 30;
+        /**
+         * How many times a WP-CLI sync waits and resends one batch before it
+         * counts the batch as failed.
+         *
+         * @since 1.2.0
+         */
+        private const CLI_MAX_WAITS = 10;
+        /**
          * Connect-phase budget (ms) to install on the in-flight cURL handle
          * via http_api_curl. Set just before wp_remote_post in do_request(),
 …
                                 // (cURL) or by apply_fallback_request_timeout (Streams).
                                 'timeout'  => 0.01,
+                                'headers'  => array(
+                                        'Content-Type'        => 'application/json',
+                                        'X-Webhook-Signature' => $this->generate_signature( $json ),
+                                ),
+                                'headers'  => self::signed_headers( $json ),
                                 'body'     => $json,
+                        )
 …
                 $result  = $this->do_request( $payload, false, $timeout );
+                // WP-CLI has no request time limit, so it waits as Emporiqa asks and
+                // sends the same batch again. The admin sync waits in the browser.
+                $waits = 0;
+                while ( ! $result['success'] && null !== ( $result['retry_after'] ?? null ) && $debug && defined( 'WP_CLI' ) && WP_CLI && $waits < self::CLI_MAX_WAITS ) {
+                        ++$waits;
+                        \WP_CLI::log( sprintf( 'Emporiqa asked to wait %d s before the next batch; waiting.', $result['retry_after'] ) );
+                        sleep( $result['retry_after'] );
+                        $result = $this->do_request( $payload, false, $timeout );
+                }
+                $this->last_retry_after = $result['success'] ? null : ( $result['retry_after'] ?? null );
                 if ( ! $result['success'] ) {
                         $this->last_error = $this->build_friendly_error( $result );
 …
         public function get_last_error(): ?string {
                 return $this->last_error;
+        }
+        /**
+         * Seconds Emporiqa asked to wait before the batch that just failed is
+         * sent again; null when the failure was not a request to wait.
+         *
+         * @since 1.2.0
+         *
+         * @return int|null
+         */
+        public function get_last_retry_after(): ?int {
+                return $this->last_retry_after;
+        }
+        /**
+         * The wait a failed response asks for: a 429 always (Retry-After, else
+         * DEFAULT_RETRY_AFTER), a 503 only when it carries Retry-After. Seconds
+         * between 1 and MAX_RETRY_AFTER; an HTTP-date Retry-After counts as the
+         * default. Null for every other failure.
+         *
+         * @since 1.2.0
+         *
+         * @param int    $status      HTTP status.
+         * @param string $retry_after Retry-After header value, '' when absent.
+         * @return int|null
+         */
+        public static function retry_after( int $status, string $retry_after ): ?int {
+                $retry_after = trim( $retry_after );
+                if ( 429 !== $status && ! ( 503 === $status && '' !== $retry_after ) ) {
+                        return null;
+                }
+                $seconds = ctype_digit( $retry_after ) ? (int) $retry_after : self::DEFAULT_RETRY_AFTER;
+                return max( 1, min( self::MAX_RETRY_AFTER, $seconds ) );
+        }
 …
                 $result = $this->do_request( array( 'events' => $events ), true );
+                // Warned from 2 minutes, well inside the 5 minutes Emporiqa allows, so
+                // the merchant hears of a drifting clock before every sync fails.
+                $clock_warning = '';
+                $skew          = $result['clock_skew'] ?? null;
+                if ( null !== $skew && abs( $skew ) > 120 ) {
+                        $clock_warning = ' ' . sprintf(
+                                /* translators: %d: number of minutes */
+                                __( "This server's clock is %d minutes off. Ask your host to turn on time synchronisation (NTP): Emporiqa refuses data sent with a clock more than 5 minutes off.", 'emporiqa' ),
+                                (int) round( abs( $skew ) / 60 )
+                        );
+                }
                 if ( $result['success'] ) {
                         $dry_run_data = $result['response'] ?? array();
+                        if ( is_array( $dry_run_data ) ) {
+                                // A connected site learns here, without reconnecting, whether
+                                // Emporiqa offers ready-made rules and which are live.
+                                Emporiqa_Admin::store_rules_status( $dry_run_data );
+                        }
                         $has_warnings = false;
 …
                         return array(
                                 'success' => true,
                                 'message' => $has_warnings
+                                'message' => ( $has_warnings
                                         ? __( 'Connection successful, but there are warnings.', 'emporiqa' )
                                         : __( 'Connection successful! All fields validated.', 'emporiqa' ),
+                                        : __( 'Connection successful! All fields validated.', 'emporiqa' ) ) . $clock_warning,
                                 'dry_run' => $dry_run_data,
                         );
 …
                         'success' => false,
                         /* translators: %s: human-readable error message from the Emporiqa server */
                         'message' => sprintf( __( 'Connection failed: %s', 'emporiqa' ), $this->build_friendly_error( $result ) ),
+                        'message' => sprintf( __( 'Connection failed: %s', 'emporiqa' ), $this->build_friendly_error( $result ) ) . $clock_warning,
                         'dry_run' => $result['response'],
                 );
 …
         /**
-         * Generate an HMAC-SHA256 signature for a payload.
+         *
-         * @since 1.0.0
+         *
-         * @param string $payload The JSON payload.
-         * @return string The hex-encoded signature.
-         */
-        private function generate_signature( string $payload ): string {
-                $secret = Emporiqa_Admin::get_option( 'webhook_secret', '' );
-                if ( '' === $secret ) {
-                        return '';
+                }
-                return hash_hmac( 'sha256', $payload, $secret );
+        }
-        /**
          * Send an HTTP POST request to the webhook endpoint.
+         *
 …
+                }
+                $headers = array(
+                        'Content-Type'        => 'application/json',
+                        'X-Webhook-Signature' => $this->generate_signature( $json_payload ),
+                );
+                $headers = self::signed_headers( $json_payload );
                 // Hook-driven (AS worker) sends get the tight handshake cap; admin-
 …
                 $status_code = wp_remote_retrieve_response_code( $response );
                 $body        = json_decode( wp_remote_retrieve_body( $response ), true );
+                $clock_skew  = self::clock_skew( (string) wp_remote_retrieve_header( $response, 'date' ), time() );
                 if ( in_array( $status_code, array( 200, 201, 202 ), true ) ) {
                         return array(
+                                'success'  => true,
+                                'response' => $body,
+                                'error'    => null,
+                                'success'    => true,
+                                'response'   => $body,
+                                'error'      => null,
+                                'clock_skew' => $clock_skew,
                         );
+                }
 …
                 return array(
+                        'success'  => false,
+                        'response' => $body,
+                        'error'    => $error_msg,
+                        'success'     => false,
+                        'response'    => $body,
+                        'error'       => $error_msg,
+                        'clock_skew'  => $clock_skew,
+                        'retry_after' => self::retry_after( (int) $status_code, (string) wp_remote_retrieve_header( $response, 'retry-after' ) ),
                 );
+        }
+        /**
+         * Headers for a sync webhook body: the scheme-2 signature beside the
+         * legacy one (a new plugin may still meet a platform that only knows the
+         * old header), and the plugin version. Built per send, so every send and
+         * every retry carries a fresh timestamp.
+         *
+         * @since 1.2.0
+         *
+         * @param string $json Exact request body.
+         * @return array<string, string>
+         */
+        public static function signed_headers( string $json ): array {
+                $secret  = (string) Emporiqa_Admin::get_option( 'webhook_secret', '' );
+                $headers = array(
+                        'Content-Type'              => 'application/json',
+                        'X-Webhook-Signature'       => '' === $secret ? '' : hash_hmac( 'sha256', $json, $secret ),
+                        'X-Emporiqa-Plugin-Version' => 'woocommerce/' . EMPORIQA_VERSION,
+                );
+                $scheme2 = Emporiqa_Signature::webhook_header( $json, $secret, (string) Emporiqa_Admin::get_option( 'store_id', '' ) );
+                if ( '' !== $scheme2 ) {
+                        $headers['X-Emporiqa-Webhook-Signature'] = $scheme2;
+                }
+                return $headers;
+        }
+        /**
+         * Seconds this server's clock is ahead of Emporiqa's (negative: behind),
+         * from the response Date header; null when there is none. Tells a skewed
+         * clock apart from a wrong secret when signatures are refused.
+         *
+         * @since 1.2.0
+         *
+         * @param string $date_header HTTP Date header value.
+         * @param int    $now         Local time.
+         * @return int|null
+         */
+        public static function clock_skew( string $date_header, int $now ): ?int {
+                $remote = '' === $date_header ? false : strtotime( $date_header );
+                return false === $remote ? null : $now - $remote;
+        }

emporiqa/tags/1.2.0/includes/class-emporiqa-widget.php

-              r3549215
+              r3730094
  * - currency: ISO 4217 currency code (e.g. EUR, USD)
  * - channel: Sales channel identifier (always included, defaults to 'default')
+ * - user_id: Signed token for logged-in customer identification
+ *
+ * A signed-in customer's token is never in the page or the URL (full-page
+ * caches would serve it to another shopper, and URLs end up in server logs).
+ * assets/js/emporiqa-customer-token.js asks the uncached admin-ajax action
+ * `emporiqa_customer_token` for it when the chat opens, and hands it to
+ * embed.js on a MessageChannel port.
+ *
  * @package Emporiqa
 …
         /**
+         * The admin-ajax action that returns the customer token.
+         */
+        public const TOKEN_ACTION = 'emporiqa_customer_token';
+        /**
+         * The request header the token script sends. A custom header makes a
+         * cross-site request need a CORS preflight, which admin-ajax never
+         * grants, so a page on another site cannot have the browser send it.
+         */
+        public const TOKEN_HEADER = 'X-Emporiqa-Token';
+        /**
          * Register hooks.
+         *
 …
                 add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_widget' ) );
                 add_filter( 'script_loader_tag', array( $this, 'modify_widget_script_tag' ), 10, 2 );
+                // Signed-in visitors only: a guest has no token, and its script never asks.
+                add_action( 'wp_ajax_' . self::TOKEN_ACTION, array( $this, 'ajax_customer_token' ) );
+        }
 …
+                }
+                $language = $this->get_current_language();
+                if ( $this->is_multilingual() && ! self::is_language_enabled( $language, (array) Emporiqa_Admin::get_option( 'enabled_languages', array() ) ) ) {
+                        return;
+                }
                 $query_params = array(
                         'store_id' => $store_id,
                         'language' => $this->get_current_language(),
+                        'language' => $language,
                 );
 …
+                }
-                if ( is_user_logged_in() ) {
-                        $webhook_secret = Emporiqa_Admin::get_option( 'webhook_secret' );
-                        if ( ! empty( $webhook_secret ) ) {
-                                $user_token = $this->generate_user_token(
-                                        (string) get_current_user_id(),
-                                        $webhook_secret
-                                );
-                                if ( ! empty( $user_token ) ) {
-                                        $query_params['user_id'] = $user_token;
+                                }
+                        }
+                }
                 /**
                  * Filter the widget embed query parameters.
 …
                  * @since 1.0.0
+                 *
                  * @param array $query_params The query parameters (store_id, language, currency, channel, user_id).
+                 * @param array $query_params The query parameters (store_id, language, currency, channel).
                  */
                 $query_params = apply_filters( 'emporiqa_widget_params', $query_params );
 …
                 wp_enqueue_script( 'emporiqa-widget', $widget_url, array(), EMPORIQA_VERSION, true );
                 wp_script_add_data( 'emporiqa-widget', 'strategy', 'async' );
+                // The same for every visitor, so cached pages may carry it: it holds
+                // only the admin-ajax URL, and the token is fetched on demand.
+                if ( ! empty( Emporiqa_Admin::get_option( 'webhook_secret' ) ) ) {
+                        wp_enqueue_script(
+                                'emporiqa-customer-token',
+                                EMPORIQA_PLUGIN_URL . 'assets/js/emporiqa-customer-token.js',
+                                array(),
+                                EMPORIQA_VERSION,
+                                array(
+                                        'in_footer' => true,
+                                        'strategy'  => 'defer',
+                                )
+                        );
+                        wp_add_inline_script(
+                                'emporiqa-customer-token',
+                                'window.emporiqaTokenConfig = ' . wp_json_encode(
+                                        array(
+                                                'url'    => admin_url( 'admin-ajax.php' ),
+                                                'action' => self::TOKEN_ACTION,
+                                                'header' => self::TOKEN_HEADER,
+                                        )
+                                ) . ';',
+                                'before'
+                        );
+                }
+        }
+        /**
+         * Admin-ajax: the signed-in customer's token.
+         *
+         * Read-only: it returns only the current session's own identity token
+         * and changes nothing. It cannot carry a nonce, because the page that
+         * would hold one is served from full-page caches to other visitors.
+         * Cross-site use is blocked instead: POST only, the TOKEN_HEADER header
+         * is required (forcing a CORS preflight), and a request whose
+         * Sec-Fetch-Site or Origin says it came from another site is refused.
+         * Never cached (no-store, private, Vary: Cookie).
+         *
+         * @since 1.2.0
+         */
+        public function ajax_customer_token(): void {
+                // Through the filter, not header(): wp_send_json() ends in the
+                // admin-ajax die handler, which sends nocache_headers() again, and
+                // before WordPress 6.3 those lack no-store and private.
+                add_filter( 'nocache_headers', array( __CLASS__, 'no_store_headers' ) );
+                nocache_headers();
+                send_nosniff_header();
+                header( 'Vary: Cookie' );
+                $method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
+                if ( 'POST' !== $method ) {
+                        wp_send_json( array( 'token' => '' ), 405 );
+                }
+                if ( ! self::is_same_site_request( $_SERVER, home_url() ) ) {
+                        wp_send_json( array( 'token' => '' ), 403 );
+                }
+                $token = '';
+                if ( is_user_logged_in() ) {
+                        $token = Emporiqa_Signature::customer_token(
+                                (string) get_current_user_id(),
+                                (string) Emporiqa_Admin::get_option( 'webhook_secret', '' ),
+                                (string) Emporiqa_Admin::get_option( 'store_id', '' )
+                        );
+                }
+                wp_send_json( array( 'token' => $token ) );
+        }
+        /**
+         * The nocache headers with no-store and private, so no shared or browser
+         * cache keeps a customer's token, on every supported WordPress version.
+         *
+         * @since 1.2.0
+         *
+         * @param array $headers Header names and values.
+         * @return array
+         */
+        public static function no_store_headers( array $headers ): array {
+                $headers['Cache-Control'] = 'no-cache, must-revalidate, max-age=0, no-store, private';
+                return $headers;
+        }
+        /**
+         * Whether a token request came from this site's own script: it carries
+         * TOKEN_HEADER, Sec-Fetch-Site (when the browser sends it) is
+         * same-origin, and Origin (when sent) is the site's own host.
+         *
+         * @since 1.2.0
+         *
+         * @param array  $server $_SERVER.
+         * @param string $home   home_url().
+         * @return bool
+         */
+        public static function is_same_site_request( array $server, string $home ): bool {
+                $header = 'HTTP_' . strtoupper( str_replace( '-', '_', self::TOKEN_HEADER ) );
+                if ( '1' !== ( $server[ $header ] ?? '' ) ) {
+                        return false;
+                }
+                $fetch_site = isset( $server['HTTP_SEC_FETCH_SITE'] ) ? strtolower( (string) $server['HTTP_SEC_FETCH_SITE'] ) : '';
+                if ( '' !== $fetch_site && 'same-origin' !== $fetch_site ) {
+                        return false;
+                }
+                $origin = isset( $server['HTTP_ORIGIN'] ) ? (string) $server['HTTP_ORIGIN'] : '';
+                if ( '' === $origin ) {
+                        return true;
+                }
+                $host = self::host_of( $origin );
+                return '' !== $host && self::host_of( $home ) === $host;
+        }
+        /**
+         * The host[:port] of a URL, lowercase; the scheme is left out, since a site
+         * behind a TLS proxy may know itself as http.
+         *
+         * @since 1.2.0
+         *
+         * @param string $url URL.
+         * @return string '' when it has no host.
+         */
+        public static function host_of( string $url ): string {
+                $parts = wp_parse_url( $url );
+                if ( ! is_array( $parts ) || empty( $parts['host'] ) ) {
+                        return '';
+                }
+                return strtolower( $parts['host'] . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' ) );
+        }
 …
         /**
+         * Generate a signed user identity token for the chat widget.
+         *
+         * @since 1.0.0
+         *
+         * @param string $user_id        The customer's user ID.
+         * @param string $webhook_secret The store's webhook secret.
+         * @return string Signed token in format "base64url_payload.hmac_hex".
+         */
+        private function generate_user_token( string $user_id, string $webhook_secret ): string {
+                $payload = wp_json_encode(
+                        array(
+                                'uid' => $user_id,
+                                'ts'  => time(),
+                        )
+                );
+                if ( false === $payload ) {
+                        return '';
+                }
+                // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for signed token encoding.
+                $encoded_payload = rtrim( strtr( base64_encode( $payload ), '+/', '-_' ), '=' );
+                $signature       = hash_hmac( 'sha256', $encoded_payload, $webhook_secret );
+                return $encoded_payload . '.' . $signature;
+         * Whether the page's language is ticked under Languages. A language that
+         * is not ticked is neither synced nor offered: its pages show no chat.
+         *
+         * @since 1.2.0
+         *
+         * @param string   $current The page's language.
+         * @param string[] $enabled Ticked languages.
+         * @return bool
+         */
+        public static function is_language_enabled( string $current, array $enabled ): bool {
+                return empty( $enabled ) || in_array( $current, $enabled, true );
+        }
+        /**
+         * Whether Polylang or WPML gives each page its own language. Without one
+         * the site has a single language, and the chat always shows.
+         *
+         * @return bool
+         */
+        private function is_multilingual(): bool {
+                return function_exists( 'pll_current_language' ) || ( defined( 'ICL_LANGUAGE_CODE' ) && ICL_LANGUAGE_CODE );
+        }

