# WordPress plugin setup

Requirements: WordPress 6.0+, WooCommerce 7.0+, PHP 7.4+ (8.x recommended), HTTPS site with a reachable REST API (`/wp-json/` or `/?rest_route=`).

1. WordPress → Plugins → Add New → Upload `voiceorder-wordpress-plugin.zip` → Activate. (Compatible with HPOS and the Cart/Checkout blocks – declared in the plugin.)
2. In the **VoiceOrder SaaS** dashboard: Websites → **Generate pairing code** (valid 30 minutes, single use).
3. WordPress → **VoiceOrder → Website Connection**: enter the server URL (`https://app.example.com`) and the pairing code → **Connect website**. The plugin receives its credentials, and the SaaS verifies ownership by fetching `/wp-json/voiceorder/v1/ownership`. Status becomes *active*.
4. **Voice Settings**: language, voice, scripts, delay, retries (edited in your SaaS account; limited by admin-defined maximums). On-site toggles: automatic calling, COD-only, confirm already-paid orders.
5. Place a test order with a valid mobile number. After the configured delay the customer is called. Press 1 → order **Confirmed**; press 2 → **Cancelled**; no answer → status unchanged.

* **No account yet?** The Website Connection page can register one (you still verify the email in your inbox → receive 5 free calls).
* **Second website?** The connect step explains the one-website rule and lets you request approval; after approval generate a new pairing code and connect.
* **Regenerated keys?** Paste the new API key + callback secret under *Replace credentials*.
* **Manual call**: order screen → *Order actions* → "VoiceOrder: call customer now (price)", or VoiceOrder → Call History.
* **Updates**: appear in the normal WordPress Updates screen when the Super Admin publishes a release; downloads use a 10-minute signed URL and are SHA-256 verified.

## Behaviour guarantees
* One automatic call per order (guard meta + SaaS idempotency key `order-{id}`), regardless of how many hooks fire (`woocommerce_checkout_order_processed` and the Store API hook are both handled).
* Never called: cancelled, refunded, failed, completed, trashed/draft orders, or orders without a phone number. Cancelling/refunding an order tells the SaaS to drop any not-yet-dialled call and release the credit.
* **Confirming never marks anything as paid** (no `payment_complete`, no `date_paid`). Already-paid orders get a note only unless you enable "confirm paid orders".
* Orders already `completed`/`refunded`/`cancelled` are not overwritten by a late call result.
* Credentials are encrypted at rest (libsodium, key derived from WP salts) and never logged. Provider (TZSMM etc.) credentials never leave the SaaS.
* Deactivating the plugin only stops hooks. **Uninstalling** deletes local settings/log table only; your SaaS wallet, history and website record stay (so reinstalling gives no new free credits or website slot).

## Known limitations
Not run on a real WordPress/WooCommerce in this build – see the testing report. Multisite is untested. Languages: UI strings are translatable (`voiceorder` text domain) but no translation files are shipped.