=== AI 402 Monetization ===
Contributors: davidebordigoni
Tags: monetization, http-402, ai-protection, copyright-tdm, pay-as-you-go
Requires at least: 5.6
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Monetize AI agent scraping with HTTP 402 micro-settlements and enforce the EU Copyright Art. 4 TDM Opt-Out.

== Description ==

**AI 402 Monetization** is the EU-native HTTP 402 pay-as-you-go monetization plugin for digital publishers, news portals, and content creators facing unauthorized AI scraping from crawlers like GPTBot, PerplexityBot, ClaudeBot, and Bytespider.

= EU Compliance Engine (the core) =

* **EU Copyright Directive Art. 4(3) TDM Opt-Out:** Automatically injects the machine-readable `TDM-Reservation: 1` header on every response. Per the Hamburg OLG ruling (5 U 104/24, Dec 2025), natural-language ToS opt-outs are NOT sufficient — reservations must be machine-actionable. This plugin makes them so.
* **W3C TDMRep JSON-LD:** Auto-serves `/.well-known/tdmrep.json` (belt-and-suspenders alongside the HTTP header).
* **EU AI Act Art. 50/53 Transparency Manifest:** Auto-serves `/.well-known/ai-act-transparency.json` documenting data provenance and TDM reservation for AI model providers operating in the EU.
* **GDPR-first:** Zero PII stored for synthetic client requests. Payout data is only transmitted after explicit admin consent.

= Monetization Gateway =

* **HTTP 402 Pay-As-You-Go Challenges:** Intercepts AI crawler user-agents and issues standardized `402 Payment Required` challenges with `WWW-Authenticate: L402` and x402 Foundation payment metadata (default $0.005 USD per article).
* **Centralized Cryptographic Verification:** Payment proofs are HMAC-SHA256 tokens validated server-to-server against the ai402.eu gateway. No secrets are stored in the plugin (GPLv2-safe), verified tokens are transient-cached for 5 minutes to avoid redundant gateway round-trips.
* **0% Impact on Human Readers & Search Crawlers:** Real human visitors and Googlebot/Bingbot access your content normally with zero latency penalty.
* **Automated Monthly SEPA Payouts:** Enter your IBAN to receive direct bank transfer payouts (€10 minimum threshold for the Founding 100 program).
* **Founding 100 Publisher Program:** First 100 registered publishers lock in 95% lifetime net revenue share.

= Cache Compatibility Warning =

Full-page caches (WP Rocket, LiteSpeed, W3 Total Cache, Cloudflare, etc.) bypass `template_redirect` on cache HIT. Exclude AI bot user-agents from caching, otherwise the 402 challenge only fires on cache MISS. The plugin shows a warning in wp-admin when a known cache plugin is detected.

== Third-Party Services ==

This plugin connects to external web services operated by ai402.eu to process onboarding telemetry, verify publisher registration, and validate HTTP 402 / L402 / x402 payment proofs:

* **Service Name:** AI 402 Gateway Onboarding & Micro-Settlement Network
* **Service Domain:** https://ai402.eu
* **Purpose:** (a) Validate payment proof tokens on AI bot requests (server-to-server, no visitor data involved); (b) process publisher registration details (site URL, contact email, tax entity name, IBAN) for payout processing — only after explicit GDPR consent in the settings screen.
* **Terms of Service & Privacy Policy:** https://ai402.eu/privacy

== Installation ==

1. Upload the `ai-402-monetization` directory to the `/wp-content/plugins/` directory, or install the plugin directly through the WordPress plugins screen.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Navigate to **Settings -> AI 402 Monetization** in your WordPress admin dashboard.
4. Enter your contact email, company name/tax ID, and SEPA IBAN for direct monthly payouts.
5. Click **Save Settings**. Your site now serves TDM-Reservation headers, tdmrep.json, the AI Act transparency manifest, and issues HTTP 402 challenges to AI scrapers!

== Frequently Asked Questions ==

= Does this block human visitors or require them to pay? =
No! Human visitors browse your website 100% free with zero interruptions. The HTTP 402 challenge ONLY triggers for synthetic AI web scrapers.

= Will this hurt my Google SEO rankings? =
No. Googlebot and standard search engine crawlers are explicitly whitelisted and served normally.

= How do payouts work? =
Accumulated micro-settlements are aggregated and transferred directly to your bank account via automated SEPA wire transfer on the 1st of every month.

= Where are the compliance files served? =
`https://yourdomain.com/.well-known/tdmrep.json` and `https://yourdomain.com/.well-known/ai-act-transparency.json` — they are generated automatically on activation.

= Is my HMAC secret stored in the plugin? =
No. Since 1.1.0 payment proofs are verified centrally against the ai402.eu gateway. The plugin contains no secrets.

== Screenshots ==

1. Admin Settings Panel — Configure payout IBAN, pricing per article, and AI bot protection.
2. HTTP 402 Response Payload — Standardized JSON response returned to synthetic AI bots.

== Changelog ==

= 1.1.0 =
* Centralized payment-proof verification: HMAC tokens are validated server-to-server against the ai402.eu gateway — no secrets shipped in the plugin.
* Added 5-minute transient cache for verified tokens to reduce gateway round-trips.
* Added `/.well-known/tdmrep.json` (W3C TDMRep) auto-generation — belt-and-suspenders for the Hamburg OLG ruling.
* Added `/.well-known/ai-act-transparency.json` (EU AI Act Art. 50/53) auto-generation.
* Added x402 Foundation payment metadata (`X-PAYMENT` retry header, networks, settle endpoint) to the 402 challenge.
* Expanded AI bot user-agent list (OAI-SearchBot, Claude-Web, Applebot-Extended, AI2Bot, GoogleOther, LLM_Resolver and more).
* Single consent-gated onboarding dispatch (removed the duplicated JS telemetry ping from 1.0.0).
* Onboarding ping is now non-blocking (`blocking => false`).
* Added wp-admin warning when a full-page cache plugin is detected (402 challenges bypass on cache HIT).
* Price field now has a dedicated numeric sanitize callback with sane bounds (0 < price <= 1 USD).
* `Vary` headers added to 402 and verified responses for cache correctness.
* Fail-closed verification: if the gateway is unreachable, tokens are rejected.

= 1.0.0 =
* Initial official release on WordPress.org Directory.
* Added HTTP 402 Pay-As-You-Go challenge mechanism for AI scrapers.
* Integrated EU Copyright Directive Art. 4 TDM Opt-Out header injection.
* Added automated SEPA payout settings and onboarding telemetry.