emporiqa/tags/1.2.0/languages/emporiqa.pot

-              r3678094
+              r3730094
 msgid ""
 msgstr ""
 "Project-Id-Version: Emporiqa 1.1.10\n"
+"Project-Id-Version: Emporiqa 1.2.0\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/emporiqa\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 …
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "POT-Creation-Date: 2026-09-02T13:34:37+00:00\n"
+"POT-Creation-Date: 2026-10-06T05:10:28+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.12.0\n"
 …
 #. Author of the plugin
 #: emporiqa.php
 #: emporiqa.php:1061
 #: emporiqa.php:1110
 #: includes/class-emporiqa-admin.php:59
+#: emporiqa.php:1079
+#: emporiqa.php:1128
+#: includes/class-emporiqa-admin.php:64
 msgid "Emporiqa"
 msgstr ""
 …
 msgstr ""
 #: emporiqa.php:1062
+#: emporiqa.php:1080
 msgid "requires WooCommerce to be installed and active."
 msgstr ""
 #: emporiqa.php:1111
+#: emporiqa.php:1129
 msgid "requires WooCommerce 8.0 or higher. Some features may not work correctly with your current version."
 msgstr ""
 #: emporiqa.php:1128
+#: emporiqa.php:1146
 msgid "Emporiqa activated!"
 msgstr ""
 #: emporiqa.php:1129
+#: emporiqa.php:1147
 msgid "Connect your store to start syncing products and pages."
 msgstr ""
 #: emporiqa.php:1131
+#: emporiqa.php:1149
 msgid "Go to Settings →"
 msgstr ""
 #: includes/class-emporiqa-admin.php:58
+#: includes/class-emporiqa-admin.php:63
 msgid "Emporiqa Settings"
 msgstr ""
 #: includes/class-emporiqa-admin.php:78
 #: includes/class-emporiqa-admin.php:225
+#: includes/class-emporiqa-admin.php:83
+#: includes/class-emporiqa-admin.php:239
 msgid "Settings"
 msgstr ""
 #. translators: %s: link to Sync tab
 #: includes/class-emporiqa-admin.php:101
+#: includes/class-emporiqa-admin.php:106
 #, php-format
 msgid "To sync your products and pages with Emporiqa, go to the <a href=\"%s\">Sync tab</a>."
 msgstr ""
 #: includes/class-emporiqa-admin.php:168
+#: includes/class-emporiqa-admin.php:182
 msgid "Connection Secret is required. Webhooks and user identification will not work without it."
 msgstr ""
 #. translators: %s: link to Emporiqa dashboard integration overview
 #: includes/class-emporiqa-admin.php:197
+#: includes/class-emporiqa-admin.php:211
 #, php-format
 msgid "Before your first sync, make sure your Store ID and Connection Secret are configured. Find both in your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Integration overview</a>."
 msgstr ""
 #: includes/class-emporiqa-admin.php:228
+#: includes/class-emporiqa-admin.php:242
 msgid "Sync"
 msgstr ""
 #: includes/class-emporiqa-admin.php:301
+#: includes/class-emporiqa-admin.php:316
 msgid "Connection Settings"
 msgstr ""
 #: includes/class-emporiqa-admin.php:311
+#: includes/class-emporiqa-admin.php:326
 msgid "Connected."
 msgstr ""
 #: includes/class-emporiqa-admin.php:312
+#: includes/class-emporiqa-admin.php:327
 msgid "Your store is now linked to Emporiqa. Use the Sync tab to send your catalog."
 msgstr ""
+#: includes/class-emporiqa-admin.php:355
+#: includes/class-emporiqa-admin.php:380
+msgid "Ready-made rules"
+msgstr ""
+#: includes/class-emporiqa-admin.php:383
+msgid "Rules tell the chat what to do when a shopper asks for something specific. The rule below reads your WooCommerce orders through this plugin. Click Open in Emporiqa to test it and switch it on there. Rules that do not need your shop, such as return requests, are added in Emporiqa under Settings > Rules."
+msgstr ""
+#: includes/class-emporiqa-admin.php:387
+msgid "The Order status rule is on, so the old order tracking under Advanced is no longer needed. First remove its address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick Order tracking under Advanced and click Save Changes."
+msgstr ""
+#: includes/class-emporiqa-admin.php:392
+msgid "Order status address"
+msgstr ""
+#: includes/class-emporiqa-admin.php:398
+#: includes/class-emporiqa-admin.php:453
+#: includes/class-emporiqa-admin.php:709
+msgid "Copy"
+msgstr ""
+#: includes/class-emporiqa-admin.php:401
+msgid "Emporiqa fills this in for you when you add the Order status rule. If it ever asks for the address, use this one."
+msgstr ""
+#: includes/class-emporiqa-admin.php:403
+msgid "Your site is not served over https, so Emporiqa cannot call it. Switch the site to https (Settings > General), then come back here."
+msgstr ""
+#: includes/class-emporiqa-admin.php:408
+msgid "Order status"
+msgstr ""
+#: includes/class-emporiqa-admin.php:411
+msgid "On"
+msgstr ""
+#: includes/class-emporiqa-admin.php:413
+msgid "Not added"
+msgstr ""
+#: includes/class-emporiqa-admin.php:416
+msgid "Open in Emporiqa"
+msgstr ""
+#: includes/class-emporiqa-admin.php:420
+msgid "Answers \"Where is my order?\" from your WooCommerce orders. A shopper signed in to your shop only gives the order number; a guest also gives the email used for the order."
+msgstr ""
+#: includes/class-emporiqa-admin.php:423
+msgid "On and Not added show what Emporiqa said at your last connect or Test connection (Sync tab). Run Test connection after changing a rule to refresh them."
+msgstr ""
+#: includes/class-emporiqa-admin.php:442
+msgid "Order tracking (old)"
+msgstr ""
+#: includes/class-emporiqa-admin.php:448
+msgid "Answer order lookups at the old order tracking address."
+msgstr ""
+#: includes/class-emporiqa-admin.php:457
+msgid "Replaced by the Order status rule above. Leave it on while your Emporiqa dashboard still has this address. To switch it off, first remove the address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick this and click Save Changes."
+msgstr ""
+#: includes/class-emporiqa-admin.php:527
 msgid "Connect to Emporiqa in one click"
 msgstr ""
 #: includes/class-emporiqa-admin.php:358
+#: includes/class-emporiqa-admin.php:530
 msgid "We'll sign you in, link this store, and send back a fresh connection secret. No copy-pasting."
 msgstr ""
 #: includes/class-emporiqa-admin.php:371
+#: includes/class-emporiqa-admin.php:543
 msgid "Connect to Emporiqa"
 msgstr ""
 #: includes/class-emporiqa-admin.php:376
 #: includes/class-emporiqa-connect.php:133
+#: includes/class-emporiqa-admin.php:548
+#: includes/class-emporiqa-connect.php:148
 msgid "Your site must be served over HTTPS to use one-click connect."
 msgstr ""
 #: includes/class-emporiqa-admin.php:383
+#: includes/class-emporiqa-admin.php:555
 msgid "I'd rather paste credentials manually"
 msgstr ""
 #: includes/class-emporiqa-admin.php:400
+#: includes/class-emporiqa-admin.php:572
 msgid "Connection in progress."
 msgstr ""
 #: includes/class-emporiqa-admin.php:401
+#: includes/class-emporiqa-admin.php:573
 msgid "Finish the steps on emporiqa.com, then come back to this tab."
 msgstr ""
 #. translators: %s: link text for "start over"
 #: includes/class-emporiqa-admin.php:407
+#: includes/class-emporiqa-admin.php:579
 #, php-format
 msgid "Tab got stuck? %s."
 msgstr ""
 #: includes/class-emporiqa-admin.php:411
+#: includes/class-emporiqa-admin.php:583
 msgid "Start over"
 msgstr ""
 #: includes/class-emporiqa-admin.php:432
+#: includes/class-emporiqa-admin.php:604
 msgid "Connected to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:436
 #: includes/class-emporiqa-admin.php:480
+#: includes/class-emporiqa-admin.php:608
+#: includes/class-emporiqa-admin.php:652
 msgid "Store ID"
 msgstr ""
 #: includes/class-emporiqa-admin.php:442
+#: includes/class-emporiqa-admin.php:614
 msgid "Connection secret"
 msgstr ""
 #: includes/class-emporiqa-admin.php:444
+#: includes/class-emporiqa-admin.php:616
 msgid "Stored. Reconnect to rotate."
 msgstr ""
 #: includes/class-emporiqa-admin.php:450
+#: includes/class-emporiqa-admin.php:622
 msgid "Reconnect"
 msgstr ""
 #: includes/class-emporiqa-admin.php:453
+#: includes/class-emporiqa-admin.php:625
 msgid "Open Emporiqa dashboard"
 msgstr ""
 #: includes/class-emporiqa-admin.php:461
+#: includes/class-emporiqa-admin.php:633
 msgid "Edit credentials manually"
 msgstr ""
 #. translators: %s: link to Emporiqa dashboard integration overview
 #: includes/class-emporiqa-admin.php:490
+#: includes/class-emporiqa-admin.php:662
 #, php-format
 msgid "Find it in your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Integration overview</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:499
+#: includes/class-emporiqa-admin.php:671
 msgid "Connection Secret"
 msgstr ""
 #: includes/class-emporiqa-admin.php:505
+#: includes/class-emporiqa-admin.php:677
 msgid "Value is set (leave empty to keep)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:511
+#: includes/class-emporiqa-admin.php:683
 msgid "Not configured"
 msgstr ""
 #: includes/class-emporiqa-admin.php:516
+#: includes/class-emporiqa-admin.php:688
 msgid "Required. Secret key for HMAC signature. Leave empty to keep the current value."
 msgstr ""
 #: includes/class-emporiqa-admin.php:532
+#: includes/class-emporiqa-admin.php:704
 msgid "Order Tracking API URL"
 msgstr ""
-#: includes/class-emporiqa-admin.php:537
-msgid "Copy"
-msgstr ""
 #. translators: %s: link to Emporiqa dashboard order tracking settings
 #: includes/class-emporiqa-admin.php:545
+#: includes/class-emporiqa-admin.php:717
 #, php-format
 msgid "Optional. To enable order tracking in the chat, paste this URL into your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Order Tracking API URL</a>. Requests are authenticated with your webhook secret; the customer email is always required and must match the order billing email."
 msgstr ""
 #: includes/class-emporiqa-admin.php:569
+#: includes/class-emporiqa-admin.php:741
 msgid "Advanced"
 msgstr ""
 #: includes/class-emporiqa-admin.php:575
+#: includes/class-emporiqa-admin.php:747
 msgid "The defaults work for most stores. Open this only if you want to change what's sent to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:579
+#: includes/class-emporiqa-admin.php:751
 msgid "Sync products"
 msgstr ""
 #: includes/class-emporiqa-admin.php:584
+#: includes/class-emporiqa-admin.php:756
 msgid "Send new and updated products to Emporiqa so the chat can recommend them."
 msgstr ""
 #: includes/class-emporiqa-admin.php:589
+#: includes/class-emporiqa-admin.php:761
 msgid "Sync pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:594
+#: includes/class-emporiqa-admin.php:766
 msgid "Send pages and blog content so the chat can answer questions about your shipping, returns, FAQs, and similar."
 msgstr ""
 #: includes/class-emporiqa-admin.php:599
+#: includes/class-emporiqa-admin.php:771
 msgid "Languages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:616
+#: includes/class-emporiqa-admin.php:788
 msgid "Pick the languages of your products and pages to send. The chat replies in each shopper's language for any of these."
 msgstr ""
 #: includes/class-emporiqa-admin.php:621
+#: includes/class-emporiqa-admin.php:793
 msgid "Pages and posts to include"
 msgstr ""
 #: includes/class-emporiqa-admin.php:642
+#: includes/class-emporiqa-admin.php:814
 msgid "Which kinds of content count as \"pages\" for the chat. Most stores leave this as Pages only. Add Posts if you want your blog articles included."
 msgstr ""
 #: includes/class-emporiqa-admin.php:647
+#: includes/class-emporiqa-admin.php:824
 msgid "Emporiqa server URL"
 msgstr ""
 #: includes/class-emporiqa-admin.php:652
+#: includes/class-emporiqa-admin.php:829
 msgid "Where this site sends product and page updates. Keep the default (https://emporiqa.com/webhooks/sync/) unless Emporiqa support asked you to change it."
 msgstr ""
 #: includes/class-emporiqa-admin.php:657
+#: includes/class-emporiqa-admin.php:834
 msgid "Items per batch"
 msgstr ""
 #: includes/class-emporiqa-admin.php:662
+#: includes/class-emporiqa-admin.php:839
 msgid "How many products to send at a time during the first sync. The default works for almost everyone. If a sync stops partway through on a big catalog, try a smaller number (10 or 15)."
 msgstr ""
 #: includes/class-emporiqa-admin.php:811
+#: includes/class-emporiqa-admin.php:988
 msgid "Connected to Emporiqa. One more step."
 msgstr ""
 #: includes/class-emporiqa-admin.php:815
+#: includes/class-emporiqa-admin.php:992
 msgid "Send your products and pages to Emporiqa so the chat has something to recommend. We'll send everything in batches in the background."
 msgstr ""
 #: includes/class-emporiqa-admin.php:828
+#: includes/class-emporiqa-admin.php:1005
 msgid "Send my catalog"
 msgstr ""
 #. translators: 1: total item count, 2: typical time
 #: includes/class-emporiqa-admin.php:834
+#: includes/class-emporiqa-admin.php:1011
 #, php-format
 msgid "%1$d items to send. Typically a few minutes."
 msgstr ""
 #: includes/class-emporiqa-admin.php:842
+#: includes/class-emporiqa-admin.php:1019
 msgid "The chat goes live on your storefront once the first full sync finishes. You don't need to keep this tab open. Sync runs from your store."
 msgstr ""
 #: includes/class-emporiqa-admin.php:847
+#: includes/class-emporiqa-admin.php:1024
 msgid "Bulk Sync"
 msgstr ""
 #: includes/class-emporiqa-admin.php:849
+#: includes/class-emporiqa-admin.php:1026
 msgid "Use \"Sync All\" for your initial sync. After that, product and page changes are sent automatically in real-time via webhooks."
 msgstr ""
 #: includes/class-emporiqa-admin.php:855
+#: includes/class-emporiqa-admin.php:1032
 msgid "products"
 msgstr ""
 #. translators: %s: language codes
 #: includes/class-emporiqa-admin.php:859
+#: includes/class-emporiqa-admin.php:1036
 #, php-format
 msgid "(all languages synced per product: %s)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:866
+#: includes/class-emporiqa-admin.php:1043
 msgid "No published products found. Make sure you have published products before syncing."
 msgstr ""
 #. translators: %s: link to settings tab
 #: includes/class-emporiqa-admin.php:875
+#: includes/class-emporiqa-admin.php:1052
 #, php-format
 msgid "Product sync is disabled &mdash; <a href=\"%s\">enable it in the Settings tab</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:885
+#: includes/class-emporiqa-admin.php:1062
 msgid "pages"
 msgstr ""
 #. translators: %s: language codes
 #: includes/class-emporiqa-admin.php:889
+#: includes/class-emporiqa-admin.php:1066
 #, php-format
 msgid "(all languages synced per page: %s)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:896
+#: includes/class-emporiqa-admin.php:1073
 msgid "No published pages found. Make sure you have published pages before syncing."
 msgstr ""
 #. translators: %s: link to settings tab
 #: includes/class-emporiqa-admin.php:905
+#: includes/class-emporiqa-admin.php:1082
 #, php-format
 msgid "Page sync is disabled &mdash; <a href=\"%s\">enable it in the Settings tab</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:917
+#: includes/class-emporiqa-admin.php:1094
 msgid "Please configure your Store ID and Connection Secret in the Settings tab before syncing."
 msgstr ""
 #: includes/class-emporiqa-admin.php:929
+#: includes/class-emporiqa-admin.php:1106
 msgid "Sync Products"
 msgstr ""
 #: includes/class-emporiqa-admin.php:931
+#: includes/class-emporiqa-admin.php:1108
 msgid "Send all products to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:936
 #: includes/class-emporiqa-admin.php:957
 #: includes/class-emporiqa-admin.php:976
+#: includes/class-emporiqa-admin.php:1113
+#: includes/class-emporiqa-admin.php:1134
+#: includes/class-emporiqa-admin.php:1153
 msgid "Configure your Store ID and Connection Secret first"
 msgstr ""
 #: includes/class-emporiqa-admin.php:938
+#: includes/class-emporiqa-admin.php:1115
 msgid "Enable product sync in the Settings tab"
 msgstr ""
 #: includes/class-emporiqa-admin.php:950
+#: includes/class-emporiqa-admin.php:1127
 msgid "Sync Pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:952
+#: includes/class-emporiqa-admin.php:1129
 msgid "Send all pages to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:959
+#: includes/class-emporiqa-admin.php:1136
 msgid "Enable page sync in the Settings tab"
 msgstr ""
 #: includes/class-emporiqa-admin.php:971
+#: includes/class-emporiqa-admin.php:1148
 msgid "Sync All"
 msgstr ""
 #: includes/class-emporiqa-admin.php:973
+#: includes/class-emporiqa-admin.php:1150
 msgid "Send all products and pages at once."
 msgstr ""
 #: includes/class-emporiqa-admin.php:984
+#: includes/class-emporiqa-admin.php:1161
 msgid "Cancel"
 msgstr ""
 #: includes/class-emporiqa-admin.php:995
+#: includes/class-emporiqa-admin.php:1172
 msgid "Sync log"
 msgstr ""
 #: includes/class-emporiqa-admin.php:998
+#: includes/class-emporiqa-admin.php:1175
 msgid "Test Connection"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1000
+#: includes/class-emporiqa-admin.php:1177
 msgid "Sends a real product to Emporiqa in dry run mode. Validates the connection, signature, and payload without storing anything."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1004
+#: includes/class-emporiqa-admin.php:1181
 msgid "Test Connection (Dry Run)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1011
+#: includes/class-emporiqa-admin.php:1188
 msgid "WP-CLI Commands (for developers)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1059
+#: includes/class-emporiqa-admin.php:1236
 msgid "Testing..."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1060
+#: includes/class-emporiqa-admin.php:1237
 msgid "Copied!"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1062
+#: includes/class-emporiqa-admin.php:1239
 msgid "Initializing sync..."
 msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1064
+#: includes/class-emporiqa-admin.php:1241
 #, php-format
 msgid "Started %s sync"
 …
 #. translators: 1: number of items, 2: number of events, 3: entity type
 #: includes/class-emporiqa-admin.php:1066
+#: includes/class-emporiqa-admin.php:1243
 #, php-format
 msgid "Processed %1$d items (%2$d events) for %3$s"
 …
 #. translators: %s: entity type
 #: includes/class-emporiqa-admin.php:1068
+#: includes/class-emporiqa-admin.php:1245
 #, php-format
 msgid "Batch failed for %s"
 msgstr ""
+#. translators: 1: entity type (products/pages), 2: seconds
+#: includes/class-emporiqa-admin.php:1247
+#, php-format
+msgid "Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds."
+msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1070
+#: includes/class-emporiqa-admin.php:1249
 #, php-format
 msgid "Completed %s sync session"
 …
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1072
+#: includes/class-emporiqa-admin.php:1251
 #, php-format
 msgid "Failed to complete %s session"
 …
 #. translators: 1: entity type (products/pages), 2: total count
 #: includes/class-emporiqa-admin.php:1074
+#: includes/class-emporiqa-admin.php:1253
 #, php-format
 msgid "Total %1$s synced: %2$d items"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1075
+#: includes/class-emporiqa-admin.php:1254
 msgid "Sync completed successfully!"
 msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1077
+#: includes/class-emporiqa-admin.php:1256
 #, php-format
 msgid "The %s sync session was not finalized because some batches failed: items missing from this sync were NOT removed from Emporiqa. Re-run the sync after resolving the errors."
 …
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1079
+#: includes/class-emporiqa-admin.php:1258
 #, php-format
 msgid "No %s were synced, so the session was not finalized."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1080
+#: includes/class-emporiqa-admin.php:1259
 msgid "Sync finished with errors — see the log above. Re-run the sync after resolving them."
 msgstr ""
 #. translators: 1: Products link placeholder, 2: Pages link placeholder
 #: includes/class-emporiqa-admin.php:1082
+#: includes/class-emporiqa-admin.php:1261
 #, php-format
 msgid "Your data is now being processed by Emporiqa. This may take a few minutes before changes are fully reflected in the chat assistant. You can check the status on the %1$s or %2$s list in your Emporiqa dashboard."
 …
 #. translators: used as link text in sync log
 #: includes/class-emporiqa-admin.php:1086
+#: includes/class-emporiqa-admin.php:1265
 msgid "Products"
 msgstr ""
 #. translators: used as link text in sync log
 #: includes/class-emporiqa-admin.php:1088
+#: includes/class-emporiqa-admin.php:1267
 msgid "Pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1089
+#: includes/class-emporiqa-admin.php:1268
 msgid "Sync cancelled."
 msgstr ""
 #. translators: %s: error message
 #: includes/class-emporiqa-admin.php:1091
+#: includes/class-emporiqa-admin.php:1270
 #, php-format
 msgid "Sync failed: %s"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1092
+#: includes/class-emporiqa-admin.php:1271
 msgid "Failed to initialize sync."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1093
+#: includes/class-emporiqa-admin.php:1272
 msgid "Sample product payload"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1094
+#: includes/class-emporiqa-admin.php:1273
 msgid "Sample page payload"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1111
+#: includes/class-emporiqa-admin.php:1290
 #: includes/class-emporiqa-sync.php:65
 #: includes/class-emporiqa-sync.php:161
 #: includes/class-emporiqa-sync.php:201
+#: includes/class-emporiqa-sync.php:165
+#: includes/class-emporiqa-sync.php:209
 msgid "Permission denied."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:81
 #: includes/class-emporiqa-cart-ajax.php:190
 #: includes/class-emporiqa-cart-ajax.php:229
+#: includes/class-emporiqa-cart-ajax.php:89
+#: includes/class-emporiqa-cart-ajax.php:198
+#: includes/class-emporiqa-cart-ajax.php:237
 msgid "No product ID provided."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:90
+#: includes/class-emporiqa-cart-ajax.php:98
 msgid "Product not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:95
+#: includes/class-emporiqa-cart-ajax.php:103
 msgid "This product cannot be purchased."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:98
+#: includes/class-emporiqa-cart-ajax.php:106
 msgid "This product is currently out of stock."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:109
+#: includes/class-emporiqa-cart-ajax.php:117
 msgid "Parent product not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:119
+#: includes/class-emporiqa-cart-ajax.php:127
 msgid "Please select a product variation."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:128
+#: includes/class-emporiqa-cart-ajax.php:136
 msgid "Variation not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:131
+#: includes/class-emporiqa-cart-ajax.php:139
 msgid "This variation cannot be purchased."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:134
+#: includes/class-emporiqa-cart-ajax.php:142
 msgid "This variation is currently out of stock."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:144
+#: includes/class-emporiqa-cart-ajax.php:152
 msgid "Failed to add item to cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:194
+#: includes/class-emporiqa-cart-ajax.php:202
 msgid "Quantity must be greater than zero."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:199
 #: includes/class-emporiqa-cart-ajax.php:234
+#: includes/class-emporiqa-cart-ajax.php:207
+#: includes/class-emporiqa-cart-ajax.php:242
 msgid "Item not found in cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:206
+#: includes/class-emporiqa-cart-ajax.php:214
 msgid "Failed to update cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:241
+#: includes/class-emporiqa-cart-ajax.php:249
 msgid "Failed to remove item."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:316
+#: includes/class-emporiqa-cart-ajax.php:326
 msgid "Security check failed. Please refresh the page and try again."
 msgstr ""
 #: includes/class-emporiqa-connect.php:145
+#: includes/class-emporiqa-connect.php:160
 msgid "Couldn't save the connection state. Please try again."
 msgstr ""
 #: includes/class-emporiqa-connect.php:194
+#: includes/class-emporiqa-connect.php:209
 msgid "Unexpected redirect source."
 msgstr ""
 #: includes/class-emporiqa-connect.php:199
+#: includes/class-emporiqa-connect.php:214
 msgid "Callback missing required parameters."
 msgstr ""
 #: includes/class-emporiqa-connect.php:207
+#: includes/class-emporiqa-connect.php:222
 msgid "Connection link expired or already used. Click Connect to try again."
 msgstr ""
 #. translators: %s: WP HTTP API error message
 #: includes/class-emporiqa-connect.php:237
+#: includes/class-emporiqa-connect.php:255
 #, php-format
 msgid "Couldn't reach Emporiqa: %s"
 …
 #. translators: %s: error code from the exchange endpoint
 #: includes/class-emporiqa-connect.php:253
+#: includes/class-emporiqa-connect.php:278
 #, php-format
 msgid "Emporiqa refused the connection: %s"
 msgstr ""
 #: includes/class-emporiqa-formatter.php:941
 #: includes/class-emporiqa-formatter.php:952
+#: includes/class-emporiqa-formatter.php:869
+#: includes/class-emporiqa-formatter.php:880
 msgid "General"
 msgstr ""
 #: includes/class-emporiqa-formatter.php:1021
+#: includes/class-emporiqa-formatter.php:1245
 msgid "Generic"
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:80
+#: includes/class-emporiqa-order-tracking.php:96
 msgid "Missing signature."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:89
 #: includes/class-emporiqa-order-tracking.php:99
+#: includes/class-emporiqa-order-tracking.php:105
+#: includes/class-emporiqa-order-tracking.php:115
 msgid "Invalid signature."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:108
+#: includes/class-emporiqa-order-tracking.php:124
 msgid "Invalid JSON in request body."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:117
+#: includes/class-emporiqa-order-tracking.php:133
 msgid "Request expired."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:158
+#: includes/class-emporiqa-order-tracking.php:197
 msgid "Invalid payload: order_identifier is required."
 msgstr ""
+#: includes/class-emporiqa-order-tracking.php:185
+#: includes/class-emporiqa-order-tracking.php:205
+#: includes/class-emporiqa-order-tracking.php:303
+#: includes/class-emporiqa-order-tracking.php:312
+msgid "Order not found."
+msgstr ""
+#: includes/class-emporiqa-order-tracking.php:230
 msgid "Too many requests. Please try again later."
-msgstr ""
-#: includes/class-emporiqa-order-tracking.php:251
-#: includes/class-emporiqa-order-tracking.php:260
-msgid "Order not found."
 msgstr ""
 …
 msgstr ""
 #: includes/class-emporiqa-sync.php:217
+#: includes/class-emporiqa-sync.php:225
 msgid "Unknown or expired sync session — it was not finalized. Re-run the sync."
 msgstr ""
 #. translators: 1: number of items that failed, 2: entity type (products or pages).
 #: includes/class-emporiqa-sync.php:228
+#: includes/class-emporiqa-sync.php:236
 #, php-format
 msgid "The %2$s sync session was not finalized because %1$d item(s) failed to sync: items missing from this sync were NOT removed from Emporiqa. Re-run the sync after resolving the errors."
 msgstr ""
+#: includes/class-emporiqa-sync.php:240
+#. translators: %s: entity type (products or pages).
+#: includes/class-emporiqa-sync.php:250
+#, php-format
+msgid "The %s sync session was not finalized because Emporiqa asked to wait and a batch was not sent again: items missing from this sync were NOT removed from Emporiqa. Re-run the sync."
+msgstr ""
+#: includes/class-emporiqa-sync.php:261
 msgid "No items were synced in this session, so it was not finalized (finalizing an empty session would delete the entire remote catalog)."
 msgstr ""
 #: includes/class-emporiqa-sync.php:249
+#: includes/class-emporiqa-sync.php:270
 msgid "Session completed."
 msgstr ""
 #: includes/class-emporiqa-sync.php:252
+#: includes/class-emporiqa-sync.php:273
 msgid "Failed to complete sync session."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:915
+#: includes/class-emporiqa-webhook.php:989
 msgid "Unknown error"
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1000
+#: includes/class-emporiqa-webhook.php:1074
 msgid "Store ID is not configured."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1009
+#: includes/class-emporiqa-webhook.php:1083
 msgid "Connection Secret is not configured."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1018
+#: includes/class-emporiqa-webhook.php:1092
 msgid "No published products found. Add a product before testing."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1027
+#: includes/class-emporiqa-webhook.php:1101
 msgid "Failed to format product for dry run."
 msgstr ""
+#: includes/class-emporiqa-webhook.php:1058
+#. translators: %d: number of minutes
+#: includes/class-emporiqa-webhook.php:1123
+#, php-format
+msgid "This server's clock is %d minutes off. Ask your host to turn on time synchronisation (NTP): Emporiqa refuses data sent with a clock more than 5 minutes off."
+msgstr ""
+#: includes/class-emporiqa-webhook.php:1149
 msgid "Connection successful, but there are warnings."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1059
+#: includes/class-emporiqa-webhook.php:1150
 msgid "Connection successful! All fields validated."
 msgstr ""
 #. translators: %s: human-readable error message from the Emporiqa server
 #: includes/class-emporiqa-webhook.php:1067
+#: includes/class-emporiqa-webhook.php:1158
 #, php-format
 msgid "Connection failed: %s"
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1174
+#: includes/class-emporiqa-webhook.php:1249
 msgid "Webhook not configured (missing Store ID)."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1183
+#: includes/class-emporiqa-webhook.php:1258
 msgid "Connection Secret is not configured. Go to Settings > Emporiqa to set it."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1196
+#: includes/class-emporiqa-webhook.php:1271
 msgid "Failed to encode payload as JSON."
 msgstr ""
 #. translators: %d: HTTP status code
 #: includes/class-emporiqa-webhook.php:1249
+#: includes/class-emporiqa-webhook.php:1323
 #, php-format
 msgid "Unexpected status code: %d"

