=== Vector Analytical — The Record ===
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.2.0
Tags: certificate, coa, verification, peptide, laboratory

Let visitors check a Vector Analytical certificate against The Record — no account, and the file never leaves their browser.

== Description ==

Vector Analytical is a third-party laboratory testing research peptides. Every test it performs is issued to a numbered record in a public registry, The Record, that anyone can check without an account.

This plugin puts that check on your pages. A visitor can:

* Enter a record number printed on a certificate and learn whether Vector Analytical issued it, and whether it still stands.
* Choose the certificate PDF and learn whether it is, byte for byte, the document Vector Analytical issued. The file is hashed in the visitor's own browser and never uploaded — to you or to Vector.
* Follow a link to order a test at Vector Analytical.
* On a product page, see Identity, Purity, the certificate and the full panel for that material, each with what it tells you and what it does not, and order the ones Vector sells — at Vector's published price, on Vector's order page.
* See the certificates Vector Analytical has issued to your shop, listed from the laboratory's own registry — not from files you uploaded — each opening Vector's public check. Free.

Every answer comes from Vector Analytical's public verification endpoint, fetched by the visitor's browser and shown word for word. Your site cannot change what the answer says, cannot upload a certificate to The Record, and cannot issue one. Vector Analytical is always the issuer. That is the point: a certificate a shop can restyle is a certificate a shop can fake.

The plugin stores no secret. Its settings are your shop's tenant slug — its public identifier on The Record, which "Connect Vector account" fetches through Vector's own sign-in and which every order link carries, so Vector records orders placed from your pages as referred by you — and, for the certificate list, a publishable site key created free in your Vector dashboard. The plugin is free; Vector hosting your issued certificates is free; listing them on your shop is free. There is no plan to buy for any of this.

**Empty registry, empty answers.** If Vector Analytical has not issued a record, the plugin says exactly that. It never shows an example record, a sample certificate or a placeholder result.

== Installation ==

1. Copy the `vector-record` folder into `wp-content/plugins/`, or upload it as a zip from Plugins → Add New → Upload Plugin.
2. Activate "Vector Analytical — The Record" under Plugins.
3. Optionally, under Settings → Vector Analytical, click "Connect Vector account". You sign in at Vector Analytical, Vector shows which account you hold and asks before sending its account ID back. No password or key is stored in WordPress. (You may also type the slug by hand.) To list your certificates, also paste the free, publishable site key from your Vector dashboard.
4. Add the "Vector Analytical record" block to a page, or place the shortcode:

    [vector_record]

On a page that sells a tested lot, cite its record so the check is bound to it:

    [vector_record record="…"]

Write the number exactly as printed on the certificate. Attributes:

* `record` — the record number this page cites. The widget looks it up as soon as the page loads.
* `file` — `yes` (default) or `no`: offer to check a PDF.
* `lookup` — `yes` (default) or `no`: offer a record-number field.
* `order` — `yes` (default) or `no`: show the link to order a test.

On a product page, offer the three lines for the material it sells:

    [vector_order test="…"]

`test` is the material's slug on Vector Analytical's test menu (for example the last part of the material's address there). Leave it out and the visitor chooses the material on Vector's order page. The block "Order a Vector Analytical test" does the same with a picker.

To list your shop's issued certificates:

    [vector_records]
    [vector_records lot="…"]

`lot` narrows the list to a lot you declared when ordering; it is sent to Vector as a filter and is never shown on the page. The list needs your site key from the Vector dashboard (Settings → Vector Analytical). The block "Vector Analytical certificates" does the same.

== Frequently Asked Questions ==

= Does the plugin need an API key or a Vector account? =

No. Verification is public by design. The tenant slug in Settings is optional and is only appended to the order link; Vector Analytical's order page does not read it yet.

= What does the plugin send to Vector Analytical? =

For a record-number check, the record number. For a PDF check, the file's SHA-256 digest and whatever the PDF itself declares — a Vector Analytical record number, or another laboratory's name — read from the file in the browser exactly as vectoranalytical.com/verify reads it. Never the file, and never the record number your page cites: that is used only to say whether the certificate Vector recognises is the one your page names. The visitor can open "What was sent, and how to check it yourself" under any answer to see the exact request and a command to reproduce the digest without trusting anyone.

= Can I change the wording, the colour or the issuer shown in the answer? =

No, and there is no setting for it. Your theme styles the form; Vector Analytical's answer renders in its own isolated style. The full-ink treatment in it means "this is a true record" — a withdrawn record that resolves correctly earns it, and a forged document never does.

= A visitor's check says "Not issued" for a record I know exists. =

The plugin reports what The Record reports. Check the number as printed on the certificate, then check it directly at vectoranalytical.com/verify. If they disagree with the certificate, contact Vector Analytical.

= What can a visitor order from my page? =

The full panel — Identity, Purity and the certificate — at the price on Vector Analytical's test menu for that material. Identity or Purity alone show "not sold alone yet": no standalone price is on file, and the plugin never invents one or divides the panel price. The certificate cannot be bought alone; it certifies the measurements on the order. Add-ons and extra vials are chosen on Vector's order page. Payment is to Vector Analytical, never through your site.

= What does "Connect Vector account" store? =

Your shop's account ID (tenant slug) and nothing else. Clicking it opens Vector Analytical's own sign-in; after you sign in, Vector shows you the account and asks before sending its ID back to your settings screen. The screen accepts the answer only if it matches a one-time token it created when you clicked. If your Vector sign-in is not yet linked to a shop, both sides say so and nothing is stored. Disconnect clears the ID.

= What does the certificate list show, and what does it cost? =

Every record Vector Analytical has issued to your shop, from the laboratory's registry: the record number, its position in the series, its standing (issued, superseded or withdrawn), the date it was issued, the number of any record that amended it, and the published reason if it was withdrawn. Nothing else — no measurements, no analyte, no lot, no file. Each number links to Vector's public check, so a shopper verifies with the laboratory, not with a PDF you host. It costs nothing: the plugin, Vector hosting your certificates, and listing them are all free, and no plan is required.

= What is the site key, and is it safe to publish? =

A read-only key you create in your Vector dashboard under Plugin & API, free, in one click. It identifies your shop to the list endpoint and lets it return only what /verify already tells anyone about any one record. It appears in your page source by design. It is not a password, cannot issue, amend or withdraw anything, and you can revoke it and create another at any time.

= Can I point the plugin at a staging copy of The Record? =

Only from code: define `VECTOR_RECORD_API_ORIGIN` in `wp-config.php`, or use the `vector_record_api_origin` filter. HTTPS origins and plain-HTTP loopback origins are accepted; anything else is ignored with a `_doing_it_wrong` notice and the real Record is used. This is deliberately not a setting a shop can change from the dashboard.

== Changelog ==

= 0.2.0 =
* Connect Vector account: fetch the shop's account ID through Vector's own sign-in, with consent and a one-time state token. Disconnect clears it.
* The three lines on a product page: `[vector_order]` and the "Order a Vector Analytical test" block, priced and refused by Vector's own rules in the browser.
* Order links carry tenant, material and lines; Vector's order page reads them.
* The certificate list: `[vector_records]` and the "Vector Analytical certificates" block list the shop's issued records from The Record, each linking to Vector's public check. Free; no plan.
* Settings gains the publishable site key the list uses.

= 0.1.0 =
* First release: shortcode, block, settings screen with the tenant slug, order link.
