=== Sellpay Sandbox for WooCommerce ===
Requires at least: 6.5
Requires PHP: 8.0
Stable tag: 0.1.0
License: GPL-2.0-or-later

Sandbox-only pre-release. Test on a staging store, not on saleable inventory.
Requires WooCommerce 8.3+, USD currency, HTTPS and publicly accessible WordPress REST API.
Classic and block checkout adapters are included. HPOS uses WooCommerce order CRUD.

1. Upload and activate this ZIP in WordPress Plugins.
2. Generate a sandbox API key in Sellpay > Integrations.
3. Open WooCommerce > Settings > Payments > Sellpay Sandbox. Paste the key.
4. Copy the webhook URL displayed there to Sellpay's HTTPS webhook destination.
5. Paste the returned whsec_test_ signing secret into the plugin; enable it.
6. As a store administrator/shop manager, buy a test product. Open Payments in Sellpay
   and simulate the invoice as paid. Verify the WooCommerce order updates.

The gateway is intentionally hidden from ordinary shoppers. Simulated paid orders can
send WooCommerce emails, grant downloads and reduce stock. No actual money is received.
There is no automatic browser redirect back from the sandbox checkout yet.
Customers cannot simulate payments; that action requires a Sellpay merchant session.
One API key and webhook destination are shared by all integrations for this merchant.
Rotating the key/secret requires updating the plugin. Unrelated invoice events are ignored.
The plugin does not implement refunds, subscriptions, currency conversion or live payments.
Secrets are stored in private WordPress settings. Protect database backups and admin access.
Database GET_LOCK support (MySQL/MariaDB) is required; failure stops processing safely.

Webhook troubleshooting: Sellpay Integrations shows attempts, response status and replay.
401: signing secret mismatch or clock skew over five minutes.
503: invoice save race, order lock busy or Sellpay API unavailable; delivery retries.
409: order/invoice mismatch; investigate before replaying. Never manually mark a real order paid.
Failed/expired invoices require a new test order. Browser returns are never proof of payment.