emporiqa/tags/1.2.0/readme.txt

-              r3725261
+              r3730094
 Contributors: rosenhristov1
 Tags: ai chatbot, live chat, woocommerce chatbot, ecommerce chatbot, ai customer support
 Requires at least: 6.0
+Requires at least: 6.2
 Tested up to: 7.1
 Requires Plugins: woocommerce
 Requires PHP: 7.4
 WC requires at least: 8.0
 WC tested up to: 10.9
 Stable tag: 1.1.10
+WC tested up to: 11.1
+Stable tag: 1.2.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 Price, stock and status changes reach Emporiqa as you make them; a few edits need one Sync All afterwards, which the [documentation](https://emporiqa.com/docs/woocommerce/) covers. The same chatbot also runs on Drupal Commerce, Magento, PrestaShop, Shopware and Sylius.
+= Privacy and security notes =
+The signed-in shopper's token is fetched from `admin-ajax.php?action=emporiqa_customer_token`. It is read-only and returns only the current session's own identity token. It cannot be nonce-protected, because the page that would carry the nonce is full-page cached; cross-site use is blocked instead by a required custom header (which forces a CORS preflight) and a Sec-Fetch-Site / Origin check, and the answer is never cached.
 = Third-Party Service =
 This plugin requires an [Emporiqa](https://emporiqa.com) account and sends data there. Your catalog and synced pages go to `https://emporiqa.com/webhooks/sync/`, signed with HMAC-SHA256; the widget script loads from `https://emporiqa.com/chat/embed/`; connecting uses a PKCE handshake via `https://emporiqa.com/connect/start`. What a shopper types, and any photo uploaded for visual search, is processed by Emporiqa's AI provider and never trains AI models. If you switch on voice mode, a shopper's spoken message goes to that provider to be turned into text and the reply is read aloud by an AI voice; Emporiqa does not keep the recording. Emporiqa may call your REST API for an order status. [Terms of Service](https://emporiqa.com/terms-of-service/), [Privacy Policy](https://emporiqa.com/privacy-policy/).
+This plugin requires an [Emporiqa](https://emporiqa.com) account and sends data there. Your catalog and synced pages go to `https://emporiqa.com/webhooks/sync/`, signed with HMAC-SHA256; the widget script loads from `https://emporiqa.com/chat/embed/`; connecting uses a PKCE handshake via `https://emporiqa.com/connect/start`. What a shopper types, and any photo uploaded for visual search, is processed by Emporiqa's AI provider and never trains AI models. If you switch on voice mode, a shopper's spoken message goes to that provider to be turned into text and the reply is read aloud by an AI voice; Emporiqa does not keep the recording. Sync requests carry the plugin version (`X-Emporiqa-Plugin-Version`). If you add the Order status rule, Emporiqa calls this site's `/wp-json/emporiqa/v1/actions/order-status` with a signed request to look up the order a shopper asks about; the older order tracking address `/wp-json/emporiqa/api/order/tracking` keeps working while you use it. When a shopper is signed in to your store, the chat sends Emporiqa their WordPress user ID (signed, never their name or email), so Order status can find their own orders without an email and `/wp-json/emporiqa/v1/actions/customer-prices` can answer with the prices your shop gives that customer. Emporiqa also calls `/wp-json/emporiqa/v1/actions/verify` to check the address is yours. Each of these answers only a request signed with your store's connection secret (HMAC-SHA256, within 5 minutes), checked by the route's permission callback; the one unsigned call is the connect check, answered only during a connection you started in the last 2 minutes. [Terms of Service](https://emporiqa.com/terms-of-service/), [Privacy Policy](https://emporiqa.com/privacy-policy/).
 == Installation ==
 …
 . Order tracking: the chat asks for an order number and matching email
 . Dashboard (demo store data): chat status, spend, revenue from chat
 . Billing: pay-as-you-go, $0.00 a month, $0.25 a conversation, $59 cap
+. Billing: pay-as-you-go at $0.25 a conversation, capped at $59 a month, with the next billing date
 . Voice mode, if you switch it on: the answer is read aloud in an AI voice while the product cards stay on screen
 == Changelog ==
+= 1.2.0 =
+* New: Order status, a ready-made rule. Shoppers ask "where is my order?" and the chat answers from your WooCommerce orders: status, order date and tracking numbers (WooCommerce Shipment Tracking and Advanced Shipment Tracking are read when installed). A signed-in shopper only gives the order number; a guest also gives the order's email. Settings > Emporiqa shows the Order status address to copy into the rule in Emporiqa, and whether the rule is on.
+* Changed: a signed-in shopper's identity is no longer written into the page or the chat script's URL, where a full-page cache could hand it to another shopper and server logs could keep it. The chat asks for it when it opens, from an uncached request.
+* Changed: the old order tracking keeps working as before and stays on. Where ready-made rules are offered it moves under Advanced, with how to switch it off once the Order status rule replaces it.
+* Changed: sync requests are also signed with Emporiqa's newer per-purpose keys and carry the plugin version; connecting proves the request came from your site; a connection Emporiqa holds for an owner's approval shows Emporiqa's own explanation.
+* Changed: prices are sent as your shop shows them. A shop that enters prices without tax but shows them with tax (or the reverse) used to send the entered amount; prices with and without tax are now both sent when taxes are on.
+* Fix: prices are always synced as a signed-out visitor sees them, with tax at your shop's address. A role, B2B or wholesale pricing plugin could otherwise send the price of whoever saved the product or ran the sync as the public price. The chat's cart now shows each item's price with or without tax as your cart page does.
+* Fix: Sync All pages through products and pages by id, so a product changed during a sync can no longer be skipped and then removed from Emporiqa.
+* Fix: an order conversion that Emporiqa could not receive after every retry is sent again at the order's next paid status.
+* Changed: a language you did not tick under Languages (Polylang or WPML) is neither synced nor offered: its pages show no chat.
+* New: customer prices. Emporiqa can ask this site for a signed-in shopper's own prices (`actions/customer-prices`), read by WooCommerce as that shopper with tax for their address. WooCommerce has one price per product, so this is your public price unless a role, B2B or wholesale pricing plugin gives that customer another; only prices are returned, and products the shopper cannot see are left out.
+* New: quantity price tiers. The Tiered Price Table plugin's tiers are sent when it is active, and the `emporiqa_price_tiers` filter lets any other quantity-pricing plugin send its own (WooCommerce has none of its own); each tier is the unit price the cart charges, with tax as your shop shows prices.
+* Changed: the signed-in shopper's token request requires a custom header and refuses cross-site requests; guests no longer reach it at all.
+* Fix: the old order tracking reads a typed number only as an order number, never as another order's internal id.
+* Test connection warns when this server's clock is more than 2 minutes off.
+* Changed: a variation is sent without the description, categories and brand it shares with its product, and Emporiqa reads them from the product, so syncs send less.
+* Fix: moving a variable product to the Trash now removes its variations from Emporiqa straight away, not only at the next Sync All.
+* Fix: on a page served from a full-page cache long enough for its security token to expire, the chat's first add to cart no longer fails with "Security check failed"; it is retried once with a fresh token.
+* Fix: when Emporiqa is busy and asks a sync to slow down, Sync All and the WP-CLI sync wait as asked and send the same batch again, instead of failing the sync and blocking the next one for an hour.
+* Fix: the chat's cart actions now refuse requests sent from another website, and a guest's cart security token is tied to that guest's own cart.
+* Fix: the Mini-Cart block of block themes (such as Twenty Twenty-Five) now updates when the chat adds or removes items; it used to show the old count until the page was reloaded.
+* Changed: requires WordPress 6.2, the oldest version WooCommerce 8.0 runs on. The signed-in shopper's token answer is marked no-store and private on every supported WordPress version.
 = 1.1.10 =
 …
 * Text only. No functional changes.
-= 1.1.9 =
-* Fix: a full sync now finalizes only when every batch succeeds, so a failed batch can no longer drop items still present in your store from the chat's index. Nothing in your WooCommerce store was ever modified.
-* Fix: variable products with parent-managed stock no longer over-report quantity, and decimal quantities are no longer truncated in the cart.
 Older entries are in changelog.txt, shipped with the plugin.
 == Upgrade Notice ==
+= 1.2.0 =
+Adds the Order status rule, and keeps a signed-in shopper's identity out of cached pages. Old order tracking keeps working; nothing to do after updating.
 = 1.1.10 =
 Text-only update: the plugin's setup instructions now match the renamed Integration section of the Emporiqa dashboard.
-= 1.1.9 =
-Important fix: a bulk sync that hit errors could remove valid products or pages from your Emporiqa catalog. Syncs now finalize only when every batch succeeds. Also fixes over-reported stock and truncated decimal quantities.

emporiqa/tags/1.2.0/uninstall.php

-              r3546004
+              r3730094
 delete_option( 'emporiqa_pending_async_events' );
 delete_option( 'emporiqa_instance_id' );
+delete_option( 'emporiqa_rules_status' );
 // Clean up retry transients + one-click connect handshake transients.
 …
+}
+// Clean up dispatch payload transients (1.1.3+).
+$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_emporiqa_event_%' OR option_name LIKE '_transient_timeout_emporiqa_event_%'" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+// Clean up dispatch payload transients (1.1.3+) and the Order status
+// rate-limit and request-replay transients (1.2.0+).
+$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_emporiqa_event_%' OR option_name LIKE '_transient_timeout_emporiqa_event_%' OR option_name LIKE '_transient_emporiqa_arl_%' OR option_name LIKE '_transient_timeout_emporiqa_arl_%' OR option_name LIKE '_transient_emporiqa_areq_%' OR option_name LIKE '_transient_timeout_emporiqa_areq_%'" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
 // Clean up order meta.

emporiqa/trunk/admin/css/emporiqa-admin.css

-              r3506790
+              r3730094
         color: #1d2327;
+}
+/* Ready-made rules: On / Not added */
+.emporiqa-rule-state {
+        display: inline-block;
+        padding: 2px 8px;
+        border-radius: 3px;
+        background: #f0f0f1;
+        color: #50575e;
+        font-weight: 600;
+        vertical-align: middle;
+}
+.emporiqa-rule-state.emporiqa-rule-on {
+        background: #edfaef;
+        color: #00701a;
+}

emporiqa/trunk/admin/js/emporiqa-admin.js

-              r3601468
+              r3730094
         var syncRunning   = false;
         var currentXhr    = null;
+        // Consecutive waits for one batch before it counts as failed.
+        var MAX_BATCH_WAITS = 30;
         /**
 …
                                 var totalItems    = productCount + pageCount;
+                                // Build work queue: for each session, calculate pages.
+                                // Build work queue: one entry per session. Each entry is
+                                // paged by id (after_id) until the server says it is done,
+                                // so items changing mid-sync never shift the pages.
                                 var workQueue    = [];
                                 var sessionCount = sessions.length;
                                 var s, itemCount, totalPages, p;
+                                var s;
                                 for ( s = 0; s < sessionCount; s++ ) {
-                                        itemCount = 0;
-                                        if ( 'products' === sessions[ s ].entity ) {
-                                                itemCount = productCount;
-                                        } else if ( 'pages' === sessions[ s ].entity ) {
-                                                itemCount = pageCount;
+                                        }
-                                        totalPages = Math.ceil( itemCount / itemsPerBatch );
                                         addLogEntry(
                                                 sprintf(
 …
                                         );
+                                        for ( p = 1; p <= totalPages; p++ ) {
+                                                        workQueue.push(
+                                                                {
+                                                                        entity: sessions[ s ].entity,
+                                                                        language: sessions[ s ].language,
+                                                                        session_id: sessions[ s ].session_id,
+                                                                        page: p,
+                                                                        items_per_batch: itemsPerBatch
+                                                                }
+                                                        );
+                                        }
+                                        workQueue.push(
+                                                {
+                                                        entity: sessions[ s ].entity,
+                                                        language: sessions[ s ].language,
+                                                        session_id: sessions[ s ].session_id,
+                                                        after_id: 0,
+                                                        items_per_batch: itemsPerBatch,
+                                                        waits: 0
+                                                }
+                                        );
+                                }
 …
                                         var work = workQueue[ batchIndex ];
-                                        batchIndex++;
                                         currentXhr = $.post(
 …
                                                         language: work.language,
                                                         session_id: work.session_id,
                                                         page: work.page,
+                                                        after_id: work.after_id,
                                                         items_per_batch: work.items_per_batch
+                                                }
                                         ).done(
                                                 function ( batchResponse ) {
+                                                        var waitSeconds = batchResponse.success && batchResponse.data ? parseInt( batchResponse.data.retry_after, 10 ) || 0 : 0;
+                                                        if ( waitSeconds > 0 && work.waits < MAX_BATCH_WAITS ) {
+                                                                // Emporiqa asked to wait (its queue is full): send the
+                                                                // same batch again; the server holds it as pending.
+                                                                work.waits++;
+                                                                addLogEntry(
+                                                                        sprintf(
+                                                                                i18n.batchWait || 'Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds.',
+                                                                                work.entity,
+                                                                                waitSeconds
+                                                                        ),
+                                                                        'warning'
+                                                                );
+                                                                setTimeout( processBatch, waitSeconds * 1000 );
+                                                                return;
+                                                        }
+                                                        work.waits = 0;
                                                         if ( batchResponse.success && batchResponse.data ) {
                                                                 var batchProcessed = batchResponse.data.processed || 0;
 …
                                                         if ( totalItems > 0 ) {
+                                                                updateProgress( ( processed / totalItems ) * 100 );
+                                                                updateProgress( Math.min( 99, ( processed / totalItems ) * 100 ) );
+                                                        }
+                                                        var batchData = ( batchResponse.success && batchResponse.data ) || {};
+                                                        var lastId    = parseInt( batchData.last_id, 10 ) || 0;
+                                                        if ( batchData.done || lastId <= work.after_id ) {
+                                                                batchIndex++;
+                                                        } else {
+                                                                work.after_id = lastId;
+                                                        }
 …
                                                                 );
+                                                        }
+                                                        // Where the next batch starts is unknown, so the rest
+                                                        // of this session is skipped; the failure above keeps
+                                                        // the session from being finalized.
+                                                        batchIndex++;
                                                         processBatch();
+                                                }

emporiqa/trunk/assets/js/emporiqa-cart.js

-              r3491860
+              r3730094
          * Automatically updates the nonce from each response to keep
          * long-lived browser sessions working beyond the default 24h expiry.
+         *
+         * @param {string}      action The WordPress AJAX action name.
+         * @param {Object|null} data   Additional key-value pairs for the request body.
+         * A nonce refusal is retried once with the fresh nonce it carries: a page
+         * served from a full-page cache can hold an expired nonce, or a guest's
+         * nonce for a signed-in shopper, and the refused request changed nothing.
+         *
+         * @param {string}      action  The WordPress AJAX action name.
+         * @param {Object|null} data    Additional key-value pairs for the request body.
+         * @param {boolean}     retried True on the retry after a nonce refusal.
          * @return {Promise<Object>} Parsed JSON response matching the EmporiqaCartHandler spec.
          */
         function emporiqaAjax( action, data ) {
+        function emporiqaAjax( action, data, retried ) {
                 var formData = new FormData();
                 formData.append( 'action', action );
 …
                                 config.nonce = result.nonce;
+                        }
+                        return result;
+                } );
+        }
+        /**
+         * Trigger WooCommerce mini-cart fragment refresh after cart changes.
+         */
+        function refreshCartFragments() {
+                        if ( ! retried && result && result.success === false && result.code === 'invalid_nonce' && result.nonce ) {
+                                return emporiqaAjax( action, data, true );
+                        }
+                        return result;
+                } );
+        }
+        /**
+         * Tell the page's mini-cart that the cart changed.
+         *
+         * Classic themes refresh their cart fragments on wc_fragment_refresh.
+         * The Mini-Cart block of block themes ignores that and refetches the
+         * cart on wc-blocks_added_to_cart / wc-blocks_removed_from_cart.
+         *
+         * @param {boolean} removed True when items were removed (remove, clear).
+         */
+        function refreshCartFragments( removed ) {
                 if ( typeof jQuery !== 'undefined' ) {
                         jQuery( document.body ).trigger( 'wc_fragment_refresh' );
+                }
+                if ( typeof document !== 'undefined' && document.body && typeof window.Event === 'function' ) {
+                        document.body.dispatchEvent(
+                                new window.Event( removed ? 'wc-blocks_removed_from_cart' : 'wc-blocks_added_to_cart', { bubbles: true } )
+                        );
+                }
+        }
 …
                 return emporiqaAjax( 'emporiqa_remove_from_cart', data ).then( function( result ) {
                         if ( result.success ) {
                                 refreshCartFragments();
+                                refreshCartFragments( true );
+                        }
                         return result;
 …
                 return emporiqaAjax( 'emporiqa_clear_cart' ).then( function( result ) {
                         if ( result.success ) {
                                 refreshCartFragments();
+                                refreshCartFragments( true );
+                        }
                         return result;

emporiqa/trunk/changelog.txt

-              r3678094
+              r3730094
 Older Emporiqa releases. The two most recent versions are in readme.txt.
+= 1.1.9 =
+* Fix: a full sync now finalizes only when every batch succeeds, so a failed batch can no longer drop items still present in your store from the chat's index. Nothing in your WooCommerce store was ever modified.
+* Fix: variable products with parent-managed stock no longer over-report quantity, and decimal quantities are no longer truncated in the cart.
 = 1.1.8 =

emporiqa/trunk/cli/class-emporiqa-cli.php

-              r3601468
+              r3730094
                 $synced   = 0;
                 $errors   = 0;
                 $page     = 1;
+                $after_id = 0;
                 $per_page = 100;
+                // Keyset by id, not OFFSET: a product disabled mid-sync must not
+                // shift the pages and get a live one skipped (and then deleted from
+                // Emporiqa when the session completes).
                 while ( true ) {
                         $query_args = array(
+                                'status' => 'publish',
+                                'limit'  => $per_page,
+                                'page'   => $page,
+                                'type'   => Emporiqa_Admin::get_product_types(),
+                                'status'            => 'publish',
+                                'limit'             => $per_page,
+                                'orderby'           => 'ID',
+                                'order'             => 'ASC',
+                                'type'              => Emporiqa_Admin::get_product_types(),
+                                'emporiqa_after_id' => $after_id,
                         );
 …
+                        }
+                        $products = wc_get_products( $query_args );
+                        $products = Emporiqa_Sync::query_after_id(
+                                function () use ( $query_args ) {
+                                        return wc_get_products( $query_args );
+                                }
+                        );
                         if ( empty( $products ) ) {
                                 break;
 …
                         foreach ( $products as $product ) {
+                                $after_id  = max( $after_id, (int) $product->get_id() );
                                 $formatted = $formatter->format_product_consolidated( $product, $session_id );
                                 foreach ( $formatted as $item ) {
 …
                         wp_cache_flush();
-                        ++$page;
+                }
 …
                 $synced   = 0;
                 $errors   = 0;
                 $paged    = 1;
+                $after_id = 0;
                 $per_page = 100;
                 while ( true ) {
                         $query_args = array(
+                                'post_type'        => $post_types,
+                                'post_status'      => 'publish',
+                                'posts_per_page'   => $per_page,
+                                'paged'            => $paged,
+                                'suppress_filters' => false,
+                                'post_type'         => $post_types,
+                                'post_status'       => 'publish',
+                                'posts_per_page'    => $per_page,
+                                'orderby'           => 'ID',
+                                'order'             => 'ASC',
+                                'no_found_rows'     => true,
+                                'suppress_filters'  => false,
+                                'emporiqa_after_id' => $after_id,
                         );
 …
+                        }
+                        $pages = get_posts( $query_args );
+                        $pages = Emporiqa_Sync::query_after_id(
+                                function () use ( $query_args ) {
+                                        return get_posts( $query_args );
+                                }
+                        );
                         if ( empty( $pages ) ) {
                                 break;
 …
                         foreach ( $pages as $page ) {
+                                $after_id  = max( $after_id, (int) $page->ID );
                                 $formatted = $formatter->format_page_consolidated( $page, $session_id );
                                 if ( ! empty( $formatted ) ) {
 …
                         wp_cache_flush();
-                        ++$paged;
+                }

emporiqa/trunk/emporiqa.php

-              r3678232
+              r3730094
  * Plugin Name: Emporiqa
  * Description: Integrates WooCommerce with Emporiqa chat assistant.
  * Version:     1.1.10
+ * Version:     1.2.0
  * Author:      Emporiqa
  * Author URI:  https://emporiqa.com
 …
  * Text Domain: emporiqa
  * Domain Path: /languages
  * Requires at least: 6.0
+ * Requires at least: 6.2
  * Tested up to: 7.1
  * Requires PHP: 7.4
  * Requires Plugins: woocommerce
  * WC requires at least: 8.0
  * WC tested up to: 10.9
+ * WC tested up to: 11.1
+ *
  * @package Emporiqa
 …
+}
 define( 'EMPORIQA_VERSION', '1.1.10' );
+define( 'EMPORIQA_VERSION', '1.2.0' );
 define( 'EMPORIQA_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'EMPORIQA_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 …
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-widget.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-tracking.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-signature.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-status.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-customer-prices.php';
+require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-actions.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-cart-ajax.php';
 require_once EMPORIQA_PLUGIN_DIR . 'includes/class-emporiqa-order-webhook.php';
 …
          */
         private Emporiqa_Order_Tracking $order_tracking;
+        /**
+         * Ready-made rules endpoints (Order status, customer prices, verify).
+         *
+         * @var Emporiqa_Actions
+         */
+        private Emporiqa_Actions $actions;
         /**
 …
                 $this->widget         = new Emporiqa_Widget();
                 $this->order_tracking = new Emporiqa_Order_Tracking();
+                $this->actions        = new Emporiqa_Actions();
                 $this->cart_ajax      = new Emporiqa_Cart_Ajax();
                 $this->order_webhook  = new Emporiqa_Order_Webhook();
 …
         private function init_hooks(): void {
                 add_action( 'woocommerce_init', array( $this, 'init_woocommerce_hooks' ) );
+                // Quantity tiers of the Tiered Price Table plugin, when it is active.
+                add_filter( 'emporiqa_price_tiers', array( 'Emporiqa_Formatter', 'tiered_price_table_tiers' ), 5, 2 );
                 // Page-save entry point. Inside the handler we skip when Polylang is
 …
                 add_action( 'woocommerce_new_product', array( $this, 'handle_product_created' ) );
                 add_action( 'woocommerce_update_product', array( $this, 'handle_product_updated' ) );
+                add_action( 'wp_trash_post', array( $this, 'handle_product_trashed' ) );
+                // Before WooCommerce's own wp_trash_post (priority 10) trashes the
+                // variations, so the variation deletes can still be found and sent.
+                add_action( 'wp_trash_post', array( $this, 'handle_product_trashed' ), 5 );
                 add_action( 'untrashed_post', array( $this, 'handle_product_untrashed' ) );
                 add_action( 'woocommerce_new_product_variation', array( $this, 'handle_variation_created' ) );
 …
          * wp_trash_post fires when a product is moved to trash. WooCommerce's
          * woocommerce_update_product does NOT fire on trash, so this is needed.
+         * Cannot go through format_product_consolidated because WooCommerce
+         * trashes child variations before this hook fires at priority 10.
+         * Runs at priority 5, before WooCommerce trashes the child variations at
+         * priority 10, so queue_product_delete() still sees them and deletes
+         * them too; afterwards get_children() no longer returns them.
+         *
          * @since 1.0.0

emporiqa/trunk/includes/class-emporiqa-admin.php

-              r3678094
+              r3730094
          */
         private string $option_name = 'emporiqa_options';
+        /**
+         * Option holding what Emporiqa last said about ready-made rules.
+         */
+        public const RULES_STATUS_OPTION = 'emporiqa_rules_status';
         /**
 …
+                }
+                // The checkbox is on the page only where ready-made rules are offered;
+                // elsewhere a save keeps the stored value (on by default).
+                if ( isset( $input['order_tracking_shown'] ) ) {
+                        $sanitized['order_tracking'] = ! empty( $input['order_tracking'] );
+                } else {
+                        $existing                    = get_option( $this->option_name, array() );
+                        $sanitized['order_tracking'] = ! is_array( $existing ) || ! isset( $existing['order_tracking'] ) || (bool) $existing['order_tracking'];
+                }
                 $batch_size = absint( $input['batch_size'] ?? 25 );
                 if ( $batch_size < 1 || $batch_size > 100 ) {
 …
                                         <?php $this->render_connection_section( $options ); ?>
+                                        <?php $this->render_rules_section( $options ); ?>
                                         <?php $this->render_advanced_section( $options ); ?>
 …
+                }
+                $this->render_order_tracking_row();
+                // Where ready-made rules are offered, order tracking moves under
+                // Advanced as the old way; elsewhere it stays here as before.
+                if ( ! self::rules_status()['available'] ) {
+                        $this->render_order_tracking_row();
+                }
                 $this->render_section_close();
+        }
+        /**
+         * Render the Ready-made rules section: shown once Emporiqa has said, at
+         * connect or on Test connection, that this store has them.
+         *
+         * @since 1.2.0
+         *
+         * @param array $options Current options.
+         */
+        private function render_rules_section( array $options ): void {
+                $status = self::rules_status();
+                if ( ! $status['available'] ) {
+                        return;
+                }
+                $live          = in_array( 'order_status', $status['live'], true );
+                $address       = Emporiqa_Actions::base_url();
+                $platform_base = rtrim( (string) apply_filters( 'emporiqa_connect_base_url', 'https://emporiqa.com' ), '/' );
+                $this->render_section_open( 'emporiqa-section-rules', __( 'Ready-made rules', 'emporiqa' ), true );
+                ?>
+                <p style="margin:0 0 12px 0;color:#50575e;">
+                        <?php esc_html_e( 'Rules tell the chat what to do when a shopper asks for something specific. The rule below reads your WooCommerce orders through this plugin. Click Open in Emporiqa to test it and switch it on there. Rules that do not need your shop, such as return requests, are added in Emporiqa under Settings > Rules.', 'emporiqa' ); ?>
+                </p>
+                <?php if ( $live && ! empty( $options['order_tracking'] ) ) : ?>
+                        <div class="notice notice-info inline" style="margin:0 0 12px 0;">
+                                <p><?php esc_html_e( 'The Order status rule is on, so the old order tracking under Advanced is no longer needed. First remove its address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick Order tracking under Advanced and click Save Changes.', 'emporiqa' ); ?></p>
+                        </div>
+                <?php endif; ?>
+                <table class="form-table" role="presentation">
+                        <tr>
+                                <th scope="row"><label for="emporiqa_order_status_address"><?php esc_html_e( 'Order status address', 'emporiqa' ); ?></label></th>
+                                <td>
+                                        <?php if ( '' !== $address ) : ?>
+                                                <div class="emporiqa-readonly-field">
+                                                        <input type="text" id="emporiqa_order_status_address" value="<?php echo esc_attr( $address ); ?>" class="regular-text" readonly />
+                                                        <button type="button" class="button emporiqa-copy-btn" data-copy-target="emporiqa_order_status_address">
+                                                                <?php esc_html_e( 'Copy', 'emporiqa' ); ?>
+                                                        </button>
+                                                </div>
+                                                <p class="description"><?php esc_html_e( 'Emporiqa fills this in for you when you add the Order status rule. If it ever asks for the address, use this one.', 'emporiqa' ); ?></p>
+                                        <?php else : ?>
+                                                <p class="description"><?php esc_html_e( 'Your site is not served over https, so Emporiqa cannot call it. Switch the site to https (Settings > General), then come back here.', 'emporiqa' ); ?></p>
+                                        <?php endif; ?>
+                                </td>
+                        </tr>
+                        <tr>
+                                <th scope="row"><?php esc_html_e( 'Order status', 'emporiqa' ); ?></th>
+                                <td>
+                                        <?php if ( $live ) : ?>
+                                                <span class="emporiqa-rule-state emporiqa-rule-on"><?php esc_html_e( 'On', 'emporiqa' ); ?></span>
+                                        <?php else : ?>
+                                                <span class="emporiqa-rule-state"><?php esc_html_e( 'Not added', 'emporiqa' ); ?></span>
+                                        <?php endif; ?>
+                                        <a href="<?php echo esc_url( $platform_base . '/platform/rules/?add=order_status' ); ?>" class="button" target="_blank" rel="noopener noreferrer" style="margin-left:8px;">
+                                                <?php esc_html_e( 'Open in Emporiqa', 'emporiqa' ); ?>
+                                                <span class="dashicons dashicons-external" style="vertical-align:middle;font-size:14px;line-height:1;margin-left:2px;"></span>
+                                        </a>
+                                        <p class="description">
+                                                <?php esc_html_e( 'Answers "Where is my order?" from your WooCommerce orders. A shopper signed in to your shop only gives the order number; a guest also gives the email used for the order.', 'emporiqa' ); ?>
+                                        </p>
+                                        <p class="description">
+                                                <?php esc_html_e( 'On and Not added show what Emporiqa said at your last connect or Test connection (Sync tab). Run Test connection after changing a rule to refresh them.', 'emporiqa' ); ?>
+                                        </p>
+                                </td>
+                        </tr>
+                </table>
+                <?php
+                $this->render_section_close();
+        }
+        /**
+         * The old order tracking under Advanced, where ready-made rules are
+         * offered: its address and an on/off checkbox, labelled as replaced.
+         *
+         * @param array $options Current options.
+         */
+        private function render_legacy_order_tracking_rows( array $options ): void {
+                $tracking_url = rest_url( 'emporiqa/api/order/tracking' );
+                ?>
+                <tr>
+                        <th scope="row"><?php esc_html_e( 'Order tracking (old)', 'emporiqa' ); ?></th>
+                        <td>
+                                <input type="hidden" name="<?php echo esc_attr( $this->option_name ); ?>[order_tracking_shown]" value="1" />
+                                <label>
+                                        <input type="checkbox" name="<?php echo esc_attr( $this->option_name ); ?>[order_tracking]" value="1"
+                                                <?php checked( ! empty( $options['order_tracking'] ) ); ?> />
+                                        <?php esc_html_e( 'Answer order lookups at the old order tracking address.', 'emporiqa' ); ?>
+                                </label>
+                                <div class="emporiqa-readonly-field" style="margin-top:8px;">
+                                        <input type="text" id="order_tracking_url" value="<?php echo esc_attr( $tracking_url ); ?>" class="regular-text" readonly />
+                                        <button type="button" class="button emporiqa-copy-btn" data-copy-target="order_tracking_url">
+                                                <?php esc_html_e( 'Copy', 'emporiqa' ); ?>
+                                        </button>
+                                </div>
+                                <p class="description">
+                                        <?php esc_html_e( 'Replaced by the Order status rule above. Leave it on while your Emporiqa dashboard still has this address. To switch it off, first remove the address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick this and click Save Changes.', 'emporiqa' ); ?>
+                                </p>
+                        </td>
+                </tr>
+                <?php
+        }
+        /**
+         * What Emporiqa last said about ready-made rules.
+         *
+         * @since 1.2.0
+         *
+         * @return array{available: bool, live: string[]}
+         */
+        public static function rules_status(): array {
+                $stored = get_option( self::RULES_STATUS_OPTION, array() );
+                $live   = is_array( $stored ) && isset( $stored['live'] ) && is_array( $stored['live'] ) ? $stored['live'] : array();
+                return array(
+                        'available' => is_array( $stored ) && ! empty( $stored['available'] ),
+                        'live'      => array_values( array_filter( $live, 'is_string' ) ),
+                );
+        }
+        /**
+         * Keep what Emporiqa said about ready-made rules: whether this store is
+         * offered them, and which are live. Both /connect/exchange and the Test
+         * connection dry run carry it; an answer without the key (an older
+         * platform) changes nothing.
+         *
+         * Kept in its own option, not in emporiqa_options, so saving the
+         * settings form never drops it.
+         *
+         * @since 1.2.0
+         *
+         * @param array $answer Decoded Emporiqa answer.
+         */
+        public static function store_rules_status( array $answer ): void {
+                if ( ! array_key_exists( 'rules_available', $answer ) ) {
+                        return;
+                }
+                $live = array();
+                if ( isset( $answer['live_rules'] ) && is_array( $answer['live_rules'] ) ) {
+                        foreach ( $answer['live_rules'] as $key ) {
+                                if ( is_string( $key ) && preg_match( '/^[a-z_]{1,40}$/D', $key ) ) {
+                                        $live[] = $key;
+                                }
+                        }
+                }
+                $available = (bool) $answer['rules_available'];
+                update_option(
+                        self::RULES_STATUS_OPTION,
+                        array(
+                                'available' => $available,
+                                'live'      => $available ? $live : array(),
+                        ),
+                        false
+                );
+        }
 …
                                 </td>
                         </tr>
+                        <?php
+                        if ( self::rules_status()['available'] ) {
+                                $this->render_legacy_order_tracking_rows( $options );
+                        }
+                        ?>
                         <tr>
                                 <th scope="row"><label for="webhook_url"><?php esc_html_e( 'Emporiqa server URL', 'emporiqa' ); ?></label></th>
 …
                                         /* translators: %s: entity type */
                                         'batchFailed'     => __( 'Batch failed for %s', 'emporiqa' ),
+                                        /* translators: 1: entity type (products/pages), 2: seconds */
+                                        'batchWait'       => __( 'Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds.', 'emporiqa' ),
                                         /* translators: %s: entity type (products/pages) */
                                         'sessionComplete' => __( 'Completed %s sync session', 'emporiqa' ),
 …
                         'page_post_types'   => array( 'page' ),
                         'batch_size'        => 25,
+                        'order_tracking'    => true,
                 );
+        }

emporiqa/trunk/includes/class-emporiqa-cart-ajax.php

-              r3601468
+              r3730094
          * Nonce action used for all cart AJAX requests.
+         *
+         * Starts with "woocommerce" because WooCommerce binds a guest's nonce to
+         * their cart session only for such actions; any other guest nonce is the
+         * same for every signed-out visitor.
+         *
          * @since 1.0.0
          * @var string
          */
+        private const NONCE_ACTION = 'emporiqa_cart_nonce';
+        public const NONCE_ACTION = 'woocommerce-emporiqa-cart';
+        /**
+         * Error code sent when a cart change comes from another site.
+         *
+         * @since 1.2.0
+         * @var string
+         */
+        public const CROSS_SITE_CODE = 'cross_site';
+        /**
+         * Error code sent when the nonce check fails.
+         *
+         * @since 1.2.0
+         * @var string
+         */
+        public const INVALID_NONCE_CODE = 'invalid_nonce';
         /**
 …
          */
         public function add_to_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function update_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function remove_from_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
          */
         public function clear_cart(): void {
+                $this->refuse_cross_site();
                 $this->verify_nonce();
                 $this->ensure_cart_loaded();
 …
         private function verify_nonce(): void {
                 if ( ! check_ajax_referer( self::NONCE_ACTION, 'nonce', false ) ) {
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ) );
+                }
+                        // The code lets emporiqa-cart.js retry once with the fresh nonce:
+                        // a page served from a full-page cache can carry an expired one.
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ), self::INVALID_NONCE_CODE );
+                }
+        }
+        /**
+         * Refuse a cart change that another site's page sent.
+         *
+         * @since 1.2.0
+         */
+        private function refuse_cross_site(): void {
+                if ( self::is_cross_site( $_SERVER, array( home_url(), site_url() ) ) ) {
+                        $this->send_error( __( 'Security check failed. Please refresh the page and try again.', 'emporiqa' ), self::CROSS_SITE_CODE );
+                }
+        }
+        /**
+         * Whether a request says it came from another site: Sec-Fetch-Site (when
+         * the browser sends it) is neither same-origin nor none, or Origin (when
+         * sent) is not one of the site's own hosts.
+         *
+         * @since 1.2.0
+         *
+         * @param array    $server   $_SERVER.
+         * @param string[] $own_urls The site's own URLs (home_url(), site_url()).
+         * @return bool
+         */
+        public static function is_cross_site( array $server, array $own_urls ): bool {
+                $fetch_site = isset( $server['HTTP_SEC_FETCH_SITE'] ) ? strtolower( (string) $server['HTTP_SEC_FETCH_SITE'] ) : '';
+                if ( '' !== $fetch_site && 'same-origin' !== $fetch_site && 'none' !== $fetch_site ) {
+                        return true;
+                }
+                $origin = isset( $server['HTTP_ORIGIN'] ) ? (string) $server['HTTP_ORIGIN'] : '';
+                if ( '' === $origin ) {
+                        return false;
+                }
+                $host = Emporiqa_Widget::host_of( $origin );
+                return '' === $host || ! in_array( $host, array_map( array( 'Emporiqa_Widget', 'host_of' ), $own_urls ), true );
+        }
 …
                                 'name'         => $product->get_name(),
                                 'quantity'     => self::parse_quantity( $item['quantity'] ),
                                 'unit_price'   => (float) $product->get_price(),
+                                'unit_price'   => $this->displayed_unit_price( $product ),
                                 'image_url'    => $image_url ? $image_url : null,
                                 'product_url'  => get_permalink( $item['product_id'] ),
 …
                         'currency'    => emporiqa_get_active_currency(),
                 );
+        }
+        /**
+         * A cart line's unit price as the cart page shows it.
+         *
+         * Same rule as WC_Cart::get_product_price(): including or excluding tax
+         * per the shop's "Display prices during cart and checkout" setting. Read
+         * as the shopper whose cart it is, at their tax address, because this is
+         * the price they will pay, unlike the synced catalogue price, which is a
+         * guest's.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product $product The cart line's product.
+         * @return float
+         */
+        private function displayed_unit_price( \WC_Product $product ): float {
+                $price = WC()->cart->display_prices_including_tax()
+                        ? wc_get_price_including_tax( $product )
+                        : wc_get_price_excluding_tax( $product );
+                return round( (float) $price, wc_get_price_decimals() );
+        }
 …
+         *
          * @param string $message The error message.
+         */
+        private function send_error( string $message ): void {
+         * @param string $code    Machine-readable reason, '' when there is none.
+         */
+        private function send_error( string $message, string $code = '' ): void {
                 wp_send_json(
                         array(
                                 'success'     => false,
                                 'error'       => $message,
+                                'code'        => $code,
                                 'checkoutUrl' => $this->get_checkout_url(),
                                 'unit_price'  => 0,

emporiqa/trunk/includes/class-emporiqa-connect.php

-              r3601468
+              r3730094
         /**
+         * How long a claimed state stays "exchanging". Emporiqa proves the shop
+         * origin during /connect/exchange by asking actions/verify for
+         * HMAC(verifier, nonce), so the verifier must outlive the claim until the
+         * exchange returns; the TTL only bounds a request that never returned.
+         */
+        private const EXCHANGING_TTL = 120;
+        /**
+         * /connect/exchange waits on the origin proof (at most 4 s on Emporiqa's
+         * side) and on the secret rotation; past this timeout the plugin would
+         * keep its old secret while Emporiqa already rotated to the new one.
+         */
+        private const EXCHANGE_TIMEOUT = 15;
+        /**
          * Constructor — wires the admin_init handler that routes
          * ?emporiqa_action= requests.
 …
                         $this->base_url() . '/connect/exchange',
                         array(
                                 'timeout' => 10,
+                                'timeout' => self::EXCHANGE_TIMEOUT,
                                 'headers' => array(
                                         'Content-Type'        => 'application/json',
 …
                                 'body'    => wp_json_encode(
                                         array(
+                                                'code'          => $code,
+                                                'code_verifier' => $verifier,
+                                                'shop_origin'   => $shop_origin,
+                                                'code'             => $code,
+                                                'code_verifier'    => $verifier,
+                                                'shop_origin'      => $shop_origin,
+                                                'actions_base_url' => Emporiqa_Actions::base_url(),
+                                        )
                                 ),
+                        )
                 );
+                // The exchange has returned: the origin proof can no longer be asked for.
+                $this->finish_nonce( $state );
                 if ( is_wp_error( $resp ) ) {
 …
                 $status = (int) wp_remote_retrieve_response_code( $resp );
                 $body   = json_decode( wp_remote_retrieve_body( $resp ), true );
+                // A 409 carries a sentence for the merchant (a move or a reconnect
+                // waiting for an owner's email confirmation); show it as it is.
+                if ( 409 === $status && is_array( $body ) && ! empty( $body['error'] ) && is_string( $body['error'] ) ) {
+                        $this->set_error( 'exchange_409', sanitize_text_field( $body['error'] ) );
+                        $this->redirect_to_settings();
+                }
                 if ( 200 !== $status || ! is_array( $body ) || empty( $body['webhook_secret'] ) || empty( $body['store_id'] ) ) {
 …
                         $this->redirect_to_settings();
+                }
+                // Whether Emporiqa offers ready-made rules to this store, and which are live.
+                Emporiqa_Admin::store_rules_status( $body );
                 $this->persist_credentials(
 …
         /**
+         * Atomically read + delete the state→verifier transient. Returns the
+         * verifier on hit, null on miss/expired/already-used.
+         * Claim a pending state for the exchange and return its verifier; null on
+         * miss, expiry or a state already claimed (a double callback cannot
+         * replay). The row is kept, marked exchanging, until finish_nonce(), so
+         * the origin proof can be answered while the exchange is in flight.
+         *
          * @param string $state Public state from the callback.
 …
                 $key  = self::NONCE_PREFIX . hash( 'sha256', $state );
                 $data = get_transient( $key );
                 if ( ! is_array( $data ) || empty( $data['verifier'] ) ) {
+                if ( ! is_array( $data ) || empty( $data['verifier'] ) || ! empty( $data['exchanging_at'] ) ) {
                         return null;
+                }
+                // Delete first so a double-callback can't replay.
+                delete_transient( $key );
+                $data['exchanging_at'] = time();
+                if ( ! set_transient( $key, $data, self::EXCHANGING_TTL ) ) {
+                        return null;
+                }
                 return (string) $data['verifier'];
+        }
+        /**
+         * The verifier of an exchange in flight for $state, else null. Pending
+         * states never answer: only an exchange this site itself started can.
+         *
+         * @since 1.2.0
+         *
+         * @param string $state Public state sent by Emporiqa's origin proof.
+         * @return string|null
+         */
+        public static function exchanging_verifier( string $state ): ?string {
+                $data = get_transient( self::NONCE_PREFIX . hash( 'sha256', $state ) );
+                if ( ! is_array( $data ) || empty( $data['verifier'] ) || empty( $data['exchanging_at'] ) ) {
+                        return null;
+                }
+                if ( time() - (int) $data['exchanging_at'] > self::EXCHANGING_TTL ) {
+                        return null;
+                }
+                return (string) $data['verifier'];
+        }
+        /**
+         * Drop the state once the exchange has returned.
+         *
+         * @param string $state Public state from the callback.
+         */
+        private function finish_nonce( string $state ): void {
+                delete_transient( self::NONCE_PREFIX . hash( 'sha256', $state ) );
+        }

emporiqa/trunk/includes/class-emporiqa-formatter.php

-              r3601468
+              r3730094
          */
         private array $excluded_post_ids = array();
+        /**
+         * How many as_shopper() calls are running; above 0, prices are already read as a shopper.
+         *
+         * @var int
+         */
+        private static int $shopper_depth = 0;
         /**
 …
                         $brand_data[ $channel ] = $this->get_product_brand( $product, $languages[0] );
+                        if ( $is_variable && ! empty( $published_variations ) ) {
+                                // Representative price for the parent. Emporiqa derives the
+                                // real "from–to" range from the variation events at read time,
+                                // so this single value only needs the right currency and a
+                                // sensible "from" price. Pick the cheapest variation and take
+                                // BOTH its current and regular price from that same variation —
+                                // mixing the min current price with another variation's regular
+                                // price would fabricate a discount the customer can't actually
+                                // get.
+                                $representative = $published_variations[0];
+                                $min_price      = null;
+                                foreach ( $published_variations as $v ) {
+                                        $vp = $v->get_price();
+                                        if ( '' === $vp ) {
+                                                continue;
+                                        }
+                                        $vp = (float) $vp;
+                                        if ( null === $min_price || $vp < $min_price ) {
+                                                $min_price      = $vp;
+                                                $representative = $v;
+                                        }
+                                }
+                                $price         = $min_price ?? 0.0;
+                                $regular_price = '' !== $representative->get_regular_price() ? (float) $representative->get_regular_price() : $price;
+                        } elseif ( $is_grouped ) {
+                                // C2: Grouped products — the cheapest child's price. Derived
+                                // from ALL children, not only in-stock ones, so an
+                                // all-out-of-stock grouped product still reports its real
+                                // lowest price instead of 0. current_price and regular_price
+                                // are both taken from the SAME (cheapest) child so we never
+                                // pair a low current price with a different child's higher
+                                // regular price and fabricate a discount. Unlike variable
+                                // products, grouped children sync as separate products, so
+                                // Emporiqa does not range-derive the parent — this value is
+                                // shown directly.
+                                $price         = null;
+                                $regular_price = null;
+                                foreach ( $grouped_children as $child ) {
+                                        $cp          = $child->get_price();
+                                        $child_price = '' !== $cp ? (float) $cp : null;
+                                        if ( null === $child_price ) {
+                                                continue;
+                                        }
+                                        if ( null === $price || $child_price < $price ) {
+                                                $price         = $child_price;
+                                                $cr            = $child->get_regular_price();
+                                                $regular_price = '' !== $cr ? (float) $cr : $child_price;
+                                        }
+                                }
+                                $price         = $price ?? 0.0;
+                                $regular_price = $regular_price ?? $price;
+                        } else {
+                                $price         = '' !== $product->get_price() ? (float) $product->get_price() : 0.0;
+                                $regular_price = '' !== $product->get_regular_price() ? (float) $product->get_regular_price() : $price;
+                        }
+                        $price_entry = array(
+                                'currency'      => $currency,
+                                'current_price' => $price,
+                                'regular_price' => $regular_price,
+                        // Prices are read as a guest at the shop's base location; see as_shopper().
+                        $price_entry = $this->as_shopper(
+,
+                                fn() => $this->headline_entry( $product, $published_variations, $grouped_children, $currency )
                         );
 …
                 $var_images = array_values( array_unique( $var_images ) );
+                $price         = '' !== $variation->get_price() ? (float) $variation->get_price() : 0.0;
+                $regular_price = '' !== $variation->get_regular_price() ? (float) $variation->get_regular_price() : $price;
+                $price_entry = $this->price_entry( $variation, $currency );
                 $names        = array();
-                $descriptions = array();
                 $links        = array();
                 $attributes   = array();
-                $cat_data     = array();
-                $brand_data   = array();
                 $price_data   = array();
                 $avail_data   = array();
 …
                 $max_qty_data = array();
+                // Descriptions, categories and brand are not built here: Emporiqa stores a
+                // variation as a lean row and reads them from the parent.
                 foreach ( $channels as $channel ) {
+                        $names[ $channel ]        = array();
+                        $descriptions[ $channel ] = array();
+                        $links[ $channel ]        = array();
+                        $attributes[ $channel ]   = array();
+                        $cat_data[ $channel ]     = array();
+                        $names[ $channel ]      = array();
+                        $links[ $channel ]      = array();
+                        $attributes[ $channel ] = array();
                         foreach ( $languages as $lang ) {
 …
                                 $names[ $channel ][ $lang ] = $title;
-                                $descriptions[ $channel ][ $lang ] = $this->get_translated_variation_description( $variation, $parent_product, $lang );
                                 $links[ $channel ][ $lang ] = $this->get_translated_link( $parent_product, $lang );
                                 $attributes[ $channel ][ $lang ] = empty( $clean_attributes ) ? new \stdClass() : $clean_attributes;
+                                $cat_data[ $channel ][ $lang ] = $this->get_product_categories( $parent_product, $lang );
+                        }
+                        $this->apply_translation_fallbacks( $cat_data[ $channel ], $languages );
+                        }
                         $this->apply_translation_fallbacks( $names[ $channel ], $languages );
-                        $this->apply_translation_fallbacks( $descriptions[ $channel ], $languages );
                         $this->apply_translation_fallbacks( $links[ $channel ], $languages );
+                        $brand_data[ $channel ] = $this->get_product_brand( $parent_product, $languages[0] );
+                        $price_data[ $channel ] = array(
+                                array(
+                                        'currency'      => $currency,
+                                        'current_price' => $price,
+                                        'regular_price' => $regular_price,
+                                ),
+                        );
+                        $price_data[ $channel ] = array( $price_entry );
                         $avail_data[ $channel ] = $this->get_availability_status( $variation );
 …
                         'channels'              => $channels,
                         'names'                 => $names,
-                        'descriptions'          => $descriptions,
                         'links'                 => $links,
                         'attributes'            => $attributes,
-                        'categories'            => $cat_data,
-                        'brands'                => $brand_data,
                         'prices'                => $price_data,
                         'availability_statuses' => $avail_data,
 …
                         'is_virtual'            => $variation->is_virtual(),
                         'parent_sku'            => $parent_sku,
-                        'is_parent'             => false,
-                        'variation_attributes'  => new \stdClass(),
                 );
 …
          * @return array List of channel identifiers.
          */
         private function get_product_channels( \WC_Product $product ): array {
+        public function get_product_channels( \WC_Product $product ): array {
                 /**
                  * Filter the product sales channels.
 …
                 return implode( ' > ', $names );
+        }
+        /**
+         * The `prices` entry for a product as a whole: its own price, or for a
+         * variable product its cheapest priced variation's and for a grouped
+         * product its cheapest priced child's (all children, so an all-out-of-stock
+         * group still shows its real lowest price). Current and regular price both
+         * come from that one item, so a low price is never paired with another
+         * item's higher regular price, which would fabricate a discount. Quantity
+         * tiers are kept only for the product's own price: a variation's or a
+         * child's tiers are not the parent's. Emporiqa shows a variable product's
+         * full range from its variations.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product   $product    The product.
+         * @param \WC_Product[] $variations Published variations (variable products).
+         * @param \WC_Product[] $children   Children (grouped products).
+         * @param string        $currency   Currency code.
+         * @return array
+         */
+        public function headline_entry( \WC_Product $product, array $variations, array $children, string $currency ): array {
+                if ( $product->is_type( 'variable' ) && ! empty( $variations ) ) {
+                        $pool = $variations;
+                } elseif ( $product->is_type( 'grouped' ) ) {
+                        $pool = $children;
+                } else {
+                        return $this->price_entry( $product, $currency );
+                }
+                $cheapest = null;
+                $lowest   = null;
+                foreach ( $pool as $item ) {
+                        $price = $item->get_price();
+                        if ( '' !== $price && ( null === $lowest || (float) $price < $lowest ) ) {
+                                $lowest   = (float) $price;
+                                $cheapest = $item;
+                        }
+                }
+                $entry = $this->price_entry( $cheapest, $currency );
+                unset( $entry['tier_prices'] );
+                return $entry;
+        }
+        /**
+         * Run price reads as one shopper: a signed-out visitor ($user_id 0) or a
+         * signed-in customer.
+         *
+         * A sync runs as whoever triggered it: the shop manager saving a product,
+         * a signed-in user whose request ran the queue, the WP-CLI user. Role,
+         * B2B, wholesale and dynamic pricing plugins filter the price getters by
+         * the current user, session or cart, and WooCommerce works out tax from
+         * the current customer's address, so without this a wholesale or staff
+         * price, or another country's tax, could be synced as the public price.
+         *
+         * For the duration of $read the current user is $user_id, WC()->customer
+         * is that customer (none for a guest, a copy read from the database, never
+         * a session, for a customer), WC()->session and WC()->cart are unset, and
+         * the tax location is fixed: $country when given, else the customer's own
+         * taxable address, else the shop's base address. Everything is put back
+         * afterwards, also when $read throws. Nested calls run $read as-is.
+         *
+         * @since 1.2.0
+         *
+         * @param int      $user_id 0 for a guest, else a WordPress user id.
+         * @param callable $read    Reads and returns the prices.
+         * @param string   $country ISO country for tax, '' for the default.
+         * @return mixed What $read returns.
+         */
+        public function as_shopper( int $user_id, callable $read, string $country = '' ) {
+                if ( self::$shopper_depth > 0 ) {
+                        return $read();
+                }
+                global $current_user;
+                $previous_user    = $current_user;
+                $previous_user_id = get_current_user_id();
+                $swap_user        = $previous_user_id !== $user_id;
+                $wc               = function_exists( 'WC' ) ? WC() : null;
+                $previous         = $wc ? array( $wc->customer, $wc->session, $wc->cart ) : array();
+                $location         = null;
+                ++self::$shopper_depth;
+                try {
+                        if ( $swap_user ) {
+                                wp_set_current_user( $user_id );
+                        }
+                        if ( $wc ) {
+                                $wc->session  = null;
+                                $wc->cart     = null;
+                                $wc->customer = $user_id > 0 ? new \WC_Customer( $user_id ) : null;
+                                $fixed = $this->tax_location( $wc, $country );
+                                if ( null !== $fixed ) {
+                                        $location = static function () use ( $fixed ) {
+                                                return $fixed;
+                                        };
+                                        add_filter( 'woocommerce_get_tax_location', $location, PHP_INT_MAX );
+                                }
+                        }
+                        return $read();
+                } finally {
+                        if ( null !== $location ) {
+                                remove_filter( 'woocommerce_get_tax_location', $location, PHP_INT_MAX );
+                        }
+                        if ( $wc ) {
+                                list( $wc->customer, $wc->session, $wc->cart ) = $previous;
+                        }
+                        if ( $swap_user ) {
+                                wp_set_current_user( $previous_user_id );
+                                $current_user = $previous_user; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Puts back the exact user object the caller had.
+                        }
+                        --self::$shopper_depth;
+                }
+        }
+        /**
+         * The tax location as_shopper() fixes, null when WooCommerce knows no countries.
+         *
+         * @param object $wc      WC().
+         * @param string $country ISO country, or ''.
+         * @return array|null array( country, state, postcode, city ).
+         */
+        private function tax_location( $wc, string $country ): ?array {
+                if ( '' !== $country ) {
+                        return array( $country, '', '', '' );
+                }
+                if ( $wc->customer ) {
+                        $own = $wc->customer->get_taxable_address();
+                        if ( is_array( $own ) && ! empty( $own[0] ) ) {
+                                return $own;
+                        }
+                }
+                $countries = $wc->countries;
+                if ( ! $countries ) {
+                        return null;
+                }
+                return array( $countries->get_base_country(), $countries->get_base_state(), $countries->get_base_postcode(), $countries->get_base_city() );
+        }
+        /**
+         * One `prices` entry for a product or variation, as the shop shows it.
+         *
+         * Its current_price and regular_price follow the shop's "Display prices in
+         * the shop" tax setting, so the chat quotes what the product page shows
+         * even when prices are entered the other way (entered excluding tax,
+         * shown including it, as many EU shops do). With taxes on and a taxable
+         * product, price_incl_tax and price_excl_tax carry both, for the tax
+         * location as_shopper() fixed. A missing price is 0, as before. Outside
+         * as_shopper() it is read as a guest.
+         *
+         * Quantity tiers come from the `emporiqa_price_tiers` filter (WooCommerce
+         * has none of its own): each tier is the unit price the cart charges at
+         * that quantity, with tax as current_price, at full precision.
+         *
+         * @since 1.2.0
+         *
+         * @param \WC_Product|null $source   The product or variation whose price is sent; null when none has one.
+         * @param string           $currency Currency code.
+         * @return array
+         */
+        public function price_entry( ?\WC_Product $source, string $currency ): array {
+                if ( 0 === self::$shopper_depth ) {
+                        return $this->as_shopper( 0, fn() => $this->price_entry( $source, $currency ) );
+                }
+                $raw         = $source ? (string) $source->get_price() : '';
+                $regular_raw = $source ? (string) $source->get_regular_price() : '';
+                if ( '' === $regular_raw ) {
+                        $regular_raw = $raw;
+                }
+                $entry = array(
+                        'currency'      => $currency,
+                        'current_price' => '' !== $raw ? (float) $raw : 0.0,
+                        'regular_price' => '' !== $regular_raw ? (float) $regular_raw : 0.0,
+                );
+                if ( '' === $raw ) {
+                        return $entry;
+                }
+                $taxed        = function_exists( 'wc_tax_enabled' ) && wc_tax_enabled() && $source->is_taxable();
+                $display_incl = $taxed && 'incl' === get_option( 'woocommerce_tax_display_shop', 'excl' );
+                $shown        = static function ( string $amount, int $qty ) use ( $source, $taxed, $display_incl ): float {
+                        if ( ! $taxed ) {
+                                return (float) $amount;
+                        }
+                        $args = array(
+                                'qty'   => $qty,
+                                'price' => $amount,
+                        );
+                        $line = $display_incl ? wc_get_price_including_tax( $source, $args ) : wc_get_price_excluding_tax( $source, $args );
+                        return (float) $line / $qty;
+                };
+                if ( $taxed ) {
+                        $decimals = function_exists( 'wc_get_price_decimals' ) ? (int) wc_get_price_decimals() : 2;
+                        $one      = array(
+                                'qty'   => 1,
+                                'price' => $raw,
+                        );
+                        $entry['price_incl_tax'] = round( (float) wc_get_price_including_tax( $source, $one ), $decimals );
+                        $entry['price_excl_tax'] = round( (float) wc_get_price_excluding_tax( $source, $one ), $decimals );
+                        $entry['current_price']  = $display_incl ? $entry['price_incl_tax'] : $entry['price_excl_tax'];
+                        $entry['regular_price']  = round( $shown( $regular_raw, 1 ), $decimals );
+                }
+                $tiers = $this->price_tiers( $source, $shown );
+                if ( ! empty( $tiers ) ) {
+                        $entry['tier_prices'] = $tiers;
+                }
+                return $entry;
+        }
+        /**
+         * Quantity tiers from the `emporiqa_price_tiers` filter, as the cart
+         * charges them: ascending, one per quantity, min_quantity 2 or more.
+         *
+         * @param \WC_Product $source The product or variation.
+         * @param callable    $shown  ( string $unit_price, int $qty ): float, the unit price with tax as shown.
+         * @return array<int, array{min_quantity: int, price: float}>
+         */
+        private function price_tiers( \WC_Product $source, callable $shown ): array {
+                /**
+                 * Filter the quantity price tiers of a product or variation.
+                 *
+                 * WooCommerce has no quantity pricing of its own; a plugin that adds it
+                 * returns its tiers here. Each tier is array( 'min_quantity' => int,
+                 * 'price' => unit price ), the price entered as the product's own price
+                 * is (with or without tax, per the shop's setting). Called while the
+                 * price is read as the shopper (a guest for the sync), so a role-aware
+                 * tier plugin answers for that shopper.
+                 *
+                 * @since 1.2.0
+                 *
+                 * @param array       $tiers   Tiers, empty by default.
+                 * @param \WC_Product $product The product or variation.
+                 */
+                $raw = apply_filters( 'emporiqa_price_tiers', array(), $source );
+                $tiers = array();
+                foreach ( is_array( $raw ) ? $raw : array() as $tier ) {
+                        if ( ! is_array( $tier ) || ! isset( $tier['min_quantity'], $tier['price'] ) || ! is_numeric( $tier['min_quantity'] ) || ! is_numeric( $tier['price'] ) ) {
+                                continue;
+                        }
+                        $qty   = (int) $tier['min_quantity'];
+                        $price = (float) $tier['price'];
+                        if ( $qty < 2 || $price <= 0 ) {
+                                continue;
+                        }
+                        $tiers[ $qty ] = array(
+                                'min_quantity' => $qty,
+                                'price'        => $shown( (string) $price, $qty ),
+                        );
+                }
+                ksort( $tiers );
+                return array_values( $tiers );
+        }
+        /**
+         * The `emporiqa_price_tiers` answer for the Tiered Price Table plugin
+         * (tier-pricing-table): each of its quantity rules as the unit price its
+         * cart charges, unrounded and with tax as the shop enters prices, for the
+         * shopper being read. The
+         * pricing type is passed so its per-request rule cache, which keys by
+         * product only, is not read: a rule cached for another shopper earlier in
+         * the request (its role-based rules) must not be sent as this one's.
+         *
+         * @since 1.2.0
+         *
+         * @param array       $tiers   Tiers so far.
+         * @param \WC_Product $product The product or variation.
+         * @return array
+         */
+        public static function tiered_price_table_tiers( $tiers, $product ): array {
+                $tiers   = is_array( $tiers ) ? $tiers : array();
+                $manager = '\\TierPricingTable\\PriceManager';
+                if ( ! $product instanceof \WC_Product || ! is_callable( array( $manager, 'getPricingRule' ) ) || ! is_callable( array( $manager, 'getPricingType' ) ) ) {
+                        return $tiers;
+                }
+                $id   = $product->get_id();
+                $rule = call_user_func( array( $manager, 'getPricingRule' ), $id, call_user_func( array( $manager, 'getPricingType' ), $id ) );
+                if ( ! is_object( $rule ) || ! is_callable( array( $rule, 'getRules' ) ) || ! is_callable( array( $rule, 'getTierPrice' ) ) ) {
+                        return $tiers;
+                }
+                foreach ( array_keys( (array) $rule->getRules() ) as $qty ) {
+                        $price = $rule->getTierPrice( (int) $qty, false, 'shop', false );
+                        if ( is_numeric( $price ) ) {
+                                $tiers[] = array(
+                                        'min_quantity' => (int) $qty,
+                                        'price'        => (float) $price,
+                                );
+                        }
+                }
+                return $tiers;
+        }
 …
         /**
-         * Get the translated variation description, falling back to parent description.
+         *
-         * @since 1.0.0
+         *
-         * @param \WC_Product_Variation $variation      The variation.
-         * @param \WC_Product           $parent_product The parent product.
-         * @param string                $language       The target language code.
-         * @return string
-         */
-        private function get_translated_variation_description( \WC_Product_Variation $variation, \WC_Product $parent_product, string $language ): string {
-                $translated_parent_id = $this->get_translation_id( $parent_product->get_id(), $language );
-                if ( $translated_parent_id && $translated_parent_id !== $parent_product->get_id() ) {
-                        $translated_parent = wc_get_product( $translated_parent_id );
-                        if ( $translated_parent && $translated_parent->is_type( 'variable' ) ) {
-                                // Find the matching translated variation by SKU or attribute combination.
-                                foreach ( $translated_parent->get_children() as $translated_var_id ) {
-                                        $translated_var = wc_get_product( $translated_var_id );
-                                        if ( ! $translated_var ) {
-                                                continue;
+                                        }
-                                        if ( $translated_var->get_sku() === $variation->get_sku() && '' !== $variation->get_sku() ) {
-                                                $desc = $translated_var->get_description();
-                                                if ( ! empty( $desc ) ) {
-                                                        return $desc;
+                                                }
-                                                break;
+                                        }
+                                }
-                                // Fall back to translated parent description.
-                                return $translated_parent->get_description();
+                        }
+                }
-                $var_desc = $variation->get_description();
-                return ! empty( $var_desc ) ? $var_desc : $parent_product->get_description();
+        }
-        /**
          * Get the translated product title.
+         *

emporiqa/trunk/includes/class-emporiqa-order-tracking.php

-              r3506790
+              r3730094
  * order data. Requests are authenticated via HMAC-SHA256 using the same
  * webhook secret configured in Settings > Emporiqa.
+ *
+ * Replaced by the Order status ready-made rule (class-emporiqa-actions.php)
+ * since 1.2.0, and kept working unchanged for stores that use it: same
+ * request, same answers. It stays on unless the merchant switches it off
+ * (option `order_tracking`, default on).
+ *
  * @package Emporiqa
 …
         /**
+         * Whether the merchant left order tracking on (the default).
+         *
+         * @since 1.2.0
+         *
+         * @return bool
+         */
+        public static function is_enabled(): bool {
+                return (bool) Emporiqa_Admin::get_option( 'order_tracking', true );
+        }
+        /**
          * Verify HMAC signature and timestamp for the incoming request.
+         *
 …
          */
         public function handle_request( WP_REST_Request $request ): WP_REST_Response {
+                if ( ! self::is_enabled() ) {
+                        // Untranslated on purpose: Emporiqa reads this exact text as
+                        // "switched off", not as an unknown order.
+                        return new WP_REST_Response( array( 'error' => 'Order tracking is disabled.' ), 404 );
+                }
+                try {
+                        return $this->answer( $request );
+                } catch ( \Throwable $e ) {
+                        if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+                                error_log( '[Emporiqa] order tracking failed: ' . $e->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+                        }
+                        return new WP_REST_Response( array( 'error' => 'Internal error.' ), 500 );
+                }
+        }
+        /**
+         * The answer to a signature-verified request.
+         *
+         * @param WP_REST_Request $request The REST request.
+         * @return WP_REST_Response
+         */
+        private function answer( WP_REST_Request $request ): WP_REST_Response {
                 // H8: Rate limiting per IP.
                 $rate_check = $this->check_rate_limit();
 …
+                }
+                $order_identifier        = sanitize_text_field( $payload['order_identifier'] );
+                $order_identifier        = is_scalar( $payload['order_identifier'] ) ? ltrim( sanitize_text_field( (string) $payload['order_identifier'] ), '#' ) : '';
+                if ( ! preg_match( '/^[0-9A-Za-z][0-9A-Za-z\-]{0,63}$/D', $order_identifier ) ) {
+                        return new WP_REST_Response(
+                                array( 'error' => __( 'Order not found.', 'emporiqa' ) ),
+                        );
+                }
                 $raw_verification        = $payload['verification_fields'] ?? array();
                 $verification_fields     = is_array( $raw_verification ) ? array_map( 'sanitize_text_field', $raw_verification ) : array();
 …
          */
         private function lookup_order( string $order_identifier, array $verification_fields ): WP_REST_Response {
+                $order = wc_get_order( $order_identifier );
+                // The typed value is an order number, never an internal id: "123"
+                // must not resolve to whichever order has id 123.
+                $order = Emporiqa_Order_Status::find_by_number( $order_identifier );
                 // Also try searching by order number (custom order number plugins).
 …
                         );
                         $order  = $orders[0] ?? null;
+                }
+                if ( ! $order ) {
+                        // WooCommerce ignores a query var it does not know, and then
+                        // returns the newest order: only an exact number match counts.
+                        if ( $order && 0 !== strcasecmp( (string) $order->get_order_number(), $order_identifier ) ) {
+                                $order = null;
+                        }
+                }
+                if ( ! $order instanceof WC_Order ) {
                         return new WP_REST_Response(
                                 array( 'error' => __( 'Order not found.', 'emporiqa' ) ),

emporiqa/trunk/includes/class-emporiqa-order-webhook.php

-              r3549190
+              r3730094
                         $url,
                         array(
+                                'headers'  => array(
+                                        'Content-Type'        => 'application/json',
+                                        'X-Webhook-Signature' => hash_hmac( 'sha256', $payload, $secret ),
+                                ),
+                                'headers'  => Emporiqa_Webhook::signed_headers( $payload ),
                                 'body'     => $payload,
                                 'timeout'  => 5,
 …
                                 $this->log( "order.completed webhook failed for order #{$order_id}. Retry #{$attempt} in {$delay}s." );
                         } else {
+                                // Not marked as sent, so the order's next paid status
+                                // (processing to completed, say) tries once more.
+                                $order->delete_meta_data( self::TRACKED_META_KEY );
+                                $order->save();
                                 $this->log( "order.completed webhook permanently failed for order #{$order_id} after {$attempt} attempt(s)." );
+                        }

emporiqa/trunk/includes/class-emporiqa-sync.php

-              r3601468
+              r3730094
          * AJAX handler: process a single batch of items.
+         *
+         * Queries N items for the given page, formats them, and sends them
+         * via the webhook.
+         * Queries the next N items after `after_id` (keyset, by id), formats
+         * them, and sends them via the webhook. The answer's `last_id` is the
+         * next call's `after_id`, and `done` says there is nothing after it.
+         * Paging by id instead of OFFSET means an item disabled or added
+         * mid-sync cannot shift the pages and make a live item skipped, which
+         * the session's completion would then delete from Emporiqa.
+         *
          * @since 1.0.0
 …
                 $entity          = sanitize_text_field( wp_unslash( $_POST['entity'] ?? '' ) );
                 $session_id      = sanitize_text_field( wp_unslash( $_POST['session_id'] ?? '' ) );
                 $page            = absint( $_POST['page'] ?? 1 );
+                $after_id        = absint( $_POST['after_id'] ?? 0 );
                 $items_per_batch = absint( $_POST['items_per_batch'] ?? self::ITEMS_PER_BATCH );
 …
                         'events'    => 0,
                         'success'   => true,
+                        'last_id'   => $after_id,
+                        'done'      => true,
                 );
                 if ( 'products' === $entity ) {
                         $result = $this->process_product_batch( $session_id, $page, $items_per_batch );
+                        $result = $this->process_product_batch( $session_id, $after_id, $items_per_batch );
                 } elseif ( 'pages' === $entity ) {
                         $result = $this->process_page_batch( $session_id, $page, $items_per_batch );
+                        $result = $this->process_page_batch( $session_id, $after_id, $items_per_batch );
+                }
                 // A failed batch reclassifies all of its items as errors — the
+                // per-session counters drive the completion guard below.
+                $this->record_batch_result( $session_id, $result['processed'], $result['success'] );
+                // per-session counters drive the completion guard below. A batch
+                // Emporiqa asked to wait for is held as pending instead: the browser
+                // sends the same batch again after the wait.
+                $this->record_batch_result( $session_id, $result['processed'], $result['success'], $after_id, isset( $result['retry_after'] ) );
                 wp_send_json_success( $result );
 …
+                }
+                if ( ! empty( $state['pending'] ) ) {
+                        wp_send_json_error(
+                                array(
+                                        'message' => sprintf(
+                                                /* translators: %s: entity type (products or pages). */
+                                                __( 'The %s sync session was not finalized because Emporiqa asked to wait and a batch was not sent again: items missing from this sync were NOT removed from Emporiqa. Re-run the sync.', 'emporiqa' ),
+                                                $entity
+                                        ),
+                                        'skipped' => true,
+                                )
+                        );
+                }
                 if ( $state['synced'] < 1 ) {
                         wp_send_json_error(
 …
          * Mirrors the Drupal reference: a failed batch send reclassifies the
          * whole batch's items as errors (no partial accounting inside a batch).
+         * A batch Emporiqa asked to wait for (429) is held as pending under the
+         * id it starts after, and released when that batch is sent; completion
+         * is refused while any is pending.
+         *
          * @since 1.1.9
 …
          * @param int    $processed  Items processed in this batch.
          * @param bool   $success    Whether the batch send succeeded.
+         */
+        private function record_batch_result( string $session_id, int $processed, bool $success ): void {
+         * @param int    $after_id   Id the batch starts after.
+         * @param bool   $wait       Whether Emporiqa asked to wait and resend.
+         */
+        private function record_batch_result( string $session_id, int $processed, bool $success, int $after_id = 0, bool $wait = false ): void {
                 $state = $this->get_session_state( $session_id );
                 if ( ! is_array( $state ) ) {
 …
+                }
+                $pending = isset( $state['pending'] ) && is_array( $state['pending'] ) ? $state['pending'] : array();
+                unset( $pending[ (string) $after_id ] );
+                if ( $wait ) {
+                        $pending[ (string) $after_id ] = true;
+                }
+                $state['pending'] = $pending;
                 if ( $success ) {
                         $state['synced'] += $processed;
                 } else {
+                } elseif ( ! $wait ) {
                         $state['errors'] += max( 1, $processed );
+                }
 …
+         *
          * @param string $session_id      Sync session ID.
          * @param int    $page            Page number (1-based).
          * @param int    $items_per_batch Items per page.
          * @return array{processed: int, events: int, success: bool}
          */
         private function process_product_batch( string $session_id, int $page, int $items_per_batch ): array {
+         * @param int    $after_id        Only items with a larger id.
+         * @param int    $items_per_batch Items per batch.
+         * @return array{processed: int, events: int, success: bool, last_id: int, done: bool, error?: string, retry_after?: int}
+         */
+        private function process_product_batch( string $session_id, int $after_id, int $items_per_batch ): array {
                 $formatter = emporiqa()->get_formatter();
                 $webhook   = emporiqa()->get_webhook();
                 $query_args = array(
+                        'status' => 'publish',
+                        'limit'  => $items_per_batch,
+                        'page'   => $page,
+                        'type'   => Emporiqa_Admin::get_product_types(),
+                        'status'  => 'publish',
+                        'limit'   => $items_per_batch,
+                        'orderby' => 'ID',
+                        'order'   => 'ASC',
+                        'type'    => Emporiqa_Admin::get_product_types(),
                 );
 …
+                }
+                $products  = wc_get_products( $query_args );
+                $query_args['emporiqa_after_id'] = $after_id;
+                $products  = self::query_after_id(
+                        function () use ( $query_args ) {
+                                return wc_get_products( $query_args );
+                        }
+                );
                 $events    = array();
                 $processed = count( $products );
+                $last_id   = $after_id;
                 foreach ( $products as $product ) {
+                        $last_id   = max( $last_id, (int) $product->get_id() );
                         $formatted = $formatter->format_product_consolidated( $product, $session_id );
                         foreach ( $formatted as $item ) {
 …
+                }
+                $success = true;
+                $error   = null;
+                $success     = true;
+                $error       = null;
+                $retry_after = null;
                 if ( ! empty( $events ) ) {
                         $success = $webhook->send_batch_events( $events );
                         if ( ! $success ) {
+                                $error = $webhook->get_last_error();
+                                $error       = $webhook->get_last_error();
+                                $retry_after = $webhook->get_last_retry_after();
+                        }
+                }
 …
                         'events'    => count( $events ),
                         'success'   => $success,
+                        'last_id'   => $last_id,
+                        'done'      => $processed < $items_per_batch,
                 );
                 if ( ! $success && $error ) {
                         $out['error'] = $error;
+                }
+                if ( null !== $retry_after ) {
+                        $out['retry_after'] = $retry_after;
+                }
                 return $out;
 …
+         *
          * @param string $session_id      Sync session ID.
          * @param int    $page            Page number (1-based).
          * @param int    $items_per_batch Items per page.
          * @return array{processed: int, events: int, success: bool}
          */
         private function process_page_batch( string $session_id, int $page, int $items_per_batch ): array {
+         * @param int    $after_id        Only items with a larger id.
+         * @param int    $items_per_batch Items per batch.
+         * @return array{processed: int, events: int, success: bool, last_id: int, done: bool, error?: string, retry_after?: int}
+         */
+        private function process_page_batch( string $session_id, int $after_id, int $items_per_batch ): array {
                 $post_types = Emporiqa_Admin::get_option( 'page_post_types', array( 'page' ) );
 …
                                 'events'    => 0,
                                 'success'   => true,
+                                'last_id'   => $after_id,
+                                'done'      => true,
                         );
+                }
 …
                         'post_status'      => 'publish',
                         'posts_per_page'   => $items_per_batch,
+                        'paged'            => $page,
+                        'orderby'          => 'ID',
+                        'order'            => 'ASC',
+                        'no_found_rows'    => true,
                         'suppress_filters' => false,
                 );
 …
+                }
+                $pages     = get_posts( $query_args );
+                $query_args['emporiqa_after_id'] = $after_id;
+                $pages     = self::query_after_id(
+                        function () use ( $query_args ) {
+                                return get_posts( $query_args );
+                        }
+                );
                 $events    = array();
                 $processed = count( $pages );
+                $last_id   = $after_id;
                 foreach ( $pages as $page_post ) {
+                        $last_id   = max( $last_id, (int) $page_post->ID );
                         $formatted = $formatter->format_page_consolidated( $page_post, $session_id );
                         if ( ! empty( $formatted ) ) {
 …
+                }
+                $success = true;
+                $error   = null;
+                $success     = true;
+                $error       = null;
+                $retry_after = null;
                 if ( ! empty( $events ) ) {
                         $success = $webhook->send_batch_events( $events );
                         if ( ! $success ) {
+                                $error = $webhook->get_last_error();
+                                $error       = $webhook->get_last_error();
+                                $retry_after = $webhook->get_last_retry_after();
+                        }
+                }
 …
                         'events'    => count( $events ),
                         'success'   => $success,
+                        'last_id'   => $last_id,
+                        'done'      => $processed < $items_per_batch,
                 );
                 if ( ! $success && $error ) {
                         $out['error'] = $error;
+                }
+                if ( null !== $retry_after ) {
+                        $out['retry_after'] = $retry_after;
+                }
                 return $out;
+        }
+        /**
+         * Run $query with `ID > after_id` added to the posts queries that carry
+         * the `emporiqa_after_id` query var (keyset paging). wc_get_products()
+         * and get_posts() have no "id after" argument, but both pass unknown
+         * query vars through to WP_Query, so it goes in through posts_where.
+         *
+         * @since 1.2.0
+         *
+         * @param callable $query Runs one posts query whose args include `emporiqa_after_id`.
+         * @return array
+         */
+        public static function query_after_id( callable $query ): array {
+                $filter = function ( $where, $wp_query ) {
+                        $after_id = $wp_query instanceof \WP_Query ? $wp_query->get( 'emporiqa_after_id', null ) : null;
+                        if ( null === $after_id ) {
+                                return $where;
+                        }
+                        global $wpdb;
+                        return $where . $wpdb->prepare( " AND {$wpdb->posts}.ID > %d", absint( $after_id ) );
+                };
+                add_filter( 'posts_where', $filter, 10, 2 );
+                try {
+                        $result = $query();
+                } finally {
+                        remove_filter( 'posts_where', $filter, 10 );
+                }
+                return is_array( $result ) ? $result : array();
+        }
+}

emporiqa/trunk/includes/class-emporiqa-webhook.php

-              r3560454
+              r3730094
         /**
+         * Seconds Emporiqa asked us to wait (429, or 503 with Retry-After) on the
+         * most recent failed send_batch_events call, or null. Emporiqa sheds sync
+         * batches this way when its queue is full; the batch is meant to be sent
+         * again after the wait, not counted as failed.
+         *
+         * @var int|null
+         */
+        private ?int $last_retry_after = null;
+        /**
+         * Longest wait honoured from Retry-After (seconds).
+         *
+         * @since 1.2.0
+         */
+        public const MAX_RETRY_AFTER = 300;
+        /**
+         * Wait used when a 429 names none (seconds).
+         *
+         * @since 1.2.0
+         */
+        public const DEFAULT_RETRY_AFTER = 30;
+        /**
+         * How many times a WP-CLI sync waits and resends one batch before it
+         * counts the batch as failed.
+         *
+         * @since 1.2.0
+         */
+        private const CLI_MAX_WAITS = 10;
+        /**
          * Connect-phase budget (ms) to install on the in-flight cURL handle
          * via http_api_curl. Set just before wp_remote_post in do_request(),
 …
                                 // (cURL) or by apply_fallback_request_timeout (Streams).
                                 'timeout'  => 0.01,
+                                'headers'  => array(
+                                        'Content-Type'        => 'application/json',
+                                        'X-Webhook-Signature' => $this->generate_signature( $json ),
+                                ),
+                                'headers'  => self::signed_headers( $json ),
                                 'body'     => $json,
+                        )
 …
                 $result  = $this->do_request( $payload, false, $timeout );
+                // WP-CLI has no request time limit, so it waits as Emporiqa asks and
+                // sends the same batch again. The admin sync waits in the browser.
+                $waits = 0;
+                while ( ! $result['success'] && null !== ( $result['retry_after'] ?? null ) && $debug && defined( 'WP_CLI' ) && WP_CLI && $waits < self::CLI_MAX_WAITS ) {
+                        ++$waits;
+                        \WP_CLI::log( sprintf( 'Emporiqa asked to wait %d s before the next batch; waiting.', $result['retry_after'] ) );
+                        sleep( $result['retry_after'] );
+                        $result = $this->do_request( $payload, false, $timeout );
+                }
+                $this->last_retry_after = $result['success'] ? null : ( $result['retry_after'] ?? null );
                 if ( ! $result['success'] ) {
                         $this->last_error = $this->build_friendly_error( $result );
 …
         public function get_last_error(): ?string {
                 return $this->last_error;
+        }
+        /**
+         * Seconds Emporiqa asked to wait before the batch that just failed is
+         * sent again; null when the failure was not a request to wait.
+         *
+         * @since 1.2.0
+         *
+         * @return int|null
+         */
+        public function get_last_retry_after(): ?int {
+                return $this->last_retry_after;
+        }
+        /**
+         * The wait a failed response asks for: a 429 always (Retry-After, else
+         * DEFAULT_RETRY_AFTER), a 503 only when it carries Retry-After. Seconds
+         * between 1 and MAX_RETRY_AFTER; an HTTP-date Retry-After counts as the
+         * default. Null for every other failure.
+         *
+         * @since 1.2.0
+         *
+         * @param int    $status      HTTP status.
+         * @param string $retry_after Retry-After header value, '' when absent.
+         * @return int|null
+         */
+        public static function retry_after( int $status, string $retry_after ): ?int {
+                $retry_after = trim( $retry_after );
+                if ( 429 !== $status && ! ( 503 === $status && '' !== $retry_after ) ) {
+                        return null;
+                }
+                $seconds = ctype_digit( $retry_after ) ? (int) $retry_after : self::DEFAULT_RETRY_AFTER;
+                return max( 1, min( self::MAX_RETRY_AFTER, $seconds ) );
+        }
 …
                 $result = $this->do_request( array( 'events' => $events ), true );
+                // Warned from 2 minutes, well inside the 5 minutes Emporiqa allows, so
+                // the merchant hears of a drifting clock before every sync fails.
+                $clock_warning = '';
+                $skew          = $result['clock_skew'] ?? null;
+                if ( null !== $skew && abs( $skew ) > 120 ) {
+                        $clock_warning = ' ' . sprintf(
+                                /* translators: %d: number of minutes */
+                                __( "This server's clock is %d minutes off. Ask your host to turn on time synchronisation (NTP): Emporiqa refuses data sent with a clock more than 5 minutes off.", 'emporiqa' ),
+                                (int) round( abs( $skew ) / 60 )
+                        );
+                }
                 if ( $result['success'] ) {
                         $dry_run_data = $result['response'] ?? array();
+                        if ( is_array( $dry_run_data ) ) {
+                                // A connected site learns here, without reconnecting, whether
+                                // Emporiqa offers ready-made rules and which are live.
+                                Emporiqa_Admin::store_rules_status( $dry_run_data );
+                        }
                         $has_warnings = false;
 …
                         return array(
                                 'success' => true,
                                 'message' => $has_warnings
+                                'message' => ( $has_warnings
                                         ? __( 'Connection successful, but there are warnings.', 'emporiqa' )
                                         : __( 'Connection successful! All fields validated.', 'emporiqa' ),
+                                        : __( 'Connection successful! All fields validated.', 'emporiqa' ) ) . $clock_warning,
                                 'dry_run' => $dry_run_data,
                         );
 …
                         'success' => false,
                         /* translators: %s: human-readable error message from the Emporiqa server */
                         'message' => sprintf( __( 'Connection failed: %s', 'emporiqa' ), $this->build_friendly_error( $result ) ),
+                        'message' => sprintf( __( 'Connection failed: %s', 'emporiqa' ), $this->build_friendly_error( $result ) ) . $clock_warning,
                         'dry_run' => $result['response'],
                 );
 …
         /**
-         * Generate an HMAC-SHA256 signature for a payload.
+         *
-         * @since 1.0.0
+         *
-         * @param string $payload The JSON payload.
-         * @return string The hex-encoded signature.
-         */
-        private function generate_signature( string $payload ): string {
-                $secret = Emporiqa_Admin::get_option( 'webhook_secret', '' );
-                if ( '' === $secret ) {
-                        return '';
+                }
-                return hash_hmac( 'sha256', $payload, $secret );
+        }
-        /**
          * Send an HTTP POST request to the webhook endpoint.
+         *
 …
+                }
+                $headers = array(
+                        'Content-Type'        => 'application/json',
+                        'X-Webhook-Signature' => $this->generate_signature( $json_payload ),
+                );
+                $headers = self::signed_headers( $json_payload );
                 // Hook-driven (AS worker) sends get the tight handshake cap; admin-
 …
                 $status_code = wp_remote_retrieve_response_code( $response );
                 $body        = json_decode( wp_remote_retrieve_body( $response ), true );
+                $clock_skew  = self::clock_skew( (string) wp_remote_retrieve_header( $response, 'date' ), time() );
                 if ( in_array( $status_code, array( 200, 201, 202 ), true ) ) {
                         return array(
+                                'success'  => true,
+                                'response' => $body,
+                                'error'    => null,
+                                'success'    => true,
+                                'response'   => $body,
+                                'error'      => null,
+                                'clock_skew' => $clock_skew,
                         );
+                }
 …
                 return array(
+                        'success'  => false,
+                        'response' => $body,
+                        'error'    => $error_msg,
+                        'success'     => false,
+                        'response'    => $body,
+                        'error'       => $error_msg,
+                        'clock_skew'  => $clock_skew,
+                        'retry_after' => self::retry_after( (int) $status_code, (string) wp_remote_retrieve_header( $response, 'retry-after' ) ),
                 );
+        }
+        /**
+         * Headers for a sync webhook body: the scheme-2 signature beside the
+         * legacy one (a new plugin may still meet a platform that only knows the
+         * old header), and the plugin version. Built per send, so every send and
+         * every retry carries a fresh timestamp.
+         *
+         * @since 1.2.0
+         *
+         * @param string $json Exact request body.
+         * @return array<string, string>
+         */
+        public static function signed_headers( string $json ): array {
+                $secret  = (string) Emporiqa_Admin::get_option( 'webhook_secret', '' );
+                $headers = array(
+                        'Content-Type'              => 'application/json',
+                        'X-Webhook-Signature'       => '' === $secret ? '' : hash_hmac( 'sha256', $json, $secret ),
+                        'X-Emporiqa-Plugin-Version' => 'woocommerce/' . EMPORIQA_VERSION,
+                );
+                $scheme2 = Emporiqa_Signature::webhook_header( $json, $secret, (string) Emporiqa_Admin::get_option( 'store_id', '' ) );
+                if ( '' !== $scheme2 ) {
+                        $headers['X-Emporiqa-Webhook-Signature'] = $scheme2;
+                }
+                return $headers;
+        }
+        /**
+         * Seconds this server's clock is ahead of Emporiqa's (negative: behind),
+         * from the response Date header; null when there is none. Tells a skewed
+         * clock apart from a wrong secret when signatures are refused.
+         *
+         * @since 1.2.0
+         *
+         * @param string $date_header HTTP Date header value.
+         * @param int    $now         Local time.
+         * @return int|null
+         */
+        public static function clock_skew( string $date_header, int $now ): ?int {
+                $remote = '' === $date_header ? false : strtotime( $date_header );
+                return false === $remote ? null : $now - $remote;
+        }

emporiqa/trunk/includes/class-emporiqa-widget.php

-              r3549215
+              r3730094
  * - currency: ISO 4217 currency code (e.g. EUR, USD)
  * - channel: Sales channel identifier (always included, defaults to 'default')
+ * - user_id: Signed token for logged-in customer identification
+ *
+ * A signed-in customer's token is never in the page or the URL (full-page
+ * caches would serve it to another shopper, and URLs end up in server logs).
+ * assets/js/emporiqa-customer-token.js asks the uncached admin-ajax action
+ * `emporiqa_customer_token` for it when the chat opens, and hands it to
+ * embed.js on a MessageChannel port.
+ *
  * @package Emporiqa
 …
         /**
+         * The admin-ajax action that returns the customer token.
+         */
+        public const TOKEN_ACTION = 'emporiqa_customer_token';
+        /**
+         * The request header the token script sends. A custom header makes a
+         * cross-site request need a CORS preflight, which admin-ajax never
+         * grants, so a page on another site cannot have the browser send it.
+         */
+        public const TOKEN_HEADER = 'X-Emporiqa-Token';
+        /**
          * Register hooks.
+         *
 …
                 add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_widget' ) );
                 add_filter( 'script_loader_tag', array( $this, 'modify_widget_script_tag' ), 10, 2 );
+                // Signed-in visitors only: a guest has no token, and its script never asks.
+                add_action( 'wp_ajax_' . self::TOKEN_ACTION, array( $this, 'ajax_customer_token' ) );
+        }
 …
+                }
+                $language = $this->get_current_language();
+                if ( $this->is_multilingual() && ! self::is_language_enabled( $language, (array) Emporiqa_Admin::get_option( 'enabled_languages', array() ) ) ) {
+                        return;
+                }
                 $query_params = array(
                         'store_id' => $store_id,
                         'language' => $this->get_current_language(),
+                        'language' => $language,
                 );
 …
+                }
-                if ( is_user_logged_in() ) {
-                        $webhook_secret = Emporiqa_Admin::get_option( 'webhook_secret' );
-                        if ( ! empty( $webhook_secret ) ) {
-                                $user_token = $this->generate_user_token(
-                                        (string) get_current_user_id(),
-                                        $webhook_secret
-                                );
-                                if ( ! empty( $user_token ) ) {
-                                        $query_params['user_id'] = $user_token;
+                                }
+                        }
+                }
                 /**
                  * Filter the widget embed query parameters.
 …
                  * @since 1.0.0
+                 *
                  * @param array $query_params The query parameters (store_id, language, currency, channel, user_id).
+                 * @param array $query_params The query parameters (store_id, language, currency, channel).
                  */
                 $query_params = apply_filters( 'emporiqa_widget_params', $query_params );
 …
                 wp_enqueue_script( 'emporiqa-widget', $widget_url, array(), EMPORIQA_VERSION, true );
                 wp_script_add_data( 'emporiqa-widget', 'strategy', 'async' );
+                // The same for every visitor, so cached pages may carry it: it holds
+                // only the admin-ajax URL, and the token is fetched on demand.
+                if ( ! empty( Emporiqa_Admin::get_option( 'webhook_secret' ) ) ) {
+                        wp_enqueue_script(
+                                'emporiqa-customer-token',
+                                EMPORIQA_PLUGIN_URL . 'assets/js/emporiqa-customer-token.js',
+                                array(),
+                                EMPORIQA_VERSION,
+                                array(
+                                        'in_footer' => true,
+                                        'strategy'  => 'defer',
+                                )
+                        );
+                        wp_add_inline_script(
+                                'emporiqa-customer-token',
+                                'window.emporiqaTokenConfig = ' . wp_json_encode(
+                                        array(
+                                                'url'    => admin_url( 'admin-ajax.php' ),
+                                                'action' => self::TOKEN_ACTION,
+                                                'header' => self::TOKEN_HEADER,
+                                        )
+                                ) . ';',
+                                'before'
+                        );
+                }
+        }
+        /**
+         * Admin-ajax: the signed-in customer's token.
+         *
+         * Read-only: it returns only the current session's own identity token
+         * and changes nothing. It cannot carry a nonce, because the page that
+         * would hold one is served from full-page caches to other visitors.
+         * Cross-site use is blocked instead: POST only, the TOKEN_HEADER header
+         * is required (forcing a CORS preflight), and a request whose
+         * Sec-Fetch-Site or Origin says it came from another site is refused.
+         * Never cached (no-store, private, Vary: Cookie).
+         *
+         * @since 1.2.0
+         */
+        public function ajax_customer_token(): void {
+                // Through the filter, not header(): wp_send_json() ends in the
+                // admin-ajax die handler, which sends nocache_headers() again, and
+                // before WordPress 6.3 those lack no-store and private.
+                add_filter( 'nocache_headers', array( __CLASS__, 'no_store_headers' ) );
+                nocache_headers();
+                send_nosniff_header();
+                header( 'Vary: Cookie' );
+                $method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
+                if ( 'POST' !== $method ) {
+                        wp_send_json( array( 'token' => '' ), 405 );
+                }
+                if ( ! self::is_same_site_request( $_SERVER, home_url() ) ) {
+                        wp_send_json( array( 'token' => '' ), 403 );
+                }
+                $token = '';
+                if ( is_user_logged_in() ) {
+                        $token = Emporiqa_Signature::customer_token(
+                                (string) get_current_user_id(),
+                                (string) Emporiqa_Admin::get_option( 'webhook_secret', '' ),
+                                (string) Emporiqa_Admin::get_option( 'store_id', '' )
+                        );
+                }
+                wp_send_json( array( 'token' => $token ) );
+        }
+        /**
+         * The nocache headers with no-store and private, so no shared or browser
+         * cache keeps a customer's token, on every supported WordPress version.
+         *
+         * @since 1.2.0
+         *
+         * @param array $headers Header names and values.
+         * @return array
+         */
+        public static function no_store_headers( array $headers ): array {
+                $headers['Cache-Control'] = 'no-cache, must-revalidate, max-age=0, no-store, private';
+                return $headers;
+        }
+        /**
+         * Whether a token request came from this site's own script: it carries
+         * TOKEN_HEADER, Sec-Fetch-Site (when the browser sends it) is
+         * same-origin, and Origin (when sent) is the site's own host.
+         *
+         * @since 1.2.0
+         *
+         * @param array  $server $_SERVER.
+         * @param string $home   home_url().
+         * @return bool
+         */
+        public static function is_same_site_request( array $server, string $home ): bool {
+                $header = 'HTTP_' . strtoupper( str_replace( '-', '_', self::TOKEN_HEADER ) );
+                if ( '1' !== ( $server[ $header ] ?? '' ) ) {
+                        return false;
+                }
+                $fetch_site = isset( $server['HTTP_SEC_FETCH_SITE'] ) ? strtolower( (string) $server['HTTP_SEC_FETCH_SITE'] ) : '';
+                if ( '' !== $fetch_site && 'same-origin' !== $fetch_site ) {
+                        return false;
+                }
+                $origin = isset( $server['HTTP_ORIGIN'] ) ? (string) $server['HTTP_ORIGIN'] : '';
+                if ( '' === $origin ) {
+                        return true;
+                }
+                $host = self::host_of( $origin );
+                return '' !== $host && self::host_of( $home ) === $host;
+        }
+        /**
+         * The host[:port] of a URL, lowercase; the scheme is left out, since a site
+         * behind a TLS proxy may know itself as http.
+         *
+         * @since 1.2.0
+         *
+         * @param string $url URL.
+         * @return string '' when it has no host.
+         */
+        public static function host_of( string $url ): string {
+                $parts = wp_parse_url( $url );
+                if ( ! is_array( $parts ) || empty( $parts['host'] ) ) {
+                        return '';
+                }
+                return strtolower( $parts['host'] . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' ) );
+        }
 …
         /**
+         * Generate a signed user identity token for the chat widget.
+         *
+         * @since 1.0.0
+         *
+         * @param string $user_id        The customer's user ID.
+         * @param string $webhook_secret The store's webhook secret.
+         * @return string Signed token in format "base64url_payload.hmac_hex".
+         */
+        private function generate_user_token( string $user_id, string $webhook_secret ): string {
+                $payload = wp_json_encode(
+                        array(
+                                'uid' => $user_id,
+                                'ts'  => time(),
+                        )
+                );
+                if ( false === $payload ) {
+                        return '';
+                }
+                // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for signed token encoding.
+                $encoded_payload = rtrim( strtr( base64_encode( $payload ), '+/', '-_' ), '=' );
+                $signature       = hash_hmac( 'sha256', $encoded_payload, $webhook_secret );
+                return $encoded_payload . '.' . $signature;
+         * Whether the page's language is ticked under Languages. A language that
+         * is not ticked is neither synced nor offered: its pages show no chat.
+         *
+         * @since 1.2.0
+         *
+         * @param string   $current The page's language.
+         * @param string[] $enabled Ticked languages.
+         * @return bool
+         */
+        public static function is_language_enabled( string $current, array $enabled ): bool {
+                return empty( $enabled ) || in_array( $current, $enabled, true );
+        }
+        /**
+         * Whether Polylang or WPML gives each page its own language. Without one
+         * the site has a single language, and the chat always shows.
+         *
+         * @return bool
+         */
+        private function is_multilingual(): bool {
+                return function_exists( 'pll_current_language' ) || ( defined( 'ICL_LANGUAGE_CODE' ) && ICL_LANGUAGE_CODE );
+        }

emporiqa/trunk/languages/emporiqa.pot

-              r3678094
+              r3730094
 msgid ""
 msgstr ""
 "Project-Id-Version: Emporiqa 1.1.10\n"
+"Project-Id-Version: Emporiqa 1.2.0\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/emporiqa\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 …
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "POT-Creation-Date: 2026-09-02T13:34:37+00:00\n"
+"POT-Creation-Date: 2026-10-06T05:10:28+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.12.0\n"
 …
 #. Author of the plugin
 #: emporiqa.php
 #: emporiqa.php:1061
 #: emporiqa.php:1110
 #: includes/class-emporiqa-admin.php:59
+#: emporiqa.php:1079
+#: emporiqa.php:1128
+#: includes/class-emporiqa-admin.php:64
 msgid "Emporiqa"
 msgstr ""
 …
 msgstr ""
 #: emporiqa.php:1062
+#: emporiqa.php:1080
 msgid "requires WooCommerce to be installed and active."
 msgstr ""
 #: emporiqa.php:1111
+#: emporiqa.php:1129
 msgid "requires WooCommerce 8.0 or higher. Some features may not work correctly with your current version."
 msgstr ""
 #: emporiqa.php:1128
+#: emporiqa.php:1146
 msgid "Emporiqa activated!"
 msgstr ""
 #: emporiqa.php:1129
+#: emporiqa.php:1147
 msgid "Connect your store to start syncing products and pages."
 msgstr ""
 #: emporiqa.php:1131
+#: emporiqa.php:1149
 msgid "Go to Settings →"
 msgstr ""
 #: includes/class-emporiqa-admin.php:58
+#: includes/class-emporiqa-admin.php:63
 msgid "Emporiqa Settings"
 msgstr ""
 #: includes/class-emporiqa-admin.php:78
 #: includes/class-emporiqa-admin.php:225
+#: includes/class-emporiqa-admin.php:83
+#: includes/class-emporiqa-admin.php:239
 msgid "Settings"
 msgstr ""
 #. translators: %s: link to Sync tab
 #: includes/class-emporiqa-admin.php:101
+#: includes/class-emporiqa-admin.php:106
 #, php-format
 msgid "To sync your products and pages with Emporiqa, go to the <a href=\"%s\">Sync tab</a>."
 msgstr ""
 #: includes/class-emporiqa-admin.php:168
+#: includes/class-emporiqa-admin.php:182
 msgid "Connection Secret is required. Webhooks and user identification will not work without it."
 msgstr ""
 #. translators: %s: link to Emporiqa dashboard integration overview
 #: includes/class-emporiqa-admin.php:197
+#: includes/class-emporiqa-admin.php:211
 #, php-format
 msgid "Before your first sync, make sure your Store ID and Connection Secret are configured. Find both in your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Integration overview</a>."
 msgstr ""
 #: includes/class-emporiqa-admin.php:228
+#: includes/class-emporiqa-admin.php:242
 msgid "Sync"
 msgstr ""
 #: includes/class-emporiqa-admin.php:301
+#: includes/class-emporiqa-admin.php:316
 msgid "Connection Settings"
 msgstr ""
 #: includes/class-emporiqa-admin.php:311
+#: includes/class-emporiqa-admin.php:326
 msgid "Connected."
 msgstr ""
 #: includes/class-emporiqa-admin.php:312
+#: includes/class-emporiqa-admin.php:327
 msgid "Your store is now linked to Emporiqa. Use the Sync tab to send your catalog."
 msgstr ""
+#: includes/class-emporiqa-admin.php:355
+#: includes/class-emporiqa-admin.php:380
+msgid "Ready-made rules"
+msgstr ""
+#: includes/class-emporiqa-admin.php:383
+msgid "Rules tell the chat what to do when a shopper asks for something specific. The rule below reads your WooCommerce orders through this plugin. Click Open in Emporiqa to test it and switch it on there. Rules that do not need your shop, such as return requests, are added in Emporiqa under Settings > Rules."
+msgstr ""
+#: includes/class-emporiqa-admin.php:387
+msgid "The Order status rule is on, so the old order tracking under Advanced is no longer needed. First remove its address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick Order tracking under Advanced and click Save Changes."
+msgstr ""
+#: includes/class-emporiqa-admin.php:392
+msgid "Order status address"
+msgstr ""
+#: includes/class-emporiqa-admin.php:398
+#: includes/class-emporiqa-admin.php:453
+#: includes/class-emporiqa-admin.php:709
+msgid "Copy"
+msgstr ""
+#: includes/class-emporiqa-admin.php:401
+msgid "Emporiqa fills this in for you when you add the Order status rule. If it ever asks for the address, use this one."
+msgstr ""
+#: includes/class-emporiqa-admin.php:403
+msgid "Your site is not served over https, so Emporiqa cannot call it. Switch the site to https (Settings > General), then come back here."
+msgstr ""
+#: includes/class-emporiqa-admin.php:408
+msgid "Order status"
+msgstr ""
+#: includes/class-emporiqa-admin.php:411
+msgid "On"
+msgstr ""
+#: includes/class-emporiqa-admin.php:413
+msgid "Not added"
+msgstr ""
+#: includes/class-emporiqa-admin.php:416
+msgid "Open in Emporiqa"
+msgstr ""
+#: includes/class-emporiqa-admin.php:420
+msgid "Answers \"Where is my order?\" from your WooCommerce orders. A shopper signed in to your shop only gives the order number; a guest also gives the email used for the order."
+msgstr ""
+#: includes/class-emporiqa-admin.php:423
+msgid "On and Not added show what Emporiqa said at your last connect or Test connection (Sync tab). Run Test connection after changing a rule to refresh them."
+msgstr ""
+#: includes/class-emporiqa-admin.php:442
+msgid "Order tracking (old)"
+msgstr ""
+#: includes/class-emporiqa-admin.php:448
+msgid "Answer order lookups at the old order tracking address."
+msgstr ""
+#: includes/class-emporiqa-admin.php:457
+msgid "Replaced by the Order status rule above. Leave it on while your Emporiqa dashboard still has this address. To switch it off, first remove the address in your Emporiqa dashboard (Settings > Integration > For your developer > Order tracking API URL), then untick this and click Save Changes."
+msgstr ""
+#: includes/class-emporiqa-admin.php:527
 msgid "Connect to Emporiqa in one click"
 msgstr ""
 #: includes/class-emporiqa-admin.php:358
+#: includes/class-emporiqa-admin.php:530
 msgid "We'll sign you in, link this store, and send back a fresh connection secret. No copy-pasting."
 msgstr ""
 #: includes/class-emporiqa-admin.php:371
+#: includes/class-emporiqa-admin.php:543
 msgid "Connect to Emporiqa"
 msgstr ""
 #: includes/class-emporiqa-admin.php:376
 #: includes/class-emporiqa-connect.php:133
+#: includes/class-emporiqa-admin.php:548
+#: includes/class-emporiqa-connect.php:148
 msgid "Your site must be served over HTTPS to use one-click connect."
 msgstr ""
 #: includes/class-emporiqa-admin.php:383
+#: includes/class-emporiqa-admin.php:555
 msgid "I'd rather paste credentials manually"
 msgstr ""
 #: includes/class-emporiqa-admin.php:400
+#: includes/class-emporiqa-admin.php:572
 msgid "Connection in progress."
 msgstr ""
 #: includes/class-emporiqa-admin.php:401
+#: includes/class-emporiqa-admin.php:573
 msgid "Finish the steps on emporiqa.com, then come back to this tab."
 msgstr ""
 #. translators: %s: link text for "start over"
 #: includes/class-emporiqa-admin.php:407
+#: includes/class-emporiqa-admin.php:579
 #, php-format
 msgid "Tab got stuck? %s."
 msgstr ""
 #: includes/class-emporiqa-admin.php:411
+#: includes/class-emporiqa-admin.php:583
 msgid "Start over"
 msgstr ""
 #: includes/class-emporiqa-admin.php:432
+#: includes/class-emporiqa-admin.php:604
 msgid "Connected to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:436
 #: includes/class-emporiqa-admin.php:480
+#: includes/class-emporiqa-admin.php:608
+#: includes/class-emporiqa-admin.php:652
 msgid "Store ID"
 msgstr ""
 #: includes/class-emporiqa-admin.php:442
+#: includes/class-emporiqa-admin.php:614
 msgid "Connection secret"
 msgstr ""
 #: includes/class-emporiqa-admin.php:444
+#: includes/class-emporiqa-admin.php:616
 msgid "Stored. Reconnect to rotate."
 msgstr ""
 #: includes/class-emporiqa-admin.php:450
+#: includes/class-emporiqa-admin.php:622
 msgid "Reconnect"
 msgstr ""
 #: includes/class-emporiqa-admin.php:453
+#: includes/class-emporiqa-admin.php:625
 msgid "Open Emporiqa dashboard"
 msgstr ""
 #: includes/class-emporiqa-admin.php:461
+#: includes/class-emporiqa-admin.php:633
 msgid "Edit credentials manually"
 msgstr ""
 #. translators: %s: link to Emporiqa dashboard integration overview
 #: includes/class-emporiqa-admin.php:490
+#: includes/class-emporiqa-admin.php:662
 #, php-format
 msgid "Find it in your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Integration overview</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:499
+#: includes/class-emporiqa-admin.php:671
 msgid "Connection Secret"
 msgstr ""
 #: includes/class-emporiqa-admin.php:505
+#: includes/class-emporiqa-admin.php:677
 msgid "Value is set (leave empty to keep)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:511
+#: includes/class-emporiqa-admin.php:683
 msgid "Not configured"
 msgstr ""
 #: includes/class-emporiqa-admin.php:516
+#: includes/class-emporiqa-admin.php:688
 msgid "Required. Secret key for HMAC signature. Leave empty to keep the current value."
 msgstr ""
 #: includes/class-emporiqa-admin.php:532
+#: includes/class-emporiqa-admin.php:704
 msgid "Order Tracking API URL"
 msgstr ""
-#: includes/class-emporiqa-admin.php:537
-msgid "Copy"
-msgstr ""
 #. translators: %s: link to Emporiqa dashboard order tracking settings
 #: includes/class-emporiqa-admin.php:545
+#: includes/class-emporiqa-admin.php:717
 #, php-format
 msgid "Optional. To enable order tracking in the chat, paste this URL into your <a href=\"%s\" target=\"_blank\">Emporiqa dashboard &rarr; Settings &rarr; Integration &rarr; Order Tracking API URL</a>. Requests are authenticated with your webhook secret; the customer email is always required and must match the order billing email."
 msgstr ""
 #: includes/class-emporiqa-admin.php:569
+#: includes/class-emporiqa-admin.php:741
 msgid "Advanced"
 msgstr ""
 #: includes/class-emporiqa-admin.php:575
+#: includes/class-emporiqa-admin.php:747
 msgid "The defaults work for most stores. Open this only if you want to change what's sent to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:579
+#: includes/class-emporiqa-admin.php:751
 msgid "Sync products"
 msgstr ""
 #: includes/class-emporiqa-admin.php:584
+#: includes/class-emporiqa-admin.php:756
 msgid "Send new and updated products to Emporiqa so the chat can recommend them."
 msgstr ""
 #: includes/class-emporiqa-admin.php:589
+#: includes/class-emporiqa-admin.php:761
 msgid "Sync pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:594
+#: includes/class-emporiqa-admin.php:766
 msgid "Send pages and blog content so the chat can answer questions about your shipping, returns, FAQs, and similar."
 msgstr ""
 #: includes/class-emporiqa-admin.php:599
+#: includes/class-emporiqa-admin.php:771
 msgid "Languages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:616
+#: includes/class-emporiqa-admin.php:788
 msgid "Pick the languages of your products and pages to send. The chat replies in each shopper's language for any of these."
 msgstr ""
 #: includes/class-emporiqa-admin.php:621
+#: includes/class-emporiqa-admin.php:793
 msgid "Pages and posts to include"
 msgstr ""
 #: includes/class-emporiqa-admin.php:642
+#: includes/class-emporiqa-admin.php:814
 msgid "Which kinds of content count as \"pages\" for the chat. Most stores leave this as Pages only. Add Posts if you want your blog articles included."
 msgstr ""
 #: includes/class-emporiqa-admin.php:647
+#: includes/class-emporiqa-admin.php:824
 msgid "Emporiqa server URL"
 msgstr ""
 #: includes/class-emporiqa-admin.php:652
+#: includes/class-emporiqa-admin.php:829
 msgid "Where this site sends product and page updates. Keep the default (https://emporiqa.com/webhooks/sync/) unless Emporiqa support asked you to change it."
 msgstr ""
 #: includes/class-emporiqa-admin.php:657
+#: includes/class-emporiqa-admin.php:834
 msgid "Items per batch"
 msgstr ""
 #: includes/class-emporiqa-admin.php:662
+#: includes/class-emporiqa-admin.php:839
 msgid "How many products to send at a time during the first sync. The default works for almost everyone. If a sync stops partway through on a big catalog, try a smaller number (10 or 15)."
 msgstr ""
 #: includes/class-emporiqa-admin.php:811
+#: includes/class-emporiqa-admin.php:988
 msgid "Connected to Emporiqa. One more step."
 msgstr ""
 #: includes/class-emporiqa-admin.php:815
+#: includes/class-emporiqa-admin.php:992
 msgid "Send your products and pages to Emporiqa so the chat has something to recommend. We'll send everything in batches in the background."
 msgstr ""
 #: includes/class-emporiqa-admin.php:828
+#: includes/class-emporiqa-admin.php:1005
 msgid "Send my catalog"
 msgstr ""
 #. translators: 1: total item count, 2: typical time
 #: includes/class-emporiqa-admin.php:834
+#: includes/class-emporiqa-admin.php:1011
 #, php-format
 msgid "%1$d items to send. Typically a few minutes."
 msgstr ""
 #: includes/class-emporiqa-admin.php:842
+#: includes/class-emporiqa-admin.php:1019
 msgid "The chat goes live on your storefront once the first full sync finishes. You don't need to keep this tab open. Sync runs from your store."
 msgstr ""
 #: includes/class-emporiqa-admin.php:847
+#: includes/class-emporiqa-admin.php:1024
 msgid "Bulk Sync"
 msgstr ""
 #: includes/class-emporiqa-admin.php:849
+#: includes/class-emporiqa-admin.php:1026
 msgid "Use \"Sync All\" for your initial sync. After that, product and page changes are sent automatically in real-time via webhooks."
 msgstr ""
 #: includes/class-emporiqa-admin.php:855
+#: includes/class-emporiqa-admin.php:1032
 msgid "products"
 msgstr ""
 #. translators: %s: language codes
 #: includes/class-emporiqa-admin.php:859
+#: includes/class-emporiqa-admin.php:1036
 #, php-format
 msgid "(all languages synced per product: %s)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:866
+#: includes/class-emporiqa-admin.php:1043
 msgid "No published products found. Make sure you have published products before syncing."
 msgstr ""
 #. translators: %s: link to settings tab
 #: includes/class-emporiqa-admin.php:875
+#: includes/class-emporiqa-admin.php:1052
 #, php-format
 msgid "Product sync is disabled &mdash; <a href=\"%s\">enable it in the Settings tab</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:885
+#: includes/class-emporiqa-admin.php:1062
 msgid "pages"
 msgstr ""
 #. translators: %s: language codes
 #: includes/class-emporiqa-admin.php:889
+#: includes/class-emporiqa-admin.php:1066
 #, php-format
 msgid "(all languages synced per page: %s)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:896
+#: includes/class-emporiqa-admin.php:1073
 msgid "No published pages found. Make sure you have published pages before syncing."
 msgstr ""
 #. translators: %s: link to settings tab
 #: includes/class-emporiqa-admin.php:905
+#: includes/class-emporiqa-admin.php:1082
 #, php-format
 msgid "Page sync is disabled &mdash; <a href=\"%s\">enable it in the Settings tab</a>"
 msgstr ""
 #: includes/class-emporiqa-admin.php:917
+#: includes/class-emporiqa-admin.php:1094
 msgid "Please configure your Store ID and Connection Secret in the Settings tab before syncing."
 msgstr ""
 #: includes/class-emporiqa-admin.php:929
+#: includes/class-emporiqa-admin.php:1106
 msgid "Sync Products"
 msgstr ""
 #: includes/class-emporiqa-admin.php:931
+#: includes/class-emporiqa-admin.php:1108
 msgid "Send all products to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:936
 #: includes/class-emporiqa-admin.php:957
 #: includes/class-emporiqa-admin.php:976
+#: includes/class-emporiqa-admin.php:1113
+#: includes/class-emporiqa-admin.php:1134
+#: includes/class-emporiqa-admin.php:1153
 msgid "Configure your Store ID and Connection Secret first"
 msgstr ""
 #: includes/class-emporiqa-admin.php:938
+#: includes/class-emporiqa-admin.php:1115
 msgid "Enable product sync in the Settings tab"
 msgstr ""
 #: includes/class-emporiqa-admin.php:950
+#: includes/class-emporiqa-admin.php:1127
 msgid "Sync Pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:952
+#: includes/class-emporiqa-admin.php:1129
 msgid "Send all pages to Emporiqa."
 msgstr ""
 #: includes/class-emporiqa-admin.php:959
+#: includes/class-emporiqa-admin.php:1136
 msgid "Enable page sync in the Settings tab"
 msgstr ""
 #: includes/class-emporiqa-admin.php:971
+#: includes/class-emporiqa-admin.php:1148
 msgid "Sync All"
 msgstr ""
 #: includes/class-emporiqa-admin.php:973
+#: includes/class-emporiqa-admin.php:1150
 msgid "Send all products and pages at once."
 msgstr ""
 #: includes/class-emporiqa-admin.php:984
+#: includes/class-emporiqa-admin.php:1161
 msgid "Cancel"
 msgstr ""
 #: includes/class-emporiqa-admin.php:995
+#: includes/class-emporiqa-admin.php:1172
 msgid "Sync log"
 msgstr ""
 #: includes/class-emporiqa-admin.php:998
+#: includes/class-emporiqa-admin.php:1175
 msgid "Test Connection"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1000
+#: includes/class-emporiqa-admin.php:1177
 msgid "Sends a real product to Emporiqa in dry run mode. Validates the connection, signature, and payload without storing anything."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1004
+#: includes/class-emporiqa-admin.php:1181
 msgid "Test Connection (Dry Run)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1011
+#: includes/class-emporiqa-admin.php:1188
 msgid "WP-CLI Commands (for developers)"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1059
+#: includes/class-emporiqa-admin.php:1236
 msgid "Testing..."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1060
+#: includes/class-emporiqa-admin.php:1237
 msgid "Copied!"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1062
+#: includes/class-emporiqa-admin.php:1239
 msgid "Initializing sync..."
 msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1064
+#: includes/class-emporiqa-admin.php:1241
 #, php-format
 msgid "Started %s sync"
 …
 #. translators: 1: number of items, 2: number of events, 3: entity type
 #: includes/class-emporiqa-admin.php:1066
+#: includes/class-emporiqa-admin.php:1243
 #, php-format
 msgid "Processed %1$d items (%2$d events) for %3$s"
 …
 #. translators: %s: entity type
 #: includes/class-emporiqa-admin.php:1068
+#: includes/class-emporiqa-admin.php:1245
 #, php-format
 msgid "Batch failed for %s"
 msgstr ""
+#. translators: 1: entity type (products/pages), 2: seconds
+#: includes/class-emporiqa-admin.php:1247
+#, php-format
+msgid "Emporiqa is busy and asked to wait. Sending this %1$s batch again in %2$d seconds."
+msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1070
+#: includes/class-emporiqa-admin.php:1249
 #, php-format
 msgid "Completed %s sync session"
 …
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1072
+#: includes/class-emporiqa-admin.php:1251
 #, php-format
 msgid "Failed to complete %s session"
 …
 #. translators: 1: entity type (products/pages), 2: total count
 #: includes/class-emporiqa-admin.php:1074
+#: includes/class-emporiqa-admin.php:1253
 #, php-format
 msgid "Total %1$s synced: %2$d items"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1075
+#: includes/class-emporiqa-admin.php:1254
 msgid "Sync completed successfully!"
 msgstr ""
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1077
+#: includes/class-emporiqa-admin.php:1256
 #, php-format
 msgid "The %s sync session was not finalized because some batches failed: items missing from this sync were NOT removed from Emporiqa. Re-run the sync after resolving the errors."
 …
 #. translators: %s: entity type (products/pages)
 #: includes/class-emporiqa-admin.php:1079
+#: includes/class-emporiqa-admin.php:1258
 #, php-format
 msgid "No %s were synced, so the session was not finalized."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1080
+#: includes/class-emporiqa-admin.php:1259
 msgid "Sync finished with errors — see the log above. Re-run the sync after resolving them."
 msgstr ""
 #. translators: 1: Products link placeholder, 2: Pages link placeholder
 #: includes/class-emporiqa-admin.php:1082
+#: includes/class-emporiqa-admin.php:1261
 #, php-format
 msgid "Your data is now being processed by Emporiqa. This may take a few minutes before changes are fully reflected in the chat assistant. You can check the status on the %1$s or %2$s list in your Emporiqa dashboard."
 …
 #. translators: used as link text in sync log
 #: includes/class-emporiqa-admin.php:1086
+#: includes/class-emporiqa-admin.php:1265
 msgid "Products"
 msgstr ""
 #. translators: used as link text in sync log
 #: includes/class-emporiqa-admin.php:1088
+#: includes/class-emporiqa-admin.php:1267
 msgid "Pages"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1089
+#: includes/class-emporiqa-admin.php:1268
 msgid "Sync cancelled."
 msgstr ""
 #. translators: %s: error message
 #: includes/class-emporiqa-admin.php:1091
+#: includes/class-emporiqa-admin.php:1270
 #, php-format
 msgid "Sync failed: %s"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1092
+#: includes/class-emporiqa-admin.php:1271
 msgid "Failed to initialize sync."
 msgstr ""
 #: includes/class-emporiqa-admin.php:1093
+#: includes/class-emporiqa-admin.php:1272
 msgid "Sample product payload"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1094
+#: includes/class-emporiqa-admin.php:1273
 msgid "Sample page payload"
 msgstr ""
 #: includes/class-emporiqa-admin.php:1111
+#: includes/class-emporiqa-admin.php:1290
 #: includes/class-emporiqa-sync.php:65
 #: includes/class-emporiqa-sync.php:161
 #: includes/class-emporiqa-sync.php:201
+#: includes/class-emporiqa-sync.php:165
+#: includes/class-emporiqa-sync.php:209
 msgid "Permission denied."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:81
 #: includes/class-emporiqa-cart-ajax.php:190
 #: includes/class-emporiqa-cart-ajax.php:229
+#: includes/class-emporiqa-cart-ajax.php:89
+#: includes/class-emporiqa-cart-ajax.php:198
+#: includes/class-emporiqa-cart-ajax.php:237
 msgid "No product ID provided."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:90
+#: includes/class-emporiqa-cart-ajax.php:98
 msgid "Product not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:95
+#: includes/class-emporiqa-cart-ajax.php:103
 msgid "This product cannot be purchased."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:98
+#: includes/class-emporiqa-cart-ajax.php:106
 msgid "This product is currently out of stock."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:109
+#: includes/class-emporiqa-cart-ajax.php:117
 msgid "Parent product not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:119
+#: includes/class-emporiqa-cart-ajax.php:127
 msgid "Please select a product variation."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:128
+#: includes/class-emporiqa-cart-ajax.php:136
 msgid "Variation not found."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:131
+#: includes/class-emporiqa-cart-ajax.php:139
 msgid "This variation cannot be purchased."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:134
+#: includes/class-emporiqa-cart-ajax.php:142
 msgid "This variation is currently out of stock."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:144
+#: includes/class-emporiqa-cart-ajax.php:152
 msgid "Failed to add item to cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:194
+#: includes/class-emporiqa-cart-ajax.php:202
 msgid "Quantity must be greater than zero."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:199
 #: includes/class-emporiqa-cart-ajax.php:234
+#: includes/class-emporiqa-cart-ajax.php:207
+#: includes/class-emporiqa-cart-ajax.php:242
 msgid "Item not found in cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:206
+#: includes/class-emporiqa-cart-ajax.php:214
 msgid "Failed to update cart."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:241
+#: includes/class-emporiqa-cart-ajax.php:249
 msgid "Failed to remove item."
 msgstr ""
 #: includes/class-emporiqa-cart-ajax.php:316
+#: includes/class-emporiqa-cart-ajax.php:326
 msgid "Security check failed. Please refresh the page and try again."
 msgstr ""
 #: includes/class-emporiqa-connect.php:145
+#: includes/class-emporiqa-connect.php:160
 msgid "Couldn't save the connection state. Please try again."
 msgstr ""
 #: includes/class-emporiqa-connect.php:194
+#: includes/class-emporiqa-connect.php:209
 msgid "Unexpected redirect source."
 msgstr ""
 #: includes/class-emporiqa-connect.php:199
+#: includes/class-emporiqa-connect.php:214
 msgid "Callback missing required parameters."
 msgstr ""
 #: includes/class-emporiqa-connect.php:207
+#: includes/class-emporiqa-connect.php:222
 msgid "Connection link expired or already used. Click Connect to try again."
 msgstr ""
 #. translators: %s: WP HTTP API error message
 #: includes/class-emporiqa-connect.php:237
+#: includes/class-emporiqa-connect.php:255
 #, php-format
 msgid "Couldn't reach Emporiqa: %s"
 …
 #. translators: %s: error code from the exchange endpoint
 #: includes/class-emporiqa-connect.php:253
+#: includes/class-emporiqa-connect.php:278
 #, php-format
 msgid "Emporiqa refused the connection: %s"
 msgstr ""
 #: includes/class-emporiqa-formatter.php:941
 #: includes/class-emporiqa-formatter.php:952
+#: includes/class-emporiqa-formatter.php:869
+#: includes/class-emporiqa-formatter.php:880
 msgid "General"
 msgstr ""
 #: includes/class-emporiqa-formatter.php:1021
+#: includes/class-emporiqa-formatter.php:1245
 msgid "Generic"
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:80
+#: includes/class-emporiqa-order-tracking.php:96
 msgid "Missing signature."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:89
 #: includes/class-emporiqa-order-tracking.php:99
+#: includes/class-emporiqa-order-tracking.php:105
+#: includes/class-emporiqa-order-tracking.php:115
 msgid "Invalid signature."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:108
+#: includes/class-emporiqa-order-tracking.php:124
 msgid "Invalid JSON in request body."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:117
+#: includes/class-emporiqa-order-tracking.php:133
 msgid "Request expired."
 msgstr ""
 #: includes/class-emporiqa-order-tracking.php:158
+#: includes/class-emporiqa-order-tracking.php:197
 msgid "Invalid payload: order_identifier is required."
 msgstr ""
+#: includes/class-emporiqa-order-tracking.php:185
+#: includes/class-emporiqa-order-tracking.php:205
+#: includes/class-emporiqa-order-tracking.php:303
+#: includes/class-emporiqa-order-tracking.php:312
+msgid "Order not found."
+msgstr ""
+#: includes/class-emporiqa-order-tracking.php:230
 msgid "Too many requests. Please try again later."
-msgstr ""
-#: includes/class-emporiqa-order-tracking.php:251
-#: includes/class-emporiqa-order-tracking.php:260
-msgid "Order not found."
 msgstr ""
 …
 msgstr ""
 #: includes/class-emporiqa-sync.php:217
+#: includes/class-emporiqa-sync.php:225
 msgid "Unknown or expired sync session — it was not finalized. Re-run the sync."
 msgstr ""
 #. translators: 1: number of items that failed, 2: entity type (products or pages).
 #: includes/class-emporiqa-sync.php:228
+#: includes/class-emporiqa-sync.php:236
 #, php-format
 msgid "The %2$s sync session was not finalized because %1$d item(s) failed to sync: items missing from this sync were NOT removed from Emporiqa. Re-run the sync after resolving the errors."
 msgstr ""
+#: includes/class-emporiqa-sync.php:240
+#. translators: %s: entity type (products or pages).
+#: includes/class-emporiqa-sync.php:250
+#, php-format
+msgid "The %s sync session was not finalized because Emporiqa asked to wait and a batch was not sent again: items missing from this sync were NOT removed from Emporiqa. Re-run the sync."
+msgstr ""
+#: includes/class-emporiqa-sync.php:261
 msgid "No items were synced in this session, so it was not finalized (finalizing an empty session would delete the entire remote catalog)."
 msgstr ""
 #: includes/class-emporiqa-sync.php:249
+#: includes/class-emporiqa-sync.php:270
 msgid "Session completed."
 msgstr ""
 #: includes/class-emporiqa-sync.php:252
+#: includes/class-emporiqa-sync.php:273
 msgid "Failed to complete sync session."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:915
+#: includes/class-emporiqa-webhook.php:989
 msgid "Unknown error"
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1000
+#: includes/class-emporiqa-webhook.php:1074
 msgid "Store ID is not configured."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1009
+#: includes/class-emporiqa-webhook.php:1083
 msgid "Connection Secret is not configured."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1018
+#: includes/class-emporiqa-webhook.php:1092
 msgid "No published products found. Add a product before testing."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1027
+#: includes/class-emporiqa-webhook.php:1101
 msgid "Failed to format product for dry run."
 msgstr ""
+#: includes/class-emporiqa-webhook.php:1058
+#. translators: %d: number of minutes
+#: includes/class-emporiqa-webhook.php:1123
+#, php-format
+msgid "This server's clock is %d minutes off. Ask your host to turn on time synchronisation (NTP): Emporiqa refuses data sent with a clock more than 5 minutes off."
+msgstr ""
+#: includes/class-emporiqa-webhook.php:1149
 msgid "Connection successful, but there are warnings."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1059
+#: includes/class-emporiqa-webhook.php:1150
 msgid "Connection successful! All fields validated."
 msgstr ""
 #. translators: %s: human-readable error message from the Emporiqa server
 #: includes/class-emporiqa-webhook.php:1067
+#: includes/class-emporiqa-webhook.php:1158
 #, php-format
 msgid "Connection failed: %s"
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1174
+#: includes/class-emporiqa-webhook.php:1249
 msgid "Webhook not configured (missing Store ID)."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1183
+#: includes/class-emporiqa-webhook.php:1258
 msgid "Connection Secret is not configured. Go to Settings > Emporiqa to set it."
 msgstr ""
 #: includes/class-emporiqa-webhook.php:1196
+#: includes/class-emporiqa-webhook.php:1271
 msgid "Failed to encode payload as JSON."
 msgstr ""
 #. translators: %d: HTTP status code
 #: includes/class-emporiqa-webhook.php:1249
+#: includes/class-emporiqa-webhook.php:1323
 #, php-format
 msgid "Unexpected status code: %d"

emporiqa/trunk/readme.txt

-              r3725261
+              r3730094
 Contributors: rosenhristov1
 Tags: ai chatbot, live chat, woocommerce chatbot, ecommerce chatbot, ai customer support
 Requires at least: 6.0
+Requires at least: 6.2
 Tested up to: 7.1
 Requires Plugins: woocommerce
 Requires PHP: 7.4
 WC requires at least: 8.0
 WC tested up to: 10.9
 Stable tag: 1.1.10
+WC tested up to: 11.1
+Stable tag: 1.2.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 Price, stock and status changes reach Emporiqa as you make them; a few edits need one Sync All afterwards, which the [documentation](https://emporiqa.com/docs/woocommerce/) covers. The same chatbot also runs on Drupal Commerce, Magento, PrestaShop, Shopware and Sylius.
+= Privacy and security notes =
+The signed-in shopper's token is fetched from `admin-ajax.php?action=emporiqa_customer_token`. It is read-only and returns only the current session's own identity token. It cannot be nonce-protected, because the page that would carry the nonce is full-page cached; cross-site use is blocked instead by a required custom header (which forces a CORS preflight) and a Sec-Fetch-Site / Origin check, and the answer is never cached.
 = Third-Party Service =
 This plugin requires an [Emporiqa](https://emporiqa.com) account and sends data there. Your catalog and synced pages go to `https://emporiqa.com/webhooks/sync/`, signed with HMAC-SHA256; the widget script loads from `https://emporiqa.com/chat/embed/`; connecting uses a PKCE handshake via `https://emporiqa.com/connect/start`. What a shopper types, and any photo uploaded for visual search, is processed by Emporiqa's AI provider and never trains AI models. If you switch on voice mode, a shopper's spoken message goes to that provider to be turned into text and the reply is read aloud by an AI voice; Emporiqa does not keep the recording. Emporiqa may call your REST API for an order status. [Terms of Service](https://emporiqa.com/terms-of-service/), [Privacy Policy](https://emporiqa.com/privacy-policy/).
+This plugin requires an [Emporiqa](https://emporiqa.com) account and sends data there. Your catalog and synced pages go to `https://emporiqa.com/webhooks/sync/`, signed with HMAC-SHA256; the widget script loads from `https://emporiqa.com/chat/embed/`; connecting uses a PKCE handshake via `https://emporiqa.com/connect/start`. What a shopper types, and any photo uploaded for visual search, is processed by Emporiqa's AI provider and never trains AI models. If you switch on voice mode, a shopper's spoken message goes to that provider to be turned into text and the reply is read aloud by an AI voice; Emporiqa does not keep the recording. Sync requests carry the plugin version (`X-Emporiqa-Plugin-Version`). If you add the Order status rule, Emporiqa calls this site's `/wp-json/emporiqa/v1/actions/order-status` with a signed request to look up the order a shopper asks about; the older order tracking address `/wp-json/emporiqa/api/order/tracking` keeps working while you use it. When a shopper is signed in to your store, the chat sends Emporiqa their WordPress user ID (signed, never their name or email), so Order status can find their own orders without an email and `/wp-json/emporiqa/v1/actions/customer-prices` can answer with the prices your shop gives that customer. Emporiqa also calls `/wp-json/emporiqa/v1/actions/verify` to check the address is yours. Each of these answers only a request signed with your store's connection secret (HMAC-SHA256, within 5 minutes), checked by the route's permission callback; the one unsigned call is the connect check, answered only during a connection you started in the last 2 minutes. [Terms of Service](https://emporiqa.com/terms-of-service/), [Privacy Policy](https://emporiqa.com/privacy-policy/).
 == Installation ==
 …
 . Order tracking: the chat asks for an order number and matching email
 . Dashboard (demo store data): chat status, spend, revenue from chat
 . Billing: pay-as-you-go, $0.00 a month, $0.25 a conversation, $59 cap
+. Billing: pay-as-you-go at $0.25 a conversation, capped at $59 a month, with the next billing date
 . Voice mode, if you switch it on: the answer is read aloud in an AI voice while the product cards stay on screen
 == Changelog ==
+= 1.2.0 =
+* New: Order status, a ready-made rule. Shoppers ask "where is my order?" and the chat answers from your WooCommerce orders: status, order date and tracking numbers (WooCommerce Shipment Tracking and Advanced Shipment Tracking are read when installed). A signed-in shopper only gives the order number; a guest also gives the order's email. Settings > Emporiqa shows the Order status address to copy into the rule in Emporiqa, and whether the rule is on.
+* Changed: a signed-in shopper's identity is no longer written into the page or the chat script's URL, where a full-page cache could hand it to another shopper and server logs could keep it. The chat asks for it when it opens, from an uncached request.
+* Changed: the old order tracking keeps working as before and stays on. Where ready-made rules are offered it moves under Advanced, with how to switch it off once the Order status rule replaces it.
+* Changed: sync requests are also signed with Emporiqa's newer per-purpose keys and carry the plugin version; connecting proves the request came from your site; a connection Emporiqa holds for an owner's approval shows Emporiqa's own explanation.
+* Changed: prices are sent as your shop shows them. A shop that enters prices without tax but shows them with tax (or the reverse) used to send the entered amount; prices with and without tax are now both sent when taxes are on.
+* Fix: prices are always synced as a signed-out visitor sees them, with tax at your shop's address. A role, B2B or wholesale pricing plugin could otherwise send the price of whoever saved the product or ran the sync as the public price. The chat's cart now shows each item's price with or without tax as your cart page does.
+* Fix: Sync All pages through products and pages by id, so a product changed during a sync can no longer be skipped and then removed from Emporiqa.
+* Fix: an order conversion that Emporiqa could not receive after every retry is sent again at the order's next paid status.
+* Changed: a language you did not tick under Languages (Polylang or WPML) is neither synced nor offered: its pages show no chat.
+* New: customer prices. Emporiqa can ask this site for a signed-in shopper's own prices (`actions/customer-prices`), read by WooCommerce as that shopper with tax for their address. WooCommerce has one price per product, so this is your public price unless a role, B2B or wholesale pricing plugin gives that customer another; only prices are returned, and products the shopper cannot see are left out.
+* New: quantity price tiers. The Tiered Price Table plugin's tiers are sent when it is active, and the `emporiqa_price_tiers` filter lets any other quantity-pricing plugin send its own (WooCommerce has none of its own); each tier is the unit price the cart charges, with tax as your shop shows prices.
+* Changed: the signed-in shopper's token request requires a custom header and refuses cross-site requests; guests no longer reach it at all.
+* Fix: the old order tracking reads a typed number only as an order number, never as another order's internal id.
+* Test connection warns when this server's clock is more than 2 minutes off.
+* Changed: a variation is sent without the description, categories and brand it shares with its product, and Emporiqa reads them from the product, so syncs send less.
+* Fix: moving a variable product to the Trash now removes its variations from Emporiqa straight away, not only at the next Sync All.
+* Fix: on a page served from a full-page cache long enough for its security token to expire, the chat's first add to cart no longer fails with "Security check failed"; it is retried once with a fresh token.
+* Fix: when Emporiqa is busy and asks a sync to slow down, Sync All and the WP-CLI sync wait as asked and send the same batch again, instead of failing the sync and blocking the next one for an hour.
+* Fix: the chat's cart actions now refuse requests sent from another website, and a guest's cart security token is tied to that guest's own cart.
+* Fix: the Mini-Cart block of block themes (such as Twenty Twenty-Five) now updates when the chat adds or removes items; it used to show the old count until the page was reloaded.
+* Changed: requires WordPress 6.2, the oldest version WooCommerce 8.0 runs on. The signed-in shopper's token answer is marked no-store and private on every supported WordPress version.
 = 1.1.10 =
 …
 * Text only. No functional changes.
-= 1.1.9 =
-* Fix: a full sync now finalizes only when every batch succeeds, so a failed batch can no longer drop items still present in your store from the chat's index. Nothing in your WooCommerce store was ever modified.
-* Fix: variable products with parent-managed stock no longer over-report quantity, and decimal quantities are no longer truncated in the cart.
 Older entries are in changelog.txt, shipped with the plugin.
 == Upgrade Notice ==
+= 1.2.0 =
+Adds the Order status rule, and keeps a signed-in shopper's identity out of cached pages. Old order tracking keeps working; nothing to do after updating.
 = 1.1.10 =
 Text-only update: the plugin's setup instructions now match the renamed Integration section of the Emporiqa dashboard.
-= 1.1.9 =
-Important fix: a bulk sync that hit errors could remove valid products or pages from your Emporiqa catalog. Syncs now finalize only when every batch succeeds. Also fixes over-reported stock and truncated decimal quantities.

emporiqa/trunk/uninstall.php

-              r3546004
+              r3730094
 delete_option( 'emporiqa_pending_async_events' );
 delete_option( 'emporiqa_instance_id' );
+delete_option( 'emporiqa_rules_status' );
 // Clean up retry transients + one-click connect handshake transients.
 …
+}
+// Clean up dispatch payload transients (1.1.3+).
+$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_emporiqa_event_%' OR option_name LIKE '_transient_timeout_emporiqa_event_%'" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+// Clean up dispatch payload transients (1.1.3+) and the Order status
+// rate-limit and request-replay transients (1.2.0+).
+$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_emporiqa_event_%' OR option_name LIKE '_transient_timeout_emporiqa_event_%' OR option_name LIKE '_transient_emporiqa_arl_%' OR option_name LIKE '_transient_timeout_emporiqa_arl_%' OR option_name LIKE '_transient_emporiqa_areq_%' OR option_name LIKE '_transient_timeout_emporiqa_areq_%'" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
 // Clean up order meta.

Context Navigation

Legend:

Download in other formats: