diff --git a/.distignore b/.distignore
new file mode 100644
index 0000000..6d9d17a
--- /dev/null
+++ b/.distignore
@@ -0,0 +1,13 @@
+.git
+.github
+.gitignore
+.distignore
+.slimm
+.phpunit.cache
+tests
+bin
+phpunit.xml
+composer.lock
+build
+*.zip
+.DS_Store
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a749ee7..94d00ed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,9 +1,8 @@
 name: Release
 
 # Build a distributable plugin zip and attach it to the GitHub release whenever
-# a version tag is pushed. The Datalumo plugin checks for updates against these
-# release assets (see src/Support/UpdateChecker.php), so the zip must contain the
-# Composer-built vendor/ directory — GitHub's auto-generated source zip does not.
+# a version tag is pushed. The zip must contain the Composer-built vendor/
+# directory — GitHub's auto-generated source archive does not.
 on:
   push:
     tags:
@@ -52,12 +51,15 @@ jobs:
             --exclude '.git' \
             --exclude '.github' \
             --exclude '.gitignore' \
+            --exclude '.distignore' \
             --exclude '.slimm' \
             --exclude 'build' \
             --exclude '*.zip' \
             --exclude 'tests' \
+            --exclude 'bin' \
             --exclude 'phpunit.xml' \
-            --exclude '.phpunit.cache'
+            --exclude '.phpunit.cache' \
+            --exclude '.DS_Store'
           (cd build && zip -rq datalumo.zip datalumo)
 
       - name: Create release and upload asset
diff --git a/.gitignore b/.gitignore
index 567402e..ac84e6a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@ build/
 *.zip
 .slimm/
 .phpunit.cache/
+.DS_Store
diff --git a/bin/ensure-index-php b/bin/ensure-index-php
new file mode 100755
index 0000000..cfd748b
--- /dev/null
+++ b/bin/ensure-index-php
@@ -0,0 +1,49 @@
+#!/usr/bin/env php
+<?php
+
+/**
+ * Drop a Silence-is-golden index.php in every plugin directory so
+ * directory listing cannot expose files.
+ */
+
+$root = dirname(__DIR__);
+$skip = ['.git', '.github', '.slimm', '.phpunit.cache'];
+$contents = "<?php\n// Silence is golden.\n";
+
+$iterator = new RecursiveIteratorIterator(
+    new RecursiveCallbackFilterIterator(
+        new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
+        static function (SplFileInfo $current) use ($skip): bool {
+            if (! $current->isDir()) {
+                return true;
+            }
+
+            $name = $current->getFilename();
+
+            if (in_array($name, $skip, true)) {
+                return false;
+            }
+
+            return ! str_contains($current->getPathname(), DIRECTORY_SEPARATOR.'vendor'.DIRECTORY_SEPARATOR.'bin');
+        },
+    ),
+    RecursiveIteratorIterator::SELF_FIRST,
+);
+
+$dirs = [$root];
+
+foreach ($iterator as $file) {
+    if ($file->isDir()) {
+        $dirs[] = $file->getPathname();
+    }
+}
+
+foreach ($dirs as $dir) {
+    $index = $dir.DIRECTORY_SEPARATOR.'index.php';
+
+    if (is_file($index)) {
+        continue;
+    }
+
+    file_put_contents($index, $contents);
+}
diff --git a/bin/fresh-site b/bin/fresh-site
new file mode 100755
index 0000000..9d0dc1d
--- /dev/null
+++ b/bin/fresh-site
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# Spin up a clean WordPress + WooCommerce site on SQLite, with this plugin
+# linked in, dummy posts/products, and admin / password.
+#
+#   bin/fresh-site
+#   bin/fresh-site --force
+#   SITE_DIR=~/Sites/datalumo-fresh bin/fresh-site
+set -euo pipefail
+
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SITE_DIR="${SITE_DIR:-$HOME/Sites/datalumo-fresh}"
+SITE_SLUG="$(basename "$SITE_DIR")"
+SITE_URL="${SITE_URL:-http://${SITE_SLUG}.test}"
+FORCE=0
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --force) FORCE=1; shift ;;
+        --url) SITE_URL="$2"; shift 2 ;;
+        --dir) SITE_DIR="$2"; SITE_SLUG="$(basename "$SITE_DIR")"; shift 2 ;;
+        -h|--help)
+            echo "Usage: bin/fresh-site [--force] [--dir PATH] [--url URL]"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 1
+            ;;
+    esac
+done
+
+WP=(wp --path="$SITE_DIR" --allow-root)
+export WP_CLI_PHP_ARGS="${WP_CLI_PHP_ARGS:--d memory_limit=512M}"
+
+need() {
+    command -v "$1" >/dev/null 2>&1 || {
+        echo "Missing $1." >&2
+        exit 1
+    }
+}
+
+need wp
+need php
+need curl
+need unzip
+
+if ! php -r 'exit(extension_loaded("pdo_sqlite") ? 0 : 1);'; then
+    echo "PHP is missing pdo_sqlite." >&2
+    exit 1
+fi
+
+case "$SITE_DIR" in
+    /|"$HOME"|"$HOME/"|/)
+        echo "Refusing to use $SITE_DIR as the site path." >&2
+        exit 1
+        ;;
+esac
+
+if [[ -e "$SITE_DIR" ]]; then
+    if [[ "$FORCE" -ne 1 ]]; then
+        echo "$SITE_DIR already exists. Re-run with --force to wipe it." >&2
+        exit 1
+    fi
+    echo "Wiping $SITE_DIR"
+    rm -rf "$SITE_DIR"
+fi
+
+echo "Installing WordPress in $SITE_DIR"
+mkdir -p "$SITE_DIR"
+wp core download --path="$SITE_DIR"
+
+wp config create \
+    --path="$SITE_DIR" \
+    --dbname=wordpress \
+    --dbuser=wordpress \
+    --dbpass=wordpress \
+    --dbhost=127.0.0.1 \
+    --skip-check \
+    --extra-php <<'PHP'
+define( 'DB_ENGINE', 'sqlite' );
+define( 'WP_ENVIRONMENT_TYPE', 'local' );
+define( 'WP_DEBUG', true );
+define( 'WP_DEBUG_DISPLAY', false );
+define( 'WP_DEBUG_LOG', true );
+define( 'DATALUMO_SSL_VERIFY', false );
+define( 'DATALUMO_API_URL', 'https://dl.test' );
+PHP
+
+echo "Adding SQLite drop-in"
+SQLITE_ZIP="$(mktemp -t sqlite-wp).zip"
+curl -fsSL "https://downloads.wordpress.org/plugin/sqlite-database-integration.latest-stable.zip" -o "$SQLITE_ZIP"
+unzip -qo "$SQLITE_ZIP" -d "$SITE_DIR/wp-content/plugins"
+rm -f "$SQLITE_ZIP"
+cp "$SITE_DIR/wp-content/plugins/sqlite-database-integration/db.copy" "$SITE_DIR/wp-content/db.php"
+
+"${WP[@]}" core install \
+    --url="$SITE_URL" \
+    --title="Datalumo Fresh" \
+    --admin_user=admin \
+    --admin_password=password \
+    --admin_email=admin@example.com \
+    --skip-email
+
+"${WP[@]}" plugin activate sqlite-database-integration
+"${WP[@]}" theme install twentytwentyfive --activate
+
+echo "Linking Datalumo plugin"
+if [[ ! -d "$PLUGIN_DIR/vendor" ]]; then
+    composer install --working-dir="$PLUGIN_DIR" --no-interaction
+fi
+ln -sfn "$PLUGIN_DIR" "$SITE_DIR/wp-content/plugins/datalumo"
+"${WP[@]}" plugin activate datalumo
+
+echo "Installing WooCommerce"
+"${WP[@]}" plugin install woocommerce --activate
+"${WP[@]}" eval 'if (class_exists("WC_Install")) { WC_Install::create_pages(); }'
+"${WP[@]}" option update woocommerce_currency EUR
+"${WP[@]}" option update woocommerce_default_country NL
+"${WP[@]}" option update woocommerce_coming_soon no || true
+"${WP[@]}" option update woocommerce_store_pages_only no || true
+"${WP[@]}" option update woocommerce_onboarding_profile '{"skipped":true,"completed":true}' --format=json || true
+"${WP[@]}" option update woocommerce_task_list_hidden yes || true
+"${WP[@]}" option update woocommerce_task_list_complete yes || true
+
+"${WP[@]}" rewrite structure '/%postname%/' --hard
+"${WP[@]}" rewrite flush --hard
+
+echo "Seeding posts and products"
+"${WP[@]}" eval-file "$PLUGIN_DIR/bin/fresh-site-seed.php"
+
+echo
+echo "Ready."
+echo "  Site     $SITE_URL"
+echo "  Admin    $SITE_URL/wp-admin/"
+echo "  User     admin"
+echo "  Password password"
+echo "  Settings $SITE_URL/wp-admin/options-general.php?page=datalumo"
+echo "  Datalumo https://dl.test  (DATALUMO_API_URL)"
+echo "  Database $SITE_DIR/wp-content/database/.ht.sqlite"
diff --git a/bin/fresh-site-seed.php b/bin/fresh-site-seed.php
new file mode 100644
index 0000000..fab5f15
--- /dev/null
+++ b/bin/fresh-site-seed.php
@@ -0,0 +1,185 @@
+<?php
+
+/**
+ * Dummy content for bin/fresh-site. Run with: wp eval-file bin/fresh-site-seed.php
+ */
+
+if (! defined('ABSPATH')) {
+    fwrite(STDERR, "Run this with WP-CLI: wp eval-file bin/fresh-site-seed.php\n");
+    exit(1);
+}
+
+wp_delete_post(1, true);
+wp_delete_post((int) get_option('page_on_front'), true);
+
+$guide = wp_insert_post([
+    'post_title' => 'Visitor guide',
+    'post_name' => 'visitor-guide',
+    'post_status' => 'publish',
+    'post_type' => 'page',
+    'post_content' => <<<'HTML'
+<p>This is a clean demo shop for trying the Datalumo WordPress plugin.</p>
+<p>Sign in at <code>/wp-admin/</code> with <strong>admin</strong> / <strong>password</strong>, then open Settings → Datalumo and press Connect with Datalumo.</p>
+HTML,
+], true);
+
+wp_insert_post([
+    'post_title' => 'About',
+    'post_name' => 'about',
+    'post_status' => 'publish',
+    'post_type' => 'page',
+    'post_content' => '<p>Datalumo Fresh is a disposable WordPress site. Wipe it with <code>bin/fresh-site --force</code>.</p>',
+], true);
+
+$posts = [
+    [
+        'Opening hours and pickup',
+        'We are open Tuesday to Saturday, 10:00 to 18:00. Weekend pickup is at the side door on Kerkstraat. Closed on Mondays.',
+    ],
+    [
+        'Shipping and returns',
+        'Orders placed before 15:00 ship the same day inside the Netherlands. You have 30 days to return unused items. Start a return from your account or reply to the order email.',
+    ],
+    [
+        'Care for wool',
+        'Hand wash wool in cold water and lay it flat to dry. A wool beanie can go in a mesh bag on a gentle cycle if you skip the dryer.',
+    ],
+    [
+        'How we roast coffee',
+        'Beans are roasted in small batches every Thursday. Light roasts land on Friday. Dark roasts are bagged the same afternoon.',
+    ],
+    [
+        'Gift wrapping',
+        'Add a note at checkout and we wrap the order in recycled paper. Gift receipts hide prices. We do not print prices on the packing slip when you ask.',
+    ],
+];
+
+foreach ($posts as [$title, $content]) {
+    wp_insert_post([
+        'post_title' => $title,
+        'post_status' => 'publish',
+        'post_type' => 'post',
+        'post_content' => '<p>'.$content.'</p>',
+    ], true);
+}
+
+if ($guide && ! is_wp_error($guide)) {
+    update_option('show_on_front', 'page');
+    update_option('page_on_front', $guide);
+}
+
+if (! class_exists('WooCommerce')) {
+    WP_CLI::warning('WooCommerce is not active; skipped products.');
+
+    return;
+}
+
+$simple = [
+    ['Canvas Tote', '29.00', 'A heavy canvas tote that stands on its own. Natural colour, one size.', 'tote'],
+    ['Ceramic Mug', '14.00', 'A 300ml stoneware mug. Dishwasher safe. Speckled cream glaze.', 'mug'],
+    ['Wool Beanie', '22.00', 'Merino beanie, unisex. Hand wash or a gentle cycle in a mesh bag.', 'beanie'],
+    ['Drip Coffee 250g', '11.50', 'Thursday roast. Light and chocolatey. Ground for filter on request.', 'coffee'],
+];
+
+foreach ($simple as [$name, $price, $description, $sku]) {
+    $product = new WC_Product_Simple();
+    $product->set_name($name);
+    $product->set_regular_price($price);
+    $product->set_short_description($description);
+    $product->set_description($description);
+    $product->set_sku($sku);
+    $product->set_manage_stock(true);
+    $product->set_stock_quantity(25);
+    $product->set_catalog_visibility('visible');
+    $product->set_status('publish');
+    $product->save();
+}
+
+foreach (['color' => 'Color', 'size' => 'Size'] as $slug => $label) {
+    if (wc_attribute_taxonomy_id_by_name($slug)) {
+        continue;
+    }
+
+    wc_create_attribute([
+        'name' => $label,
+        'slug' => $slug,
+        'type' => 'select',
+        'order_by' => 'menu_order',
+        'has_archives' => false,
+    ]);
+}
+
+delete_transient('wc_attribute_taxonomies');
+WC_Cache_Helper::invalidate_cache_group('woocommerce-attributes');
+WC()->attributes = null;
+
+if (! taxonomy_exists('pa_color') || ! taxonomy_exists('pa_size')) {
+    foreach (wc_get_attribute_taxonomies() as $taxonomy) {
+        $name = wc_attribute_taxonomy_name($taxonomy->attribute_name);
+        register_taxonomy($name, ['product'], []);
+    }
+}
+
+foreach (['Blue', 'Red'] as $color) {
+    wp_insert_term($color, 'pa_color');
+}
+
+foreach (['Small', 'Large'] as $size) {
+    wp_insert_term($size, 'pa_size');
+}
+
+$colorAttribute = new WC_Product_Attribute();
+$colorAttribute->set_id(wc_attribute_taxonomy_id_by_name('color'));
+$colorAttribute->set_name('pa_color');
+$colorAttribute->set_options(array_values(array_filter([
+    get_term_by('name', 'Blue', 'pa_color')->term_id ?? null,
+    get_term_by('name', 'Red', 'pa_color')->term_id ?? null,
+])));
+$colorAttribute->set_visible(true);
+$colorAttribute->set_variation(true);
+
+$sizeAttribute = new WC_Product_Attribute();
+$sizeAttribute->set_id(wc_attribute_taxonomy_id_by_name('size'));
+$sizeAttribute->set_name('pa_size');
+$sizeAttribute->set_options(array_values(array_filter([
+    get_term_by('name', 'Small', 'pa_size')->term_id ?? null,
+    get_term_by('name', 'Large', 'pa_size')->term_id ?? null,
+])));
+$sizeAttribute->set_visible(true);
+$sizeAttribute->set_variation(true);
+
+$jacket = new WC_Product_Variable();
+$jacket->set_name('Trail Jacket');
+$jacket->set_sku('jacket');
+$jacket->set_short_description('A packable shell. Pick a colour, then a size.');
+$jacket->set_description('Two-way zip, stuffs into its own pocket. Colour and size are variations so chat add-to-cart can walk those steps.');
+$jacket->set_attributes([$colorAttribute, $sizeAttribute]);
+$jacket->set_catalog_visibility('visible');
+$jacket->set_status('publish');
+$jacketId = $jacket->save();
+
+$prices = [
+    'Blue' => ['Small' => '89.00', 'Large' => '89.00'],
+    'Red' => ['Small' => '92.00', 'Large' => '92.00'],
+];
+
+foreach ($prices as $color => $sizes) {
+    foreach ($sizes as $size => $price) {
+        $variation = new WC_Product_Variation();
+        $variation->set_parent_id($jacketId);
+        $variation->set_attributes([
+            'pa_color' => sanitize_title($color),
+            'pa_size' => sanitize_title($size),
+        ]);
+        $variation->set_regular_price($price);
+        $variation->set_sku('jacket-'.sanitize_title($color).'-'.sanitize_title($size));
+        $variation->set_manage_stock(true);
+        $variation->set_stock_quantity(8);
+        $variation->set_status('publish');
+        $variation->save();
+    }
+}
+
+WC_Product_Variable::sync($jacketId);
+
+WP_CLI::success('Seeded pages, posts, simple products, and a variable Trail Jacket.');
diff --git a/bin/index.php b/bin/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/bin/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/composer.json b/composer.json
index 74eb1b0..3e8ec65 100644
--- a/composer.json
+++ b/composer.json
@@ -12,8 +12,7 @@
     "require": {
         "php": ">=8.1",
         "automattic/jetpack-autoloader": "^3.0",
-        "woocommerce/action-scheduler": "^3.0",
-        "yahnis-elsts/plugin-update-checker": "^5.7"
+        "woocommerce/action-scheduler": "^3.0"
     },
     "autoload": {
         "psr-4": {
@@ -36,6 +35,8 @@
         "brain/monkey": "^2.7"
     },
     "scripts": {
-        "test": "pest"
+        "test": "pest",
+        "fresh-site": "bin/fresh-site",
+        "post-autoload-dump": "@php bin/ensure-index-php"
     }
 }
diff --git a/datalumo.php b/datalumo.php
index 1ac81ff..b1f5641 100644
--- a/datalumo.php
+++ b/datalumo.php
@@ -7,11 +7,11 @@
  * Plugin Name:       Datalumo
  * Plugin URI:        https://github.com/datalumo/wordpress
  * Description:       Sync your WordPress content to Datalumo and add AI-powered search and chat to your site.
- * Version:           0.0.7
+ * Version:           0.0.8
  * Requires at least: 6.0
  * Requires PHP:      8.1
- * Author:            Jeffrey van Rossum
- * Author URI:        https://vanrossum.dev
+ * Author:            Datalumo
+ * Author URI:        https://datalumo.app
  * Text Domain:       datalumo
  * Domain Path:       /languages
  * License:           GPL-2.0-or-later
@@ -25,7 +25,7 @@
 }
 
 if (! defined('DATALUMO_VERSION')) {
-    define('DATALUMO_VERSION', '0.0.7');
+    define('DATALUMO_VERSION', '0.0.8');
     define('DATALUMO_FILE', __FILE__);
     define('DATALUMO_DIR', __DIR__);
     define('DATALUMO_URL', plugin_dir_url(__FILE__));
diff --git a/index.php b/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/languages/index.php b/languages/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/languages/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/license.txt b/license.txt
new file mode 100644
index 0000000..5434d58
--- /dev/null
+++ b/license.txt
@@ -0,0 +1,18 @@
+Datalumo WordPress Plugin
+Copyright (C) 2026 Jeffrey van Rossum
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, see <https://www.gnu.org/licenses/>.
+
+License: GPL-2.0-or-later
+License URI: https://www.gnu.org/licenses/gpl-2.0.html
diff --git a/readme.txt b/readme.txt
index 5d80067..1b1b3e3 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,10 +1,10 @@
 === Datalumo ===
-Contributors: jeffreyvanrossum
+Contributors: datalumo, jeffreyvr
 Tags: search, ai, chatbot, rag
 Requires at least: 6.0
-Tested up to: 6.9
+Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 0.0.7
+Stable tag: 0.0.8
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -19,17 +19,72 @@ Datalumo keeps a searchable, AI-ready copy of your WordPress content and gives y
 * **Search box** — drop-in search via the `[datalumo_search]` shortcode.
 * **Enhanced search** — serve WordPress' native search results from Datalumo's ranking, with an optional streamed AI summary above the results. Falls back to native search automatically.
 * **Visitor identity** — logged-in users can continue their chat conversations across visits, verified with a server-side signature.
+* **Chat page actions**: the official plugin listens for confirmed chat events (`add_to_cart`, `view_cart`, `open_checkout`, `open_page`). Add those actions in Datalumo under Reply → What it can do.
+
+This plugin is an interface to a [Datalumo](https://datalumo.app) instance. You need a Datalumo account (or a self-hosted instance). Connect with Datalumo from Settings, or use Manual setup to paste an API token. Nothing is sent until an administrator connects the site and turns a feature on.
+
+= External services =
+
+The plugin talks to the Datalumo instance you configure. The default host is `https://datalumo.app`; you can point it at your own instance instead.
+
+* Service: [https://datalumo.app](https://datalumo.app)
+* Documentation: [https://datalumo.app/docs](https://datalumo.app/docs)
+* Terms of Service: [https://datalumo.app/terms](https://datalumo.app/terms)
+* Privacy Policy: [https://datalumo.app/privacy](https://datalumo.app/privacy)
+
+When a feature is enabled, the plugin may:
+
+* Load the widget script from `{your Datalumo URL}/widget/v1/datalumo.js` (chat, search box, AI summary, and click tracking).
+* Send published post content to the Datalumo API so it can be indexed (title, HTML, permalink, author display name, categories, tags, dates, and any custom field mappings you add). WooCommerce products also send short description, product categories and tags, visible attributes, and SKU.
+* Send visitor search queries to Datalumo when enhanced search is on.
+* Send result-click events (URL, rank, search session) when enhanced search is on.
+* Send a signed visitor id (`wp-user-{id}` HMAC) when visitor identity is enabled on the Chatbot tab.
+
+= Development =
+
+Source code: [https://github.com/datalumo/wordpress](https://github.com/datalumo/wordpress)
+
+Production dependencies are installed with `composer install --no-dev`.
 
 == Installation ==
 
 1. Install and activate the plugin.
-2. In your Datalumo dashboard, create an API token (pages abilities) and a source of type API.
-3. Go to Settings → Datalumo, paste your organisation ID and token, and connect.
-4. Pick which post types sync to which source, and run the first full sync.
-5. Add a widget key to enable the chat, search box, or enhanced search.
+2. Go to Settings → Datalumo and press Connect with Datalumo.
+3. Pick or create widgets, then finish the checklist (what to sync, chat, search).
+4. Or choose Manual setup, paste an API token, and press Connect & test.
+
+== Frequently Asked Questions ==
+
+= Do I need a Datalumo account? =
+
+Yes. The plugin does not search or chat on its own. It connects WordPress to a Datalumo instance — the hosted service at datalumo.app or one you run yourself.
+
+= What data is sent to Datalumo? =
+
+Only after you connect and enable a feature. Content sync sends the published posts you choose. Enhanced search sends visitor queries and optional result-click analytics. The chat and search widgets load Datalumo's script and talk to that instance. Visitor identity is off unless you turn it on.
+
+= Can I use a self-hosted Datalumo instance? =
+
+Yes. On the Connection tab, open Using a self-hosted Datalumo? and set the URL before you connect. Manual setup has the same field.
+
+= Can the chatbot add products to a WooCommerce cart? =
+
+Yes, if WooCommerce is active. In Datalumo, add the WordPress Add to cart action (event add_to_cart, field product_id). The visitor confirms in chat. Variable products send colour, then that colour's sizes, as nested choice steps (up to 8 options per step); more than that opens the product page.
+
+= What other chat actions does the plugin handle? =
+
+View cart and Open checkout (WooCommerce), and Open this page (a post or page by id, slug, or same-site URL). Add them from Reply → Plugin actions → WordPress.
+
 
 == Changelog ==
 
+= 0.0.8 =
+* Connect with Datalumo: grant access from your Datalumo account. The plugin stores the source, token, and widget keys, then offers a short checklist for sync, chat, and search.
+* Manual setup is token-only. The organisation is inferred from the token. Widget keys and secrets are rejected in the wrong field.
+* Chat page actions: add_to_cart (WooCommerce, including variable products with nested colour/size choices), view_cart, open_checkout, and open_page.
+* Product and other singular pages send page_id (and product_id on products) as chat context.
+* WooCommerce products sync short description, product categories and tags, visible attributes, and SKU (including variation SKUs) as searchable fields.
+
 = 0.0.7 =
 * Full sync: when the push completes, the plugin now tells Datalumo to start indexing right away instead of waiting for its next background sweep. Best-effort — older Datalumo versions without the endpoint are unaffected.
 
@@ -57,5 +112,5 @@ Datalumo keeps a searchable, AI-ready copy of your WordPress content and gives y
 = 0.0.1 =
 * Initial public release.
 * Content sync, chat/search widgets, enhanced search, and visitor identity.
-* GitHub auto-updates via Plugin Update Checker.
+* GitHub auto-updates via Plugin Update Checker (removed ahead of the WordPress.org release).
 * Dutch and Chinese translations.
diff --git a/resources/css/admin.css b/resources/css/admin.css
index 47d5a4c..74885da 100644
--- a/resources/css/admin.css
+++ b/resources/css/admin.css
@@ -4,11 +4,16 @@
 }
 
 .datalumo-settings .datalumo-sync-row {
-    border: 1px solid #dcdcde;
-    border-radius: 8px;
-    padding: 0 1rem;
-    margin: 1rem 0;
-    background: #fff;
+    margin: 0;
+    padding: 0;
+    border: 0;
+    min-inline-size: 0;
+}
+
+.datalumo-settings .datalumo-sync-row.is-multiple + .datalumo-sync-row {
+    margin-top: 1.25rem;
+    padding-top: 1.25rem;
+    border-top: 1px solid #dcdcde;
 }
 
 .datalumo-inline-result {
@@ -48,3 +53,248 @@
         transform: rotate(360deg);
     }
 }
+
+.datalumo-connect-hero,
+.datalumo-checklist {
+    margin: 0;
+}
+
+.datalumo-connect-hero form {
+    margin-top: 0.75rem;
+}
+
+.datalumo-org-status {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 0.75rem;
+}
+
+.datalumo-setup-header h2 {
+    margin: 0 0 0.25rem;
+}
+
+.datalumo-setup-header p {
+    margin: 0 0 1.25rem;
+    color: #646970;
+}
+
+.datalumo-setup-card {
+    min-inline-size: 0;
+    border: 1px solid #dcdcde;
+    border-radius: 8px;
+    padding: 1rem 1.15rem 1.1rem;
+    margin: 0 0 0.75rem;
+    background: #fff;
+}
+
+.datalumo-setup-card legend {
+    float: left;
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    width: 100%;
+    padding: 0;
+    margin: 0 0 0.75rem;
+    font-weight: 600;
+}
+
+.datalumo-setup-card::after {
+    content: "";
+    display: block;
+    clear: both;
+}
+
+.datalumo-setup-step {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    box-sizing: border-box;
+    width: 22px;
+    height: 22px;
+    padding: 0 0 1px 1px;
+    border-radius: 50%;
+    background: #1d2327;
+    color: #fff;
+    font-size: 11px;
+    font-weight: 600;
+    line-height: 1;
+}
+
+.datalumo-setup-types {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.5rem;
+    clear: both;
+}
+
+.datalumo-setup-types .datalumo-checkbox,
+.datalumo-setup-options .datalumo-checkbox {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    margin: 0;
+    line-height: 1.3;
+}
+
+.datalumo-setup-types .datalumo-checkbox {
+    padding: 0.4rem 0.7rem;
+    border: 1px solid #dcdcde;
+    border-radius: 6px;
+    background: #f6f7f7;
+}
+
+.datalumo-setup-types .datalumo-checkbox:has(input:checked) {
+    border-color: #2271b1;
+    background: #f0f6fc;
+}
+
+.datalumo-setup-types .datalumo-checkbox input,
+.datalumo-setup-options .datalumo-checkbox input {
+    margin: 0;
+}
+
+.datalumo-setup-options {
+    display: flex;
+    flex-direction: column;
+    gap: 0.65rem;
+    clear: both;
+}
+
+.datalumo-setup-actions {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 0.5rem;
+    margin: 1.15rem 0 0;
+}
+
+.datalumo-setup-disconnect {
+    margin-top: 1.25rem;
+}
+
+.datalumo-setup-disconnect .button-link {
+    padding: 0;
+    color: #646970;
+}
+
+.datalumo-connect-hero .button-link,
+.datalumo-manual .button-link {
+    margin-top: 0.5rem;
+    padding: 0;
+}
+
+.datalumo-self-host {
+    margin-top: 1rem;
+    color: #646970;
+}
+
+.datalumo-self-host summary {
+    cursor: pointer;
+    font-size: 13px;
+}
+
+.datalumo-self-host[open] summary {
+    margin-bottom: 0.5rem;
+}
+
+.datalumo-self-host label {
+    display: block;
+    margin-bottom: 0.25rem;
+}
+
+.datalumo-self-host p {
+    margin: 0;
+}
+
+.datalumo-settings-layout {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: flex-start;
+    gap: 1.5rem 2.5rem;
+    margin-top: 1.25rem;
+}
+
+.datalumo-settings-main {
+    flex: 1 1 44rem;
+    min-width: 0;
+    max-width: 50rem;
+}
+
+.datalumo-settings-main > form,
+.datalumo-settings-main .form-table {
+    margin-top: 0;
+}
+
+.datalumo-settings-main .form-table tr:first-child th,
+.datalumo-settings-main .form-table tr:first-child td {
+    padding-top: 0;
+}
+
+.datalumo-settings-aside {
+    display: flex;
+    flex: 0 1 18rem;
+    flex-direction: column;
+    gap: 0.75rem;
+    width: 18rem;
+    position: sticky;
+    top: 2.75rem;
+}
+
+.datalumo-help-card,
+.datalumo-docs-card {
+    margin: 0;
+    padding: 1rem 1.1rem;
+    border: 1px solid #dcdcde;
+    border-radius: 8px;
+    background: #fff;
+}
+
+.datalumo-help-card h2 {
+    margin: 0 0 0.65rem;
+    font-size: 13px;
+    font-weight: 600;
+}
+
+.datalumo-help-fields {
+    display: flex;
+    flex-direction: column;
+    gap: 0.55rem;
+}
+
+.datalumo-help-fields textarea {
+    display: block;
+    box-sizing: border-box;
+    width: 100%;
+    max-width: 100%;
+    min-height: 5.5rem;
+    margin: 0;
+    resize: vertical;
+}
+
+.datalumo-settings-aside .datalumo-help-submit.button {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.4rem;
+    width: 100%;
+    margin: 0;
+    padding: 0 12px;
+    line-height: 1;
+}
+
+.datalumo-help-icon {
+    display: block;
+    width: 16px;
+    height: 16px;
+    flex-shrink: 0;
+}
+
+.datalumo-docs-card p {
+    margin: 0;
+}
+
+.datalumo-docs-card p + p {
+    margin-top: 0.25rem;
+    color: #646970;
+}
diff --git a/resources/css/index.php b/resources/css/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/resources/css/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/resources/index.php b/resources/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/resources/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/resources/js/add-to-cart.js b/resources/js/add-to-cart.js
new file mode 100644
index 0000000..51730fb
--- /dev/null
+++ b/resources/js/add-to-cart.js
@@ -0,0 +1,141 @@
+/**
+ * Handles Datalumo host actions named add_to_cart: POST to WordPress so
+ * WooCommerce can add the item to this visitor's cart, then settle the chip.
+ */
+(function () {
+    'use strict';
+
+    var config = window.datalumoAddToCart;
+
+    if (! config) {
+        return;
+    }
+
+    var eventName = config.event || 'add_to_cart';
+
+    window.addEventListener('datalumo:action', function (event) {
+        var detail = event.detail || {};
+
+        if (detail.name !== eventName) {
+            return;
+        }
+
+        event.preventDefault();
+
+        var payload = withPageProduct(
+            detail.payload && typeof detail.payload === 'object' && ! Array.isArray(detail.payload)
+                ? detail.payload
+                : {},
+        );
+
+        var body = new FormData();
+        body.append('action', 'datalumo_add_to_cart');
+        body.append('_ajax_nonce', config.nonce);
+        body.append('payload', JSON.stringify(payload));
+
+        fetch(config.ajaxUrl, {
+            method: 'POST',
+            credentials: 'same-origin',
+            body: body,
+        })
+            .then(function (response) {
+                return response.json();
+            })
+            .then(function (json) {
+                var ok = Boolean(json && json.success);
+                var data = (json && json.data) || {};
+                var message = typeof data.message === 'string' && data.message
+                    ? data.message
+                    : ((config.i18n && (ok ? '' : config.i18n.failed)) || '');
+
+                finish(detail, {
+                    ok: ok,
+                    message: message,
+                    status: data.status,
+                    layout: data.layout,
+                    choices: data.choices,
+                    url: data.url,
+                });
+
+                if (ok) {
+                    refreshCart(data.fragments || {}, data.cart_hash || '');
+                }
+            })
+            .catch(function () {
+                finish(detail, {
+                    ok: false,
+                    message: (config.i18n && config.i18n.failed) || '',
+                });
+            });
+    });
+
+    function withPageProduct(payload) {
+        var next = {};
+        var key;
+
+        for (key in payload) {
+            if (Object.prototype.hasOwnProperty.call(payload, key)) {
+                next[key] = payload[key];
+            }
+        }
+
+        if (! hasProductId(next) && config.productId) {
+            next.product_id = String(config.productId);
+        }
+
+        if (! next.page_url && typeof window.location === 'object' && window.location.href) {
+            next.page_url = window.location.href;
+        }
+
+        return next;
+    }
+
+    function hasProductId(payload) {
+        var keys = ['product_id', 'product', 'id', 'external_id'];
+        var i;
+        var value;
+
+        for (i = 0; i < keys.length; i++) {
+            value = parseInt(payload[keys[i]], 10);
+
+            if (value > 0) {
+                return true;
+            }
+        }
+
+        return Boolean(payload.sku && String(payload.sku).trim());
+    }
+
+    function finish(detail, result) {
+        if (typeof detail.respond === 'function') {
+            detail.respond(result);
+
+            return;
+        }
+
+        window.dispatchEvent(new CustomEvent('datalumo:action-result', {
+            detail: {
+                answer_id: detail.answer_id,
+                tool_id: detail.tool_id,
+                run: detail.run,
+                ok: result.ok !== false,
+                message: result.message || '',
+            },
+        }));
+    }
+
+    function refreshCart(fragments, cartHash) {
+        if (typeof window.jQuery === 'undefined') {
+            return;
+        }
+
+        var $ = window.jQuery;
+
+        $.each(fragments, function (selector, html) {
+            $(selector).replaceWith(html);
+        });
+
+        $(document.body).trigger('added_to_cart', [fragments, cartHash, null]);
+        $(document.body).trigger('wc_fragment_refresh');
+    }
+})();
diff --git a/resources/js/admin.js b/resources/js/admin.js
index 98b6191..15b12dc 100644
--- a/resources/js/admin.js
+++ b/resources/js/admin.js
@@ -36,6 +36,24 @@
 
     // --- Connection tab ---------------------------------------------------
 
+    var modeButtons = document.querySelectorAll('[data-datalumo-mode]');
+    var grantPanel = document.getElementById('datalumo-mode-grant');
+    var manualPanel = document.getElementById('datalumo-mode-manual');
+
+    modeButtons.forEach(function (button) {
+        button.addEventListener('click', function () {
+            var mode = button.getAttribute('data-datalumo-mode');
+
+            if (grantPanel) {
+                grantPanel.hidden = mode !== 'grant';
+            }
+
+            if (manualPanel) {
+                manualPanel.hidden = mode !== 'manual';
+            }
+        });
+    });
+
     var connectButton = document.getElementById('datalumo-connect');
 
     if (connectButton) {
@@ -46,7 +64,6 @@
             result.textContent = '…';
 
             var payload = {
-                organisation_id: document.getElementById('datalumo-organisation-id').value.trim(),
                 token: document.getElementById('datalumo-token').value.trim(),
             };
 
@@ -59,20 +76,14 @@
             }
 
             post('datalumo_connect', payload).then(function (response) {
-                connectButton.disabled = false;
-
                 if (response.success) {
-                    var organisation = response.data.organisation || {};
-                    result.textContent = sprintf(
-                        config.i18n.connected,
-                        organisation.name || organisation.id || '',
-                        (response.data.sources || []).length
-                    );
-                    result.classList.add('is-success');
-                } else {
-                    result.textContent = config.i18n.connectionFailed + ' ' + ((response.data || {}).message || '');
-                    result.classList.add('is-error');
+                    window.location.reload();
+                    return;
                 }
+
+                connectButton.disabled = false;
+                result.textContent = config.i18n.connectionFailed + ' ' + ((response.data || {}).message || '');
+                result.classList.add('is-error');
             });
         });
     }
@@ -183,4 +194,14 @@
     document.querySelectorAll('.datalumo-sync-status[data-sync]').forEach(function (status) {
         pollStatus(status.getAttribute('data-sync'));
     });
+
+    var autoSync = new URLSearchParams(window.location.search).get('datalumo_sync');
+
+    if (autoSync) {
+        var autoStart = document.querySelector('.datalumo-sync-start[data-sync="' + autoSync + '"]');
+
+        if (autoStart && ! autoStart.disabled) {
+            autoStart.click();
+        }
+    }
 })();
diff --git a/resources/js/host-navigation.js b/resources/js/host-navigation.js
new file mode 100644
index 0000000..5fac3ec
--- /dev/null
+++ b/resources/js/host-navigation.js
@@ -0,0 +1,144 @@
+/**
+ * Handles Datalumo host actions that open a page: cart, checkout, or a
+ * WordPress post.
+ */
+(function () {
+    'use strict';
+
+    var config = window.datalumoHostNavigation;
+
+    if (! config) {
+        return;
+    }
+
+    var events = config.events || ['view_cart', 'open_checkout', 'open_page'];
+
+    window.addEventListener('datalumo:action', function (event) {
+        var detail = event.detail || {};
+
+        if (events.indexOf(detail.name) === -1) {
+            return;
+        }
+
+        event.preventDefault();
+
+        var payload = isPlainObject(detail.payload) ? detail.payload : {};
+
+        if (detail.name === 'view_cart') {
+            go(detail, config.cartUrl, (config.i18n && config.i18n.no_cart) || '');
+
+            return;
+        }
+
+        if (detail.name === 'open_checkout') {
+            go(detail, config.checkoutUrl, (config.i18n && config.i18n.no_checkout) || '');
+
+            return;
+        }
+
+        resolveThenGo(detail, payload);
+    });
+
+    function resolveThenGo(detail, payload) {
+        var body = new FormData();
+        var request = {};
+        var key;
+
+        for (key in payload) {
+            if (Object.prototype.hasOwnProperty.call(payload, key)) {
+                request[key] = payload[key];
+            }
+        }
+
+        request.event = detail.name;
+        body.append('action', 'datalumo_host_navigation');
+        body.append('_ajax_nonce', config.nonce);
+        body.append('payload', JSON.stringify(request));
+
+        fetch(config.ajaxUrl, {
+            method: 'POST',
+            credentials: 'same-origin',
+            body: body,
+        })
+            .then(function (response) {
+                return response.json();
+            })
+            .then(function (json) {
+                var data = (json && json.data) || {};
+                var url = typeof data.url === 'string' ? data.url : '';
+
+                if (json && json.success && isSameSite(url)) {
+                    finish(detail, { ok: true, message: '' });
+                    window.location.assign(url);
+
+                    return;
+                }
+
+                finish(detail, {
+                    ok: false,
+                    message: (typeof data.message === 'string' && data.message)
+                        || (config.i18n && config.i18n.failed)
+                        || '',
+                });
+            })
+            .catch(function () {
+                finish(detail, {
+                    ok: false,
+                    message: (config.i18n && config.i18n.failed) || '',
+                });
+            });
+    }
+
+    function go(detail, url, missingMessage) {
+        if (! isSameSite(url)) {
+            finish(detail, { ok: false, message: missingMessage || (config.i18n && config.i18n.failed) || '' });
+
+            return;
+        }
+
+        finish(detail, { ok: true, message: '' });
+        window.location.assign(url);
+    }
+
+    function isSameSite(url) {
+        if (! url || typeof url !== 'string') {
+            return false;
+        }
+
+        try {
+            var parsed = new URL(url, window.location.href);
+            var home = String(config.homeHost || window.location.hostname).toLowerCase();
+            var host = parsed.hostname.toLowerCase();
+
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                return false;
+            }
+
+            return host === home || host === 'www.' + home || 'www.' + host === home;
+        } catch (error) {
+            return false;
+        }
+    }
+
+    function isPlainObject(value) {
+        return Boolean(value) && typeof value === 'object' && ! Array.isArray(value);
+    }
+
+    function finish(detail, result) {
+        if (typeof detail.respond === 'function') {
+            detail.respond(result);
+
+            return;
+        }
+
+        window.dispatchEvent(new CustomEvent('datalumo:action-result', {
+            detail: {
+                answer_id: detail.answer_id,
+                tool_id: detail.tool_id,
+                run: detail.run,
+                ok: result.ok !== false,
+                message: result.message || '',
+            },
+        }));
+    }
+})();
diff --git a/resources/js/index.php b/resources/js/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/resources/js/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/resources/js/setup-notice.js b/resources/js/setup-notice.js
new file mode 100644
index 0000000..48434b6
--- /dev/null
+++ b/resources/js/setup-notice.js
@@ -0,0 +1,28 @@
+/**
+ * Persist dismissal of the dashboard setup notice.
+ */
+(function () {
+    'use strict';
+
+    var config = window.datalumoSetupNotice;
+
+    if (! config) {
+        return;
+    }
+
+    document.addEventListener('click', function (event) {
+        var dismiss = event.target && event.target.closest
+            ? event.target.closest('.datalumo-setup-notice .notice-dismiss')
+            : null;
+
+        if (! dismiss) {
+            return;
+        }
+
+        var body = new FormData();
+        body.append('action', 'datalumo_dismiss_setup_notice');
+        body.append('_ajax_nonce', config.nonce);
+
+        fetch(config.ajaxUrl, { method: 'POST', body: body, credentials: 'same-origin' });
+    });
+})();
diff --git a/resources/views/index.php b/resources/views/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/resources/views/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/resources/views/settings.php b/resources/views/settings.php
index 8cc98c1..a0047d5 100644
--- a/resources/views/settings.php
+++ b/resources/views/settings.php
@@ -1,143 +1,325 @@
 <?php
 
 use Datalumo\Wp\Admin\SettingsPage;
+use Datalumo\Wp\Connect\Grant;
 use Datalumo\Wp\Support\Options;
 
 if (! defined('ABSPATH')) {
     exit;
 }
 
-/** @var string $tab (set by SettingsPage::render) */
-$organisation = Options::get('organisation', []);
-$sources = (array) Options::get('sources', []);
-$syncs = (array) Options::get('syncs', []);
-$postTypes = get_post_types(['public' => true], 'objects');
-unset($postTypes['attachment']);
+/** @var string $datalumo_tab (set by SettingsPage::render) */
+$datalumo_organisation = Options::get('organisation', []);
+$datalumo_sources = (array) Options::get('sources', []);
+$datalumo_syncs = (array) Options::get('syncs', []);
+$datalumo_post_types = get_post_types(['public' => true], 'objects');
+unset($datalumo_post_types['attachment']);
 
-$tabs = [
+$datalumo_tabs = [
     'connection' => __('Connection', 'datalumo'),
     'content-sync' => __('Content sync', 'datalumo'),
     'chatbot' => __('Chatbot', 'datalumo'),
     'search-box' => __('Search box', 'datalumo'),
     'enhanced-search' => __('Enhanced search', 'datalumo'),
 ];
+
+$datalumo_nonce_ok = isset($_GET['_wpnonce'])
+    && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'datalumo_settings_updated');
+$datalumo_notice = $datalumo_nonce_ok && isset($_GET['datalumo_notice'])
+    ? sanitize_key(wp_unslash($_GET['datalumo_notice']))
+    : '';
+$datalumo_notices = [
+    'connected' => [__('Connected to Datalumo.', 'datalumo'), 'success'],
+    'grant_failed' => [__('Connect did not finish. Start again from this page.', 'datalumo'), 'error'],
+    'disconnected' => [__('Disconnected. The API key remains in Datalumo under API keys until you revoke it there.', 'datalumo'), 'success'],
+    'setup_saved' => [__('Setup saved.', 'datalumo'), 'success'],
+    'invalid_widget_key' => [__('Widget keys look like org-id/widget-id. An API token or secret will not work there.', 'datalumo'), 'error'],
+];
+$datalumo_connected = Options::isConnected();
+$datalumo_setup_pending = $datalumo_connected && (bool) Options::get('setup_pending');
+$datalumo_chat_key = (string) Options::get('chatbot.widget_key', '');
+$datalumo_search_key = (string) Options::get('search_box.widget_key', '') ?: (string) Options::get('enhanced.widget_key', '');
+$datalumo_setup_source_id = (string) Options::get('setup_source_id', '');
+$datalumo_setup_types = ['post', 'page'];
+
+foreach ($datalumo_syncs as $datalumo_sync_row) {
+    if (($datalumo_sync_row['source_id'] ?? '') === $datalumo_setup_source_id) {
+        $datalumo_setup_types = $datalumo_sync_row['post_types'] ?? $datalumo_setup_types;
+        break;
+    }
+}
 ?>
 <div class="wrap datalumo-settings">
     <h1>Datalumo</h1>
 
-    <?php if (! empty($_GET['updated'])) : ?>
-        <div class="notice notice-success is-dismissible"><p><?php esc_html_e('Settings saved.', 'datalumo'); ?></p></div>
+    <?php if (isset($datalumo_notices[$datalumo_notice])) : ?>
+        <div class="notice notice-<?php echo esc_attr($datalumo_notices[$datalumo_notice][1]); ?> is-dismissible">
+            <p><?php echo esc_html($datalumo_notices[$datalumo_notice][0]); ?></p>
+        </div>
     <?php endif; ?>
 
-    <nav class="nav-tab-wrapper">
-        <?php foreach ($tabs as $key => $label) : ?>
-            <a href="<?php echo esc_url(admin_url('options-general.php?page=datalumo&tab=' . $key)); ?>"
-               class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo esc_html($label); ?></a>
-        <?php endforeach; ?>
-    </nav>
+    <?php if (SettingsPage::setupIsReady()) : ?>
+        <nav class="nav-tab-wrapper">
+            <?php foreach ($datalumo_tabs as $datalumo_tab_key => $datalumo_tab_label) : ?>
+                <a href="<?php echo esc_url(admin_url('options-general.php?page=datalumo&tab=' . $datalumo_tab_key)); ?>"
+                   class="nav-tab <?php echo $datalumo_tab === $datalumo_tab_key ? 'nav-tab-active' : ''; ?>"><?php echo esc_html($datalumo_tab_label); ?></a>
+            <?php endforeach; ?>
+        </nav>
+    <?php endif; ?>
 
-    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
-        <input type="hidden" name="action" value="datalumo_save" />
-        <input type="hidden" name="datalumo_tab" value="<?php echo esc_attr($tab); ?>" />
-        <?php wp_nonce_field(SettingsPage::NONCE); ?>
+    <?php
+    $datalumo_docs_hash = match ($datalumo_tab) {
+        'content-sync' => 'for-developers',
+        'chatbot' => 'chat-page-actions',
+        'search-box' => 'add-a-search-box',
+        'enhanced-search' => 'enhanced-search',
+        default => '',
+    };
+    $datalumo_docs_hint = match ($datalumo_tab) {
+        'content-sync' => __('Custom fields, filters, and sync details.', 'datalumo'),
+        'chatbot' => __('Shortcodes, visitor identity, and chat page actions.', 'datalumo'),
+        'search-box', 'enhanced-search' => __('Search box shortcode and enhanced search.', 'datalumo'),
+        default => __('Connect, sync, and widgets.', 'datalumo'),
+    };
+    ?>
 
-        <?php if ($tab === 'connection') : ?>
-            <table class="form-table" role="presentation">
-                <?php if (! defined('DATALUMO_API_URL')) : ?>
+    <div class="datalumo-settings-layout">
+    <div class="datalumo-settings-main">
+
+    <?php if ($datalumo_tab === 'connection') : ?>
+        <?php if ($datalumo_connected) : ?>
+            <?php if (! $datalumo_setup_pending) : ?>
+                <form id="datalumo-disconnect" method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
+                    <input type="hidden" name="action" value="<?php echo esc_attr(Grant::ACTION_DISCONNECT); ?>" />
+                    <?php wp_nonce_field(Grant::ACTION_DISCONNECT); ?>
+                </form>
+            <?php endif; ?>
+
+            <?php if ($datalumo_setup_pending) : ?>
+                <?php $datalumo_setup_step = 1; ?>
+                <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="datalumo-checklist">
+                    <input type="hidden" name="action" value="<?php echo esc_attr(Grant::ACTION_SETUP); ?>" />
+                    <?php wp_nonce_field(Grant::ACTION_SETUP); ?>
+                    <header class="datalumo-setup-header">
+                        <h2><?php esc_html_e('Finish setup', 'datalumo'); ?></h2>
+                        <p><?php esc_html_e('Pick a starting setup. You can change these later.', 'datalumo'); ?></p>
+                    </header>
+
+                    <fieldset class="datalumo-setup-card">
+                        <legend>
+                            <span class="datalumo-setup-step"><?php echo esc_html((string) $datalumo_setup_step++); ?></span>
+                            <?php esc_html_e('What to sync', 'datalumo'); ?>
+                        </legend>
+                        <div class="datalumo-setup-types">
+                            <?php foreach ($datalumo_post_types as $datalumo_post_type) : ?>
+                                <label class="datalumo-checkbox">
+                                    <input type="checkbox" name="setup_post_types[]"
+                                           value="<?php echo esc_attr($datalumo_post_type->name); ?>"
+                                           <?php checked(in_array($datalumo_post_type->name, $datalumo_setup_types, true)); ?> />
+                                    <?php echo esc_html($datalumo_post_type->labels->name); ?>
+                                </label>
+                            <?php endforeach; ?>
+                        </div>
+                    </fieldset>
+
+                    <?php if ($datalumo_chat_key !== '') : ?>
+                        <fieldset class="datalumo-setup-card">
+                            <legend>
+                                <span class="datalumo-setup-step"><?php echo esc_html((string) $datalumo_setup_step++); ?></span>
+                                <?php esc_html_e('Chat', 'datalumo'); ?>
+                            </legend>
+                            <div class="datalumo-setup-options">
+                                <label class="datalumo-checkbox">
+                                    <input type="checkbox" name="setup_chat_enabled" value="1" <?php checked((bool) Options::get('chatbot.enabled')); ?> />
+                                    <?php esc_html_e('Show the floating chat on every page', 'datalumo'); ?>
+                                </label>
+                            </div>
+                        </fieldset>
+                    <?php endif; ?>
+
+                    <?php if ($datalumo_search_key !== '') : ?>
+                        <fieldset class="datalumo-setup-card">
+                            <legend>
+                                <span class="datalumo-setup-step"><?php echo esc_html((string) $datalumo_setup_step++); ?></span>
+                                <?php esc_html_e('Search', 'datalumo'); ?>
+                            </legend>
+                            <div class="datalumo-setup-options">
+                                <label class="datalumo-checkbox">
+                                    <input type="checkbox" name="setup_enhanced_enabled" value="1" <?php checked((bool) Options::get('enhanced.enabled')); ?> />
+                                    <?php esc_html_e('Use Datalumo for WordPress search results', 'datalumo'); ?>
+                                </label>
+                            </div>
+                        </fieldset>
+                    <?php endif; ?>
+
+                    <p class="datalumo-setup-actions">
+                        <?php submit_button(__('Save and sync now', 'datalumo'), 'primary', 'setup_sync_now', false); ?>
+                        <?php submit_button(__('Save setup', 'datalumo'), 'secondary', 'submit', false); ?>
+                    </p>
+                </form>
+                <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="datalumo-setup-disconnect">
+                    <input type="hidden" name="action" value="<?php echo esc_attr(Grant::ACTION_DISCONNECT); ?>" />
+                    <?php wp_nonce_field(Grant::ACTION_DISCONNECT); ?>
+                    <button type="submit" class="button-link"><?php esc_html_e('Disconnect', 'datalumo'); ?></button>
+                </form>
+            <?php endif; ?>
+        <?php else : ?>
+            <div id="datalumo-mode-grant" class="datalumo-connect-hero">
+                <p><?php esc_html_e('Connect this site to Datalumo. You will pick or create a knowledge base and widgets, then we create a source and API key for you.', 'datalumo'); ?></p>
+                <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
+                    <input type="hidden" name="action" value="<?php echo esc_attr(Grant::ACTION_START); ?>" />
+                    <?php wp_nonce_field(Grant::ACTION_START); ?>
+                    <?php submit_button(__('Connect with Datalumo', 'datalumo'), 'primary', 'submit', false); ?>
+                    <?php if (! defined('DATALUMO_API_URL')) : ?>
+                        <?php
+                        $datalumo_grant_url = (string) Options::get('api_url', 'https://datalumo.app');
+                        $datalumo_self_hosted = Options::normaliseBaseUrl($datalumo_grant_url) !== 'https://datalumo.app';
+                        ?>
+                        <details class="datalumo-self-host"<?php echo $datalumo_self_hosted ? ' open' : ''; ?>>
+                            <summary><?php esc_html_e('Using a self-hosted Datalumo?', 'datalumo'); ?></summary>
+                            <p>
+                                <label for="datalumo-grant-api-url"><?php esc_html_e('Datalumo URL', 'datalumo'); ?></label>
+                                <input type="url" id="datalumo-grant-api-url" name="api_url" class="regular-text"
+                                       value="<?php echo esc_attr($datalumo_grant_url); ?>" />
+                            </p>
+                        </details>
+                    <?php endif; ?>
+                </form>
+                <p>
+                    <button type="button" class="button-link" data-datalumo-mode="manual"><?php esc_html_e('Manual setup', 'datalumo'); ?></button>
+                </p>
+            </div>
+        <?php endif; ?>
+
+        <div id="datalumo-mode-manual" class="datalumo-manual"<?php echo ($datalumo_connected && ! $datalumo_setup_pending) ? '' : ' hidden'; ?>>
+            <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
+                <input type="hidden" name="action" value="datalumo_save" />
+                <input type="hidden" name="datalumo_tab" value="connection" />
+                <?php wp_nonce_field(SettingsPage::NONCE); ?>
+                <table class="form-table" role="presentation">
+                    <?php if ($datalumo_connected) : ?>
+                        <tr>
+                            <th scope="row"><?php esc_html_e('Organisation', 'datalumo'); ?></th>
+                            <td>
+                                <div class="datalumo-org-status">
+                                    <span><?php echo esc_html($datalumo_organisation['name'] ?? $datalumo_organisation['id'] ?? ''); ?></span>
+                                    <button type="submit" form="datalumo-disconnect" class="button"><?php esc_html_e('Disconnect', 'datalumo'); ?></button>
+                                </div>
+                            </td>
+                        </tr>
+                    <?php endif; ?>
+                    <?php if (! defined('DATALUMO_API_URL')) : ?>
+                        <tr>
+                            <th scope="row"><label for="datalumo-api-url"><?php esc_html_e('Datalumo URL', 'datalumo'); ?></label></th>
+                            <td>
+                                <input type="url" id="datalumo-api-url" name="api_url" class="regular-text"
+                                       value="<?php echo esc_attr(Options::get('api_url', 'https://datalumo.app')); ?>" />
+                                <p class="description"><?php esc_html_e('Leave as-is unless you were told otherwise.', 'datalumo'); ?></p>
+                            </td>
+                        </tr>
+                    <?php endif; ?>
                     <tr>
-                        <th scope="row"><label for="datalumo-api-url"><?php esc_html_e('Datalumo URL', 'datalumo'); ?></label></th>
+                        <th scope="row"><label for="datalumo-token"><?php esc_html_e('API token', 'datalumo'); ?></label></th>
                         <td>
-                            <input type="url" id="datalumo-api-url" name="api_url" class="regular-text"
-                                   value="<?php echo esc_attr(Options::get('api_url', 'https://datalumo.app')); ?>" />
-                            <p class="description"><?php esc_html_e('Leave as-is unless you were told otherwise.', 'datalumo'); ?></p>
+                            <input type="password" id="datalumo-token" class="regular-text code" autocomplete="off"
+                                   placeholder="<?php echo Options::get('api_token') ? esc_attr__('•••••••• (saved)', 'datalumo') : ''; ?>" />
+                            <p class="description"><?php esc_html_e('Paste a token from API keys. The organisation is inferred from the token.', 'datalumo'); ?></p>
                         </td>
                     </tr>
-                <?php endif; ?>
-                <tr>
-                    <th scope="row"><label for="datalumo-organisation-id"><?php esc_html_e('Organisation ID', 'datalumo'); ?></label></th>
-                    <td>
-                        <input type="text" id="datalumo-organisation-id" class="regular-text code"
-                               value="<?php echo esc_attr($organisation['id'] ?? ''); ?>" />
-                        <p class="description"><?php esc_html_e('Find it next to your API keys in the Datalumo dashboard.', 'datalumo'); ?></p>
-                    </td>
-                </tr>
-                <tr>
-                    <th scope="row"><label for="datalumo-token"><?php esc_html_e('API token', 'datalumo'); ?></label></th>
-                    <td>
-                        <input type="password" id="datalumo-token" class="regular-text code" autocomplete="off"
-                               placeholder="<?php echo Options::get('api_token') ? esc_attr__('•••••••• (saved)', 'datalumo') : ''; ?>" />
-                        <p class="description">
-                            <?php if (Options::get('api_token')) : ?>
-                                <?php esc_html_e('Leave blank to re-test, or paste a new token to replace it.', 'datalumo'); ?>
-                            <?php else : ?>
-                                <?php esc_html_e('Create a token under API keys in your Datalumo dashboard.', 'datalumo'); ?>
+                    <tr>
+                        <th scope="row"></th>
+                        <td>
+                            <button type="button" class="button button-primary" id="datalumo-connect"><?php esc_html_e('Connect & test', 'datalumo'); ?></button>
+                            <?php if (! defined('DATALUMO_API_URL')) : ?>
+                                <?php submit_button(__('Save URL', 'datalumo'), 'secondary', 'submit', false); ?>
                             <?php endif; ?>
-                        </p>
-                    </td>
-                </tr>
-                <tr>
-                    <th scope="row"></th>
-                    <td>
-                        <button type="button" class="button button-secondary" id="datalumo-connect"><?php esc_html_e('Connect & test', 'datalumo'); ?></button>
-                        <span id="datalumo-connect-result" class="datalumo-inline-result">
-                            <?php if (Options::isConnected()) : ?>
-                                <?php printf(
-                                    esc_html__('Connected to %1$s (%2$d sources).', 'datalumo'),
-                                    esc_html($organisation['name'] ?? $organisation['id'] ?? ''),
-                                    count($sources),
-                                ); ?>
+                            <span id="datalumo-connect-result" class="datalumo-inline-result"></span>
+                            <?php if (! $datalumo_connected) : ?>
+                                <p>
+                                    <button type="button" class="button-link" data-datalumo-mode="grant"><?php esc_html_e('Connect with Datalumo', 'datalumo'); ?></button>
+                                </p>
                             <?php endif; ?>
-                        </span>
-                    </td>
-                </tr>
-            </table>
-            <?php if (! defined('DATALUMO_API_URL')) : ?>
-                <?php submit_button(__('Save URL', 'datalumo')); ?>
-            <?php endif; ?>
-        <?php elseif ($tab === 'content-sync') : ?>
+                        </td>
+                    </tr>
+                </table>
+            </form>
+        </div>
+    <?php else : ?>
+    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
+        <input type="hidden" name="action" value="datalumo_save" />
+        <input type="hidden" name="datalumo_tab" value="<?php echo esc_attr($datalumo_tab); ?>" />
+        <?php wp_nonce_field(SettingsPage::NONCE); ?>
+
+        <?php if ($datalumo_tab === 'content-sync') : ?>
             <?php if (! Options::isConnected()) : ?>
                 <p><?php esc_html_e('Connect your account first.', 'datalumo'); ?></p>
             <?php else : ?>
-                <p class="description"><?php esc_html_e('Each sync pushes the chosen post types into one Datalumo source. Create a source for this WordPress-site in your dashboard first.', 'datalumo'); ?></p>
+                <?php
+                $datalumo_sync_rows = $datalumo_syncs === [] ? [[]] : $datalumo_syncs;
+                $datalumo_sync_multiple = count($datalumo_sync_rows) > 1;
+                ?>
                 <div id="datalumo-syncs">
-                    <?php foreach ($syncs === [] ? [[]] : $syncs as $index => $sync) : ?>
-                        <fieldset class="datalumo-sync-row" data-index="<?php echo esc_attr((string) $index); ?>">
-                            <input type="hidden" name="syncs[<?php echo esc_attr((string) $index); ?>][id]" value="<?php echo esc_attr($sync['id'] ?? ''); ?>" />
+                    <?php foreach ($datalumo_sync_rows as $datalumo_sync_index => $datalumo_sync) : ?>
+                        <fieldset class="datalumo-sync-row<?php echo $datalumo_sync_multiple ? ' is-multiple' : ''; ?>" data-index="<?php echo esc_attr((string) $datalumo_sync_index); ?>">
+                            <input type="hidden" name="syncs[<?php echo esc_attr((string) $datalumo_sync_index); ?>][id]" value="<?php echo esc_attr($datalumo_sync['id'] ?? ''); ?>" />
                             <table class="form-table" role="presentation">
                                 <tr>
                                     <th scope="row"><?php esc_html_e('Source', 'datalumo'); ?></th>
                                     <td>
-                                        <select name="syncs[<?php echo esc_attr((string) $index); ?>][source_id]">
+                                        <select name="syncs[<?php echo esc_attr((string) $datalumo_sync_index); ?>][source_id]">
                                             <option value=""><?php esc_html_e('— choose a source —', 'datalumo'); ?></option>
-                                            <?php foreach ($sources as $source) : ?>
-                                                <option value="<?php echo esc_attr($source['id']); ?>" <?php selected(($sync['source_id'] ?? '') === $source['id']); ?>>
-                                                    <?php echo esc_html($source['name']); ?>
+                                            <?php
+                                            $datalumo_selected_kb = '';
+                                            foreach ($datalumo_sources as $datalumo_source) :
+                                                $datalumo_kb = is_array($datalumo_source['knowledge_base'] ?? null)
+                                                    ? (string) ($datalumo_source['knowledge_base']['name'] ?? '')
+                                                    : '';
+                                                if (($datalumo_sync['source_id'] ?? '') === ($datalumo_source['id'] ?? '')) {
+                                                    $datalumo_selected_kb = $datalumo_kb;
+                                                }
+                                                $datalumo_source_label = $datalumo_kb !== ''
+                                                    ? $datalumo_source['name'].' ('.$datalumo_kb.')'
+                                                    : (string) ($datalumo_source['name'] ?? '');
+                                                ?>
+                                                <option value="<?php echo esc_attr($datalumo_source['id']); ?>" <?php selected(($datalumo_sync['source_id'] ?? '') === $datalumo_source['id']); ?>>
+                                                    <?php echo esc_html($datalumo_source_label); ?>
                                                 </option>
                                             <?php endforeach; ?>
                                         </select>
+                                        <?php if ($datalumo_selected_kb !== '') : ?>
+                                            <p class="description">
+                                                <?php
+                                                printf(
+                                                    /* translators: %s: knowledge base name */
+                                                    esc_html__('Knowledge base: %s', 'datalumo'),
+                                                    esc_html($datalumo_selected_kb),
+                                                );
+                                                ?>
+                                            </p>
+                                        <?php endif; ?>
                                     </td>
                                 </tr>
                                 <tr>
                                     <th scope="row"><?php esc_html_e('Post types', 'datalumo'); ?></th>
                                     <td>
-                                        <?php foreach ($postTypes as $postType) : ?>
+                                        <?php foreach ($datalumo_post_types as $datalumo_post_type) : ?>
                                             <label class="datalumo-checkbox">
-                                                <input type="checkbox" name="syncs[<?php echo esc_attr((string) $index); ?>][post_types][]"
-                                                       value="<?php echo esc_attr($postType->name); ?>"
-                                                       <?php checked(in_array($postType->name, $sync['post_types'] ?? [], true)); ?> />
-                                                <?php echo esc_html($postType->labels->name); ?>
+                                                <input type="checkbox" name="syncs[<?php echo esc_attr((string) $datalumo_sync_index); ?>][post_types][]"
+                                                       value="<?php echo esc_attr($datalumo_post_type->name); ?>"
+                                                       <?php checked(in_array($datalumo_post_type->name, $datalumo_sync['post_types'] ?? [], true)); ?> />
+                                                <?php echo esc_html($datalumo_post_type->labels->name); ?>
                                             </label>
                                         <?php endforeach; ?>
                                     </td>
                                 </tr>
-                                <?php if (($sync['id'] ?? '') !== '') : ?>
+                                <?php if (($datalumo_sync['id'] ?? '') !== '') : ?>
                                     <tr>
                                         <th scope="row"><?php esc_html_e('Full sync', 'datalumo'); ?></th>
-                                        <td class="datalumo-sync-controls" data-sync="<?php echo esc_attr($sync['id']); ?>">
-                                            <button type="button" class="button datalumo-sync-start" data-sync="<?php echo esc_attr($sync['id']); ?>"><?php esc_html_e('Sync now', 'datalumo'); ?></button>
-                                            <button type="button" class="button datalumo-sync-cancel" data-sync="<?php echo esc_attr($sync['id']); ?>" disabled><?php esc_html_e('Cancel', 'datalumo'); ?></button>
+                                        <td class="datalumo-sync-controls" data-sync="<?php echo esc_attr($datalumo_sync['id']); ?>">
+                                            <button type="button" class="button datalumo-sync-start" data-sync="<?php echo esc_attr($datalumo_sync['id']); ?>"><?php esc_html_e('Sync now', 'datalumo'); ?></button>
+                                            <button type="button" class="button datalumo-sync-cancel" data-sync="<?php echo esc_attr($datalumo_sync['id']); ?>" disabled><?php esc_html_e('Cancel', 'datalumo'); ?></button>
                                             <span class="datalumo-sync-spinner" aria-hidden="true"></span>
-                                            <span class="datalumo-inline-result datalumo-sync-status" data-sync="<?php echo esc_attr($sync['id']); ?>"></span>
+                                            <span class="datalumo-inline-result datalumo-sync-status" data-sync="<?php echo esc_attr($datalumo_sync['id']); ?>"></span>
                                         </td>
                                     </tr>
                                 <?php endif; ?>
@@ -145,10 +327,9 @@ class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo
                         </fieldset>
                     <?php endforeach; ?>
                 </div>
-                <p class="description"><?php esc_html_e('Custom field and taxonomy mappings can be added per sync with the datalumo_page_payload filter for now.', 'datalumo'); ?></p>
                 <?php submit_button(__('Save syncs', 'datalumo')); ?>
             <?php endif; ?>
-        <?php elseif ($tab === 'chatbot') : ?>
+        <?php elseif ($datalumo_tab === 'chatbot') : ?>
             <table class="form-table" role="presentation">
                 <tr>
                     <th scope="row"><?php esc_html_e('Chat widget', 'datalumo'); ?></th>
@@ -180,14 +361,13 @@ class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo
                     <th scope="row"><label for="datalumo-signing-secret"><?php esc_html_e('Identity signing secret', 'datalumo'); ?></label></th>
                     <td>
                         <input type="password" id="datalumo-signing-secret" name="chatbot_signing_secret" class="regular-text code" autocomplete="off"
-                               value="<?php echo esc_attr(Options::get('chatbot.signing_secret', '')); ?>" />
-                        <p class="description"><?php esc_html_e('From the same "For developers" section. Never exposed to the browser — used to sign user ids server-side.', 'datalumo'); ?></p>
+                               placeholder="<?php echo Options::get('chatbot.signing_secret') ? esc_attr__('•••••••• (saved)', 'datalumo') : ''; ?>" />
+                        <p class="description"><?php esc_html_e('From the same "For developers" section. Never exposed to the browser. Used to sign user ids server-side.', 'datalumo'); ?></p>
                     </td>
                 </tr>
             </table>
-            <p class="description"><?php esc_html_e('Tip: use the [datalumo_chat] shortcode to embed the chat inline on a page.', 'datalumo'); ?></p>
             <?php submit_button(); ?>
-        <?php elseif ($tab === 'search-box') : ?>
+        <?php elseif ($datalumo_tab === 'search-box') : ?>
             <table class="form-table" role="presentation">
                 <tr>
                     <th scope="row"><label for="datalumo-search-key"><?php esc_html_e('Widget key', 'datalumo'); ?></label></th>
@@ -199,7 +379,7 @@ class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo
                 </tr>
             </table>
             <?php submit_button(); ?>
-        <?php elseif ($tab === 'enhanced-search') : ?>
+        <?php elseif ($datalumo_tab === 'enhanced-search') : ?>
             <table class="form-table" role="presentation">
                 <tr>
                     <th scope="row"><?php esc_html_e('Enhanced search', 'datalumo'); ?></th>
@@ -221,11 +401,11 @@ class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo
                 <tr>
                     <th scope="row"><?php esc_html_e('Limit to post types', 'datalumo'); ?></th>
                     <td>
-                        <?php foreach ($postTypes as $postType) : ?>
+                        <?php foreach ($datalumo_post_types as $datalumo_post_type) : ?>
                             <label class="datalumo-checkbox">
-                                <input type="checkbox" name="enhanced_post_types[]" value="<?php echo esc_attr($postType->name); ?>"
-                                       <?php checked(in_array($postType->name, (array) Options::get('enhanced.post_types', []), true)); ?> />
-                                <?php echo esc_html($postType->labels->name); ?>
+                                <input type="checkbox" name="enhanced_post_types[]" value="<?php echo esc_attr($datalumo_post_type->name); ?>"
+                                       <?php checked(in_array($datalumo_post_type->name, (array) Options::get('enhanced.post_types', []), true)); ?> />
+                                <?php echo esc_html($datalumo_post_type->labels->name); ?>
                             </label>
                         <?php endforeach; ?>
                         <p class="description"><?php esc_html_e('Leave all unchecked to enhance every search.', 'datalumo'); ?></p>
@@ -257,4 +437,31 @@ class="nav-tab <?php echo $tab === $key ? 'nav-tab-active' : ''; ?>"><?php echo
             <?php submit_button(); ?>
         <?php endif; ?>
     </form>
+    <?php endif; ?>
+    </div>
+
+    <?php if (SettingsPage::setupIsReady()) : ?>
+        <aside class="datalumo-settings-aside">
+            <form class="datalumo-help-card" method="get" action="<?php echo esc_url(SettingsPage::helpUrl()); ?>" target="_blank" rel="noopener noreferrer" referrerpolicy="origin">
+                <h2><?php esc_html_e('Need help?', 'datalumo'); ?></h2>
+                <div class="datalumo-help-fields">
+                    <label class="screen-reader-text" for="datalumo-help-ask"><?php esc_html_e('Ask a question', 'datalumo'); ?></label>
+                    <textarea id="datalumo-help-ask" name="ask" required maxlength="<?php echo esc_attr((string) SettingsPage::ASK_MAX_LENGTH); ?>" rows="4" placeholder="<?php esc_attr_e('How do I sync products?', 'datalumo'); ?>"></textarea>
+                    <button type="submit" class="button button-primary datalumo-help-submit">
+                        <?php esc_html_e('Start chat', 'datalumo'); ?>
+                        <svg class="datalumo-help-icon" viewBox="0 0 20 20" aria-hidden="true">
+                            <path fill="currentColor" d="M10 3c-3.87 0-7 2.69-7 6 0 1.52.7 2.9 1.86 3.98-.2.7-.62 1.72-1.6 2.77a.5.5 0 0 0 .36.8c1.7 0 2.86-.62 3.62-1.12A8.2 8.2 0 0 0 10 15c3.87 0 7-2.69 7-6s-3.13-6-7-6Z"/>
+                        </svg>
+                    </button>
+                </div>
+            </form>
+            <div class="datalumo-docs-card">
+                <p>
+                    <a href="<?php echo esc_url(SettingsPage::docsUrl($datalumo_docs_hash)); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e('WordPress plugin docs', 'datalumo'); ?></a>
+                </p>
+                <p><?php echo esc_html($datalumo_docs_hint); ?></p>
+            </div>
+        </aside>
+    <?php endif; ?>
+    </div>
 </div>
diff --git a/src/Admin/Ajax.php b/src/Admin/Ajax.php
index 22bf87c..86a0f8a 100644
--- a/src/Admin/Ajax.php
+++ b/src/Admin/Ajax.php
@@ -4,6 +4,7 @@
 
 use Datalumo\Wp\Api\ApiException;
 use Datalumo\Wp\Api\Client;
+use Datalumo\Wp\Support\Credentials;
 use Datalumo\Wp\Support\Options;
 use Datalumo\Wp\Sync\BulkSync;
 
@@ -17,13 +18,14 @@ public function register(): void
         add_action('wp_ajax_datalumo_sync_start', [$this, 'syncStart']);
         add_action('wp_ajax_datalumo_sync_cancel', [$this, 'syncCancel']);
         add_action('wp_ajax_datalumo_sync_status', [$this, 'syncStatus']);
+        add_action('wp_ajax_datalumo_dismiss_setup_notice', [$this, 'dismissSetupNotice']);
     }
 
     /**
-     * Verify the pasted org id + token against /me; on success cache the
-     * organisation and its sources so the pickers render offline.
+     * Verify a pasted API token against GET /api/v1/me. The token identifies
+     * the organisation; no organisation ID is required.
      *
-     * An empty POST token falls back to the stored one — the password field
+     * An empty POST token falls back to the stored one. The password field
      * renders only a "saved" placeholder, never the secret. The base URL comes
      * from the form field (so an unsaved value works) and is persisted on success.
      */
@@ -31,34 +33,40 @@ public function connect(): void
     {
         $this->authorise();
 
-        $organisationId = sanitize_text_field((string) ($_POST['organisation_id'] ?? ''));
-        $token = sanitize_text_field((string) ($_POST['token'] ?? ''));
+        // phpcs:disable WordPress.Security.NonceVerification -- verified in authorise().
+        $token = sanitize_text_field(wp_unslash((string) ($_POST['token'] ?? '')));
         $apiUrl = array_key_exists('api_url', $_POST)
-            ? (esc_url_raw((string) wp_unslash($_POST['api_url'])) ?: 'https://datalumo.app')
+            ? (esc_url_raw(wp_unslash((string) $_POST['api_url'])) ?: 'https://datalumo.app')
             : null;
+        // phpcs:enable WordPress.Security.NonceVerification
 
-        if ($organisationId === '') {
-            $organisationId = (string) Options::get('organisation.id', '');
+        if ($token === '') {
+            $token = (string) Options::get('api_token', '');
         }
 
         if ($token === '') {
-            $token = (string) Options::get('api_token', '');
+            wp_send_json_error(['message' => __('An API token is required.', 'datalumo')]);
         }
 
-        if ($organisationId === '' || $token === '') {
-            wp_send_json_error(['message' => __('Both the organisation ID and an API token are required.', 'datalumo')]);
+        if (Credentials::looksLikeWidgetKey($token)) {
+            wp_send_json_error(['message' => __('That looks like a widget key. Paste an API token from API keys instead.', 'datalumo')]);
+        }
+
+        if (Credentials::looksLikeSecret($token)) {
+            wp_send_json_error(['message' => __('That looks like a widget secret. Paste an API token from API keys instead.', 'datalumo')]);
         }
 
         try {
-            $me = (new Client())->me($organisationId, $token, $apiUrl);
+            $me = (new Client())->me('', $token, $apiUrl);
         } catch (ApiException $e) {
             wp_send_json_error(['message' => $e->getMessage()]);
         }
 
         $stored = [
             'api_token' => $token,
-            'organisation' => $me['organisation'] ?? ['id' => $organisationId],
+            'organisation' => $me['organisation'] ?? [],
             'sources' => $me['sources'] ?? [],
+            'connected_via' => 'token',
         ];
 
         if ($apiUrl !== null) {
@@ -96,9 +104,19 @@ public function syncStatus(): void
         wp_send_json_success((new BulkSync())->status($this->syncId()));
     }
 
+    public function dismissSetupNotice(): void
+    {
+        $this->authorise();
+
+        update_user_meta(get_current_user_id(), 'datalumo_hide_setup_notice', '1');
+
+        wp_send_json_success();
+    }
+
     private function syncId(): string
     {
-        return sanitize_text_field((string) ($_POST['sync_id'] ?? ''));
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified in authorise().
+        return sanitize_text_field(wp_unslash((string) ($_POST['sync_id'] ?? '')));
     }
 
     private function authorise(): void
diff --git a/src/Admin/SettingsPage.php b/src/Admin/SettingsPage.php
index 54731ea..efeab38 100644
--- a/src/Admin/SettingsPage.php
+++ b/src/Admin/SettingsPage.php
@@ -2,14 +2,22 @@
 
 namespace Datalumo\Wp\Admin;
 
+use Datalumo\Wp\Api\ApiException;
+use Datalumo\Wp\Api\Client;
+use Datalumo\Wp\Support\Assets;
+use Datalumo\Wp\Support\Credentials;
 use Datalumo\Wp\Support\Options;
 
 class SettingsPage
 {
     public const NONCE = 'datalumo_settings';
 
+    public const ASK_MAX_LENGTH = 280;
+
     private const TABS = ['connection', 'content-sync', 'chatbot', 'search-box', 'enhanced-search'];
 
+    private bool $widgetKeyRejected = false;
+
     public function register(): void
     {
         add_action('admin_menu', function (): void {
@@ -32,16 +40,18 @@ public function assets(string $hook): void
             return;
         }
 
-        wp_enqueue_style('datalumo-admin', DATALUMO_URL . 'resources/css/admin.css', [], DATALUMO_VERSION);
-        wp_enqueue_script('datalumo-admin', DATALUMO_URL . 'resources/js/admin.js', [], DATALUMO_VERSION, ['in_footer' => true]);
+        wp_enqueue_style('datalumo-admin', DATALUMO_URL . 'resources/css/admin.css', [], Assets::version());
+        wp_enqueue_script('datalumo-admin', DATALUMO_URL . 'resources/js/admin.js', [], Assets::version(), ['in_footer' => true]);
 
         wp_localize_script('datalumo-admin', 'datalumoAdmin', [
             'ajaxUrl' => admin_url('admin-ajax.php'),
             'nonce' => wp_create_nonce(Ajax::NONCE),
             'i18n' => [
-                'connected' => __('Connected to %s — %d source(s) available.', 'datalumo'),
+                /* translators: 1: organisation name, 2: number of sources */
+                'connected' => __('Connected to %1$s — %2$d source(s) available.', 'datalumo'),
                 'connectionFailed' => __('Connection failed:', 'datalumo'),
                 'syncStarting' => __('Starting sync…', 'datalumo'),
+                /* translators: 1: number of posts already synced, 2: total posts */
                 'syncProgress' => __('%1$d of %2$d posts synced…', 'datalumo'),
                 'syncDone' => __('Sync complete.', 'datalumo'),
             ],
@@ -50,11 +60,73 @@ public function assets(string $hook): void
 
     public function render(): void
     {
-        $tab = isset($_GET['tab']) && in_array($_GET['tab'], self::TABS, true) ? $_GET['tab'] : 'connection';
+        $datalumo_tab = $this->requestedTab();
+
+        if ($datalumo_tab === 'content-sync') {
+            $this->refreshSources();
+        }
 
         require DATALUMO_DIR . '/resources/views/settings.php';
     }
 
+    /**
+     * Other tabs are empty until a connection exists and the post-connect
+     * checklist (if any) has been saved.
+     */
+    public static function setupIsReady(): bool
+    {
+        return Options::isConnected() && ! Options::get('setup_pending');
+    }
+
+    public static function docsUrl(string $hash = ''): string
+    {
+        $url = Options::baseUrl().'/docs/wordpress';
+
+        return $hash !== '' ? $url.'#'.$hash : $url;
+    }
+
+    /**
+     * Landing page for the settings "Need help?" form. Query `ask` is
+     * honoured on first-party docs only, as a composer prefill.
+     */
+    public static function helpUrl(): string
+    {
+        return self::docsUrl();
+    }
+
+    /**
+     * Pull a fresh source list (including knowledge base names) so the
+     * picker stays current after a connect or a rename in Datalumo.
+     */
+    private function refreshSources(): void
+    {
+        if (! Options::isConnected()) {
+            return;
+        }
+
+        try {
+            $me = (new Client())->me('', (string) Options::get('api_token'));
+        } catch (ApiException) {
+            return;
+        }
+
+        if (isset($me['sources']) && is_array($me['sources'])) {
+            Options::set('sources', $me['sources']);
+        }
+    }
+
+    private function requestedTab(): string
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- settings tab is a navigation query arg.
+        $tab = isset($_GET['tab']) ? sanitize_key(wp_unslash($_GET['tab'])) : '';
+
+        if (! self::setupIsReady()) {
+            return 'connection';
+        }
+
+        return in_array($tab, self::TABS, true) ? $tab : 'connection';
+    }
+
     public function save(): void
     {
         if (! current_user_can('manage_options')) {
@@ -63,23 +135,27 @@ public function save(): void
 
         check_admin_referer(self::NONCE);
 
-        $tab = sanitize_key((string) ($_POST['datalumo_tab'] ?? 'connection'));
         $input = wp_unslash($_POST);
+        $tab = sanitize_key((string) ($input['datalumo_tab'] ?? 'connection'));
+
+        if (! in_array($tab, self::TABS, true)) {
+            $tab = 'connection';
+        }
 
         match ($tab) {
             'content-sync' => $this->saveSyncs($input),
             'chatbot' => Options::merge(['chatbot' => [
                 'enabled' => ! empty($input['chatbot_enabled']),
-                'widget_key' => sanitize_text_field((string) ($input['chatbot_widget_key'] ?? '')),
+                'widget_key' => $this->sanitizeWidgetKey((string) ($input['chatbot_widget_key'] ?? ''), (string) Options::get('chatbot.widget_key', '')),
                 'identity_enabled' => ! empty($input['chatbot_identity_enabled']),
-                'signing_secret' => sanitize_text_field((string) ($input['chatbot_signing_secret'] ?? '')),
+                'signing_secret' => $this->sanitizeSigningSecret((string) ($input['chatbot_signing_secret'] ?? '')),
             ]]),
             'search-box' => Options::merge(['search_box' => [
-                'widget_key' => sanitize_text_field((string) ($input['search_box_widget_key'] ?? '')),
+                'widget_key' => $this->sanitizeWidgetKey((string) ($input['search_box_widget_key'] ?? ''), (string) Options::get('search_box.widget_key', '')),
             ]]),
             'enhanced-search' => Options::merge(['enhanced' => [
                 'enabled' => ! empty($input['enhanced_enabled']),
-                'widget_key' => sanitize_text_field((string) ($input['enhanced_widget_key'] ?? '')),
+                'widget_key' => $this->sanitizeWidgetKey((string) ($input['enhanced_widget_key'] ?? ''), (string) Options::get('enhanced.widget_key', '')),
                 'post_types' => array_map('sanitize_key', (array) ($input['enhanced_post_types'] ?? [])),
                 'summary_enabled' => ! empty($input['enhanced_summary_enabled']),
                 'summary_selector' => sanitize_text_field((string) ($input['enhanced_summary_selector'] ?? '')),
@@ -88,10 +164,20 @@ public function save(): void
             default => $this->saveConnection($input),
         };
 
-        wp_safe_redirect(add_query_arg(
-            ['page' => 'datalumo', 'tab' => $tab, 'updated' => '1'],
-            admin_url('options-general.php'),
-        ));
+        $args = [
+            'page' => 'datalumo',
+            'tab' => $tab,
+            '_wpnonce' => wp_create_nonce('datalumo_settings_updated'),
+        ];
+
+        if ($this->widgetKeyRejected) {
+            $args['datalumo_notice'] = 'invalid_widget_key';
+        } else {
+            // options-head.php prints "Settings saved." when updated=1 on a Settings screen.
+            $args['updated'] = '1';
+        }
+
+        wp_safe_redirect(add_query_arg($args, admin_url('options-general.php')));
         exit;
     }
 
@@ -144,4 +230,24 @@ private function saveSyncs(array $input): void
 
         Options::set('syncs', $syncs);
     }
+
+    private function sanitizeWidgetKey(string $value, string $current = ''): string
+    {
+        $value = sanitize_text_field($value);
+
+        if ($value === '' || Credentials::looksLikeWidgetKey($value)) {
+            return $value;
+        }
+
+        $this->widgetKeyRejected = true;
+
+        return $current;
+    }
+
+    private function sanitizeSigningSecret(string $value): string
+    {
+        $value = sanitize_text_field($value);
+
+        return $value !== '' ? $value : (string) Options::get('chatbot.signing_secret', '');
+    }
 }
diff --git a/src/Admin/index.php b/src/Admin/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Admin/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Api/Client.php b/src/Api/Client.php
index cd105bd..d458b98 100644
--- a/src/Api/Client.php
+++ b/src/Api/Client.php
@@ -15,17 +15,35 @@
 class Client
 {
     /**
-     * GET /me — connection test + organisation/source discovery. Tokens are
-     * org-scoped, so both id and token are needed to connect.
+     * GET /api/v1/me: connection test and organisation/source discovery.
+     * The token identifies the organisation; $organisationId is optional
+     * for older Datalumo instances that still require it in the path.
      *
      * @param string|null $baseUrl Optional override (e.g. from the settings
      *                             form before it has been saved).
      */
     public function me(string $organisationId, string $token, ?string $baseUrl = null): array
     {
+        if ($organisationId === '') {
+            return $this->request('GET', $this->rootUrl('api/v1/me', $baseUrl), token: $token);
+        }
+
         return $this->request('GET', $this->orgUrl($organisationId, 'me', $baseUrl), token: $token);
     }
 
+    /**
+     * @return array<string, mixed>
+     */
+    public function exchangeWordPressGrant(string $code, string $state, ?string $baseUrl = null): array
+    {
+        return $this->request(
+            'POST',
+            $this->rootUrl('api/integrations/wordpress/exchange', $baseUrl),
+            ['code' => $code, 'state' => $state],
+            anonymous: true,
+        );
+    }
+
     public function pushPage(string $sourceId, array $payload): array
     {
         return $this->request('POST', $this->sourceUrl($sourceId, 'pages'), $payload);
@@ -70,13 +88,18 @@ public function search(string $widgetKey, string $query, int $limit = 50, ?strin
         );
     }
 
-    private function orgUrl(string $organisationId, string $path, ?string $baseUrl = null): string
+    private function rootUrl(string $path, ?string $baseUrl = null): string
     {
         $base = $baseUrl !== null && $baseUrl !== ''
             ? Options::normaliseBaseUrl($baseUrl)
             : Options::baseUrl();
 
-        return $base . '/api/v1/' . rawurlencode($organisationId) . '/' . $path;
+        return $base . '/' . ltrim($path, '/');
+    }
+
+    private function orgUrl(string $organisationId, string $path, ?string $baseUrl = null): string
+    {
+        return $this->rootUrl('api/v1/' . rawurlencode($organisationId) . '/' . $path, $baseUrl);
     }
 
     private function sourceUrl(string $sourceId, string $path): string
@@ -94,13 +117,13 @@ public function parseWidgetKey(string $key): array
         $parts = explode('/', trim($key), 2);
 
         if (count($parts) !== 2 || $parts[0] === '' || $parts[1] === '') {
-            throw new ApiException(__('Invalid widget key — copy it from the widget editor.', 'datalumo'));
+            throw new ApiException(esc_html__('Invalid widget key — copy it from the widget editor.', 'datalumo'));
         }
 
         return [$parts[0], $parts[1]];
     }
 
-    private function request(string $method, string $url, array $body = [], ?string $token = null, ?string $origin = null): array
+    private function request(string $method, string $url, array $body = [], ?string $token = null, ?string $origin = null, bool $anonymous = false): array
     {
         $headers = [
             'Accept' => 'application/json',
@@ -109,7 +132,7 @@ private function request(string $method, string $url, array $body = [], ?string
 
         if ($origin !== null) {
             $headers['Origin'] = $origin;
-        } else {
+        } elseif (! $anonymous) {
             $token ??= (string) Options::get('api_token');
 
             if ($token !== '') {
@@ -126,20 +149,24 @@ private function request(string $method, string $url, array $body = [], ?string
         ]);
 
         if (is_wp_error($response)) {
-            throw new ApiException($response->get_error_message());
+            throw new ApiException(esc_html($response->get_error_message()));
         }
 
         $status = (int) wp_remote_retrieve_response_code($response);
         $decoded = json_decode((string) wp_remote_retrieve_body($response), true);
 
         if ($status >= 400) {
-            $message = is_array($decoded) && isset($decoded['message'])
-                ? (string) $decoded['message']
-                : sprintf(__('Datalumo request failed (%d).', 'datalumo'), $status);
+            if (is_array($decoded) && isset($decoded['message'])) {
+                $message = (string) $decoded['message'];
+            } else {
+                /* translators: %d: HTTP status code */
+                $message = sprintf(esc_html__('Datalumo request failed (%d).', 'datalumo'), $status);
+            }
 
             $retryAfter = (int) wp_remote_retrieve_header($response, 'retry-after');
 
-            throw new ApiException($message, $status, $retryAfter > 0 ? $retryAfter : null);
+            // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception payload, not rendered output.
+            throw new ApiException(esc_html($message), $status, $retryAfter > 0 ? $retryAfter : null);
         }
 
         return is_array($decoded) ? $decoded : [];
diff --git a/src/Api/index.php b/src/Api/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Api/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Connect/Grant.php b/src/Connect/Grant.php
new file mode 100644
index 0000000..f776426
--- /dev/null
+++ b/src/Connect/Grant.php
@@ -0,0 +1,284 @@
+<?php
+
+namespace Datalumo\Wp\Connect;
+
+use Datalumo\Wp\Api\ApiException;
+use Datalumo\Wp\Api\Client;
+use Datalumo\Wp\Support\Options;
+
+class Grant
+{
+    public const ACTION_START = 'datalumo_connect_start';
+
+    public const ACTION_CALLBACK = 'datalumo_oauth_callback';
+
+    public const ACTION_DISCONNECT = 'datalumo_disconnect';
+
+    public const ACTION_SETUP = 'datalumo_setup';
+
+    public const TRANSIENT = 'datalumo_wp_grant_state';
+
+    public static function register(): void
+    {
+        add_action('admin_post_'.self::ACTION_START, [self::class, 'start']);
+        add_action('admin_post_'.self::ACTION_CALLBACK, [self::class, 'callback']);
+        add_action('admin_post_'.self::ACTION_DISCONNECT, [self::class, 'disconnect']);
+        add_action('admin_post_'.self::ACTION_SETUP, [self::class, 'saveSetup']);
+    }
+
+    public static function start(): void
+    {
+        self::authorise();
+        check_admin_referer(self::ACTION_START);
+
+        $state = wp_generate_uuid4();
+        set_transient(self::TRANSIENT.'_'.get_current_user_id(), $state, 10 * MINUTE_IN_SECONDS);
+
+        $apiUrl = isset($_POST['api_url'])
+            ? (esc_url_raw(wp_unslash((string) $_POST['api_url'])) ?: Options::baseUrl())
+            : Options::baseUrl();
+
+        if (! defined('DATALUMO_API_URL') && $apiUrl !== '') {
+            Options::set('api_url', $apiUrl);
+        }
+
+        $url = self::startUrl($apiUrl, $state);
+        $scheme = strtolower((string) wp_parse_url($url, PHP_URL_SCHEME));
+
+        if (! in_array($scheme, ['http', 'https'], true)) {
+            self::redirectSettings('connection', 'grant_failed');
+        }
+
+        // Off-site on purpose. wp_safe_redirect would rewrite dl.test /
+        // datalumo.app back to this site's admin.
+        wp_redirect($url);
+        exit;
+    }
+
+    public static function callback(): void
+    {
+        self::authorise();
+
+        $expected = (string) get_transient(self::TRANSIENT.'_'.get_current_user_id());
+        $state = sanitize_text_field(wp_unslash((string) ($_GET['state'] ?? '')));
+        $code = sanitize_text_field(wp_unslash((string) ($_GET['code'] ?? '')));
+
+        delete_transient(self::TRANSIENT.'_'.get_current_user_id());
+
+        if ($expected === '' || $state === '' || ! hash_equals($expected, $state) || $code === '') {
+            self::redirectSettings('connection', 'grant_failed');
+        }
+
+        try {
+            $payload = (new Client())->exchangeWordPressGrant($code, $state);
+        } catch (ApiException $e) {
+            self::redirectSettings('connection', 'grant_failed');
+        }
+
+        self::apply($payload);
+        self::redirectSettings('connection', 'connected');
+    }
+
+    public static function disconnect(): void
+    {
+        self::authorise();
+        check_admin_referer(self::ACTION_DISCONNECT);
+
+        $chatbot = (array) Options::get('chatbot', []);
+        $chatbot['widget_key'] = '';
+        $chatbot['signing_secret'] = '';
+        $chatbot['enabled'] = false;
+        $chatbot['identity_enabled'] = false;
+
+        $searchBox = (array) Options::get('search_box', []);
+        $searchBox['widget_key'] = '';
+
+        $enhanced = (array) Options::get('enhanced', []);
+        $enhanced['widget_key'] = '';
+        $enhanced['enabled'] = false;
+
+        Options::merge([
+            'api_token' => '',
+            'organisation' => [],
+            'sources' => [],
+            'setup_pending' => false,
+            'setup_source_id' => '',
+            'connected_via' => '',
+            'chatbot' => $chatbot,
+            'search_box' => $searchBox,
+            'enhanced' => $enhanced,
+        ]);
+
+        self::redirectSettings('connection', 'disconnected');
+    }
+
+    public static function saveSetup(): void
+    {
+        self::authorise();
+        check_admin_referer(self::ACTION_SETUP);
+
+        $input = wp_unslash($_POST);
+        $sourceId = (string) Options::get('setup_source_id', '');
+        $postTypes = array_map('sanitize_key', (array) ($input['setup_post_types'] ?? []));
+
+        if ($sourceId !== '' && $postTypes !== []) {
+            $syncs = (array) Options::get('syncs', []);
+            $existing = false;
+
+            foreach ($syncs as $index => $row) {
+                if (($row['source_id'] ?? '') === $sourceId) {
+                    $syncs[$index]['post_types'] = $postTypes;
+                    $existing = true;
+                    break;
+                }
+            }
+
+            if (! $existing) {
+                $syncs[] = [
+                    'id' => wp_generate_uuid4(),
+                    'source_id' => $sourceId,
+                    'post_types' => $postTypes,
+                    'meta_mappings' => [],
+                ];
+            }
+
+            Options::set('syncs', $syncs);
+        }
+
+        $chatbot = (array) Options::get('chatbot', []);
+        $chatbot['enabled'] = ! empty($input['setup_chat_enabled']);
+        $chatbot['identity_enabled'] = ! empty($input['setup_identity_enabled']);
+        Options::set('chatbot', $chatbot);
+
+        $enhanced = (array) Options::get('enhanced', []);
+        $enhanced['enabled'] = ! empty($input['setup_enhanced_enabled']);
+        Options::set('enhanced', $enhanced);
+
+        Options::set('setup_pending', false);
+
+        $args = [
+            'page' => 'datalumo',
+            'tab' => 'connection',
+            'datalumo_notice' => 'setup_saved',
+            '_wpnonce' => wp_create_nonce('datalumo_settings_updated'),
+        ];
+
+        if (! empty($input['setup_sync_now']) && $sourceId !== '') {
+            $syncId = '';
+
+            foreach ((array) Options::get('syncs', []) as $row) {
+                if (($row['source_id'] ?? '') === $sourceId) {
+                    $syncId = (string) ($row['id'] ?? '');
+                    break;
+                }
+            }
+
+            if ($syncId !== '') {
+                $args['tab'] = 'content-sync';
+                $args['datalumo_sync'] = $syncId;
+            }
+        }
+
+        wp_safe_redirect(add_query_arg($args, admin_url('options-general.php')));
+        exit;
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public static function apply(array $payload): void
+    {
+        $organisation = is_array($payload['organisation'] ?? null) ? $payload['organisation'] : [];
+        $sources = is_array($payload['sources'] ?? null) ? $payload['sources'] : [];
+        $source = is_array($payload['source'] ?? null) ? $payload['source'] : [];
+        $chatbot = is_array($payload['chatbot'] ?? null) ? $payload['chatbot'] : null;
+        $search = is_array($payload['search'] ?? null) ? $payload['search'] : null;
+
+        $sourceId = (string) ($source['id'] ?? '');
+        $stored = [
+            'api_token' => (string) ($payload['token'] ?? ''),
+            'organisation' => $organisation,
+            'sources' => $sources,
+            'setup_pending' => true,
+            'setup_source_id' => $sourceId,
+            'connected_via' => 'grant',
+        ];
+
+        if ($sourceId !== '') {
+            $syncs = (array) Options::get('syncs', []);
+            $hasSource = false;
+
+            foreach ($syncs as $row) {
+                if (($row['source_id'] ?? '') === $sourceId) {
+                    $hasSource = true;
+                    break;
+                }
+            }
+
+            if (! $hasSource) {
+                $syncs[] = [
+                    'id' => wp_generate_uuid4(),
+                    'source_id' => $sourceId,
+                    'post_types' => ['post', 'page'],
+                    'meta_mappings' => [],
+                ];
+                $stored['syncs'] = $syncs;
+            }
+        }
+
+        if (is_array($chatbot)) {
+            $stored['chatbot'] = array_merge((array) Options::get('chatbot', []), [
+                'widget_key' => (string) ($chatbot['widget_key'] ?? ''),
+                'signing_secret' => (string) ($chatbot['signing_secret'] ?? ''),
+            ]);
+        }
+
+        if (is_array($search)) {
+            $key = (string) ($search['widget_key'] ?? '');
+            $stored['search_box'] = array_merge((array) Options::get('search_box', []), [
+                'widget_key' => $key,
+            ]);
+            $stored['enhanced'] = array_merge((array) Options::get('enhanced', []), [
+                'widget_key' => $key,
+            ]);
+        }
+
+        Options::merge($stored);
+    }
+
+    public static function startUrl(string $baseUrl, string $state): string
+    {
+        $base = Options::normaliseBaseUrl($baseUrl);
+        $home = home_url('/');
+        $host = (string) wp_parse_url($home, PHP_URL_HOST);
+
+        return $base.'/integrations/wordpress?'.http_build_query([
+            'site' => $host,
+            'site_url' => $home,
+            'return' => admin_url('admin-post.php?action='.self::ACTION_CALLBACK),
+            'cancel' => admin_url('options-general.php').'?page=datalumo&tab=connection',
+            'state' => $state,
+        ]);
+    }
+
+    private static function authorise(): void
+    {
+        if (! current_user_can('manage_options')) {
+            wp_die(esc_html__('Not allowed.', 'datalumo'));
+        }
+    }
+
+    private static function redirectSettings(string $tab, string $notice): void
+    {
+        wp_safe_redirect(add_query_arg(
+            [
+                'page' => 'datalumo',
+                'tab' => $tab,
+                'datalumo_notice' => $notice,
+                '_wpnonce' => wp_create_nonce('datalumo_settings_updated'),
+            ],
+            admin_url('options-general.php'),
+        ));
+        exit;
+    }
+}
diff --git a/src/Connect/index.php b/src/Connect/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Connect/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Embed/Embed.php b/src/Embed/Embed.php
index 1a71620..08a2976 100644
--- a/src/Embed/Embed.php
+++ b/src/Embed/Embed.php
@@ -2,6 +2,7 @@
 
 namespace Datalumo\Wp\Embed;
 
+use Datalumo\Wp\Support\Assets;
 use Datalumo\Wp\Support\Options;
 
 /**
@@ -33,7 +34,7 @@ public function registerScript(): void
             self::SCRIPT_HANDLE,
             Options::baseUrl() . '/widget/v1/datalumo.js',
             [],
-            null,
+            Assets::version(),
             ['in_footer' => true],
         );
     }
@@ -105,9 +106,66 @@ public function chatShortcode(array|string $attributes = []): string
      */
     private function overrides(): array
     {
+        $overrides = [];
         $user = $this->identity();
+        $context = $this->pageContext();
 
-        return $user !== null ? ['user' => $user] : [];
+        if ($user !== null) {
+            $overrides['user'] = $user;
+        }
+
+        if ($context !== []) {
+            $overrides['context'] = $context;
+        }
+
+        return $overrides;
+    }
+
+    /**
+     * Product page hints for chat. Merged with the widget's automatic
+     * page_url / page_title so "this product" has a real id to copy.
+     *
+     * @return array<string, string>
+     */
+    public function pageContext(): array
+    {
+        $context = [];
+
+        if (function_exists('is_singular') && is_singular()) {
+            $pageId = (int) get_the_ID();
+
+            if ($pageId > 0) {
+                $context['page_id'] = (string) $pageId;
+            }
+        }
+
+        if (function_exists('is_product') && is_product()) {
+            $id = (int) get_the_ID();
+
+            if ($id > 0) {
+                $context['product_id'] = (string) $id;
+            }
+
+            if ($id > 0 && function_exists('wc_get_product')) {
+                $product = wc_get_product($id);
+
+                if ($product && method_exists($product, 'get_sku')) {
+                    $sku = trim((string) $product->get_sku());
+
+                    if ($sku !== '') {
+                        $context['sku'] = $sku;
+                    }
+                }
+            }
+        }
+
+        if (function_exists('apply_filters')) {
+            $filtered = apply_filters('datalumo_chat_context', $context);
+
+            return is_array($filtered) ? $filtered : $context;
+        }
+
+        return $context;
     }
 
     /**
diff --git a/src/Embed/index.php b/src/Embed/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Embed/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Integration/AddToCart.php b/src/Integration/AddToCart.php
new file mode 100644
index 0000000..12471a7
--- /dev/null
+++ b/src/Integration/AddToCart.php
@@ -0,0 +1,893 @@
+<?php
+
+namespace Datalumo\Wp\Integration;
+
+use Datalumo\Wp\Support\Assets;
+
+/**
+ * Listens for a Datalumo host action named add_to_cart and adds the
+ * product to the visitor's WooCommerce cart (their browser session).
+ */
+class AddToCart
+{
+    public const AJAX_ACTION = 'datalumo_add_to_cart';
+
+    public const NONCE = 'datalumo_add_to_cart';
+
+    public const DEFAULT_EVENT = 'add_to_cart';
+
+    public const MAX_CHOICES = 8;
+
+    public function register(): void
+    {
+        add_action('wp_enqueue_scripts', [$this, 'enqueue']);
+        add_action('wp_ajax_' . self::AJAX_ACTION, [$this, 'handle']);
+        add_action('wp_ajax_nopriv_' . self::AJAX_ACTION, [$this, 'handle']);
+    }
+
+    public function enqueue(): void
+    {
+        wp_enqueue_script(
+            'datalumo-add-to-cart',
+            DATALUMO_URL . 'resources/js/add-to-cart.js',
+            [],
+            Assets::version(),
+            ['in_footer' => true],
+        );
+
+        wp_localize_script('datalumo-add-to-cart', 'datalumoAddToCart', [
+            'ajaxUrl' => admin_url('admin-ajax.php'),
+            'nonce' => wp_create_nonce(self::NONCE),
+            'event' => $this->eventName(),
+            'productId' => self::currentProductId(),
+            'i18n' => [
+                'missingProduct' => __('No product was specified.', 'datalumo'),
+                'failed' => __('Could not add that to the cart.', 'datalumo'),
+            ],
+        ]);
+    }
+
+    public function eventName(): string
+    {
+        $event = apply_filters('datalumo_add_to_cart_event', self::DEFAULT_EVENT);
+
+        return is_string($event) && $event !== '' ? $event : self::DEFAULT_EVENT;
+    }
+
+    public function handle(): void
+    {
+        check_ajax_referer(self::NONCE);
+
+        $result = $this->addFromPayload($this->requestPayload());
+
+        if ($result['ok']) {
+            wp_send_json_success($result);
+        }
+
+        wp_send_json_error(array_filter([
+            'message' => $result['message'] ?? '',
+            'status' => $result['status'] ?? null,
+            'layout' => $result['layout'] ?? null,
+            'choices' => $result['choices'] ?? null,
+            'url' => $result['url'] ?? null,
+        ], fn ($value) => $value !== null && $value !== '' && $value !== []));
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array{ok: bool, message: string, fragments?: array<string, string>, cart_hash?: string}
+     */
+    public function addFromPayload(array $payload): array
+    {
+        $payload = apply_filters('datalumo_add_to_cart_payload', $payload);
+        $payload = is_array($payload) ? $payload : [];
+
+        $resolved = self::resolvePayload($payload);
+        $productId = $resolved['product_id'];
+
+        if ($productId <= 0 && $resolved['sku'] !== '' && function_exists('wc_get_product_id_by_sku')) {
+            $productId = (int) wc_get_product_id_by_sku($resolved['sku']);
+        }
+
+        if ($productId <= 0) {
+            $productId = self::productIdFromPageUrl($payload);
+        }
+
+        if ($productId <= 0) {
+            return [
+                'ok' => false,
+                'message' => __('No product was specified.', 'datalumo'),
+            ];
+        }
+
+        $variation = self::applyChoices($resolved['variation'], $payload);
+
+        return $this->add($productId, $resolved['quantity'], $resolved['variation_id'], $variation);
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array{product_id: int, quantity: int, variation_id: int, sku: string, variation: array<string, string>}
+     */
+    public static function resolvePayload(array $payload): array
+    {
+        $quantity = self::firstPositiveInt($payload, ['quantity', 'qty']);
+
+        return [
+            'product_id' => self::firstPositiveInt($payload, ['product_id', 'product', 'id', 'external_id']),
+            'quantity' => $quantity > 0 ? min($quantity, 99) : 1,
+            'variation_id' => self::firstPositiveInt($payload, ['choice', 'variation_id', 'variation']),
+            'sku' => self::firstString($payload, ['sku']),
+            'variation' => self::variationAttributes($payload),
+        ];
+    }
+
+    public static function currentProductId(): int
+    {
+        if (! function_exists('is_product') || ! is_product()) {
+            return 0;
+        }
+
+        return (int) get_the_ID();
+    }
+
+    /**
+     * Merge attributes stored on a variation product into the payload map.
+     *
+     * @param  array<string, string>  $variation
+     * @return array<string, string>
+     */
+    public static function attributesForVariation(int $variationId, array $variation): array
+    {
+        if ($variationId <= 0 || ! function_exists('wc_get_product')) {
+            return $variation;
+        }
+
+        $product = wc_get_product($variationId);
+
+        if (! $product || ! method_exists($product, 'get_variation_attributes')) {
+            return $variation;
+        }
+
+        $fromProduct = $product->get_variation_attributes();
+        $merged = [];
+
+        foreach (is_array($fromProduct) ? $fromProduct : [] as $key => $value) {
+            if (! is_string($key) || ! is_scalar($value)) {
+                continue;
+            }
+
+            $value = trim((string) $value);
+
+            if ($value !== '') {
+                $merged[$key] = $value;
+            }
+        }
+
+        foreach ($variation as $key => $value) {
+            if (! is_string($key) || ! is_scalar($value)) {
+                continue;
+            }
+
+            $value = trim((string) $value);
+
+            if ($value !== '') {
+                $merged[$key] = $value;
+            }
+        }
+
+        return $merged;
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public static function productIdFromPageUrl(array $payload): int
+    {
+        $url = self::firstString($payload, ['page_url', 'url']);
+
+        if ($url === '' || ! function_exists('url_to_postid')) {
+            return 0;
+        }
+
+        $id = (int) url_to_postid($url);
+
+        if ($id <= 0 || ! function_exists('wc_get_product')) {
+            return 0;
+        }
+
+        return wc_get_product($id) ? $id : 0;
+    }
+
+    /**
+     * @param  array<string, string>  $variation
+     * @return array{ok: bool, message: string, fragments?: array<string, string>, cart_hash?: string}
+     */
+    public function add(int $productId, int $quantity, int $variationId = 0, array $variation = []): array
+    {
+        if (! function_exists('wc_get_product') || ! function_exists('WC')) {
+            return [
+                'ok' => false,
+                'message' => __('WooCommerce is not available.', 'datalumo'),
+            ];
+        }
+
+        $parent = wc_get_product($productId);
+
+        if (! $parent) {
+            return [
+                'ok' => false,
+                'message' => __('That product could not be found.', 'datalumo'),
+            ];
+        }
+
+        if (method_exists($parent, 'is_type') && $parent->is_type('variable')) {
+            $resolved = $this->resolveVariableSelection($parent, $variationId, $variation);
+
+            if (array_key_exists('ok', $resolved)) {
+                return $resolved;
+            }
+
+            $variationId = $resolved['variation_id'];
+            $variation = $resolved['variation'];
+        }
+
+        $product = wc_get_product($variationId > 0 ? $variationId : $productId);
+
+        if (! $product) {
+            return [
+                'ok' => false,
+                'message' => __('That product could not be found.', 'datalumo'),
+            ];
+        }
+
+        if (method_exists($product, 'is_purchasable') && ! $product->is_purchasable()) {
+            return [
+                'ok' => false,
+                'message' => __('That product cannot be purchased.', 'datalumo'),
+            ];
+        }
+
+        $max = method_exists($product, 'get_max_purchase_quantity')
+            ? (int) $product->get_max_purchase_quantity()
+            : -1;
+
+        if ($max > 0) {
+            $quantity = min($quantity, $max);
+        }
+
+        if (function_exists('wc_load_cart') && WC()->cart === null) {
+            wc_load_cart();
+        }
+
+        if (! WC()->cart) {
+            return [
+                'ok' => false,
+                'message' => __('Could not add that to the cart.', 'datalumo'),
+            ];
+        }
+
+        $variation = self::attributesForVariation($variationId, $variation);
+
+        $added = WC()->cart->add_to_cart($productId, $quantity, $variationId, $variation);
+
+        if (! $added) {
+            return [
+                'ok' => false,
+                'message' => $this->cartErrorMessage(),
+            ];
+        }
+
+        $name = method_exists($product, 'get_name')
+            ? wp_strip_all_tags((string) $product->get_name())
+            : '';
+
+        return [
+            'ok' => true,
+            'message' => $name !== ''
+                ? sprintf(__('%s added to your cart.', 'datalumo'), $name)
+                : __('Added to your cart.', 'datalumo'),
+            'fragments' => $this->cartFragments(),
+            'cart_hash' => method_exists(WC()->cart, 'get_cart_hash')
+                ? (string) WC()->cart->get_cart_hash()
+                : '',
+        ];
+    }
+
+    /**
+     * Ask for one missing attribute at a time (colour, then size), then
+     * match the variation that has every picked value.
+     *
+     * @param  array<string, string>  $variation
+     * @return array{variation_id: int, variation: array<string, string>}|array{ok: false, message: string, status?: string, layout?: string, choices?: array<int, array<string, string>>, url?: string}
+     */
+    private function resolveVariableSelection(object $parent, int $variationId, array $variation): array
+    {
+        $rows = method_exists($parent, 'get_available_variations')
+            ? $parent->get_available_variations()
+            : [];
+        $rows = is_array($rows) ? $rows : [];
+        $variation = self::attributesForVariation($variationId, $variation);
+        $missing = self::missingAttributeKeys(
+            self::variationAttributeKeys($parent, $rows),
+            $variation,
+        );
+
+        if ($missing !== []) {
+            return $this->elicitAttributes($parent, $rows, $missing, $variation);
+        }
+
+        if ($variationId <= 0) {
+            $variationId = self::matchVariationId($rows, $variation);
+        }
+
+        if ($variationId <= 0) {
+            $url = method_exists($parent, 'get_permalink')
+                ? (string) $parent->get_permalink()
+                : '';
+
+            return [
+                'ok' => false,
+                'message' => __('This product needs a variation.', 'datalumo'),
+                'url' => $url,
+            ];
+        }
+
+        return [
+            'variation_id' => $variationId,
+            'variation' => $variation,
+        ];
+    }
+
+    /**
+     * @param  array<int, mixed>  $rows
+     * @param  array<int, string>  $keys
+     * @param  array<string, string>  $selected
+     * @return array{ok: false, message: string, status?: string, layout?: string, choices?: array<int, array<string, mixed>>, url?: string}
+     */
+    private function elicitAttributes(object $product, array $rows, array $keys, array $selected): array
+    {
+        $choices = self::choicesTree($rows, $keys, $selected, $product);
+        $url = method_exists($product, 'get_permalink')
+            ? (string) $product->get_permalink()
+            : '';
+
+        if ($choices === []) {
+            return [
+                'ok' => false,
+                'message' => __('This product needs a variation.', 'datalumo'),
+                'url' => $url,
+            ];
+        }
+
+        if (self::choicesExceedMax($choices)) {
+            return [
+                'ok' => false,
+                'message' => __('This product has many options. Open the product to pick one.', 'datalumo'),
+                'url' => $url,
+            ];
+        }
+
+        return [
+            'ok' => false,
+            'status' => 'choices',
+            'message' => sprintf(__('Which %s?', 'datalumo'), self::attributeLabel($keys[0])),
+            'layout' => 'options',
+            'choices' => $choices,
+            'url' => $url,
+        ];
+    }
+
+    /**
+     * @param  array<int, mixed>  $rows
+     * @return array<int, string>
+     */
+    public static function variationAttributeKeys(object $product, array $rows): array
+    {
+        if (method_exists($product, 'get_variation_attributes')) {
+            $attrs = $product->get_variation_attributes();
+
+            if (is_array($attrs) && $attrs !== []) {
+                $keys = [];
+
+                foreach (array_keys($attrs) as $key) {
+                    if (is_string($key) && $key !== '') {
+                        $keys[] = self::attributeKey($key);
+                    }
+                }
+
+                if ($keys !== []) {
+                    return $keys;
+                }
+            }
+        }
+
+        $keys = [];
+
+        foreach ($rows as $row) {
+            if (! is_array($row) || ! is_array($row['attributes'] ?? null)) {
+                continue;
+            }
+
+            foreach (array_keys($row['attributes']) as $key) {
+                if (is_string($key) && $key !== '') {
+                    $keys[$key] = true;
+                }
+            }
+        }
+
+        return array_keys($keys);
+    }
+
+    /**
+     * @param  array<int, string>  $needed
+     * @param  array<string, string>  $selected
+     * @return array<int, string>
+     */
+    public static function missingAttributeKeys(array $needed, array $selected): array
+    {
+        $missing = [];
+
+        foreach ($needed as $key) {
+            if (trim((string) ($selected[$key] ?? '')) === '') {
+                $missing[] = $key;
+            }
+        }
+
+        return $missing;
+    }
+
+    /**
+     * @param  array<string, string>  $selected
+     * @return array<string, string>
+     */
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<int, string>
+     */
+    public static function choicePath(array $payload): array
+    {
+        $choice = $payload['choice'] ?? null;
+
+        if (is_array($choice)) {
+            $path = [];
+
+            foreach ($choice as $item) {
+                if (is_string($item) && trim($item) !== '') {
+                    $path[] = trim($item);
+                }
+            }
+
+            return $path;
+        }
+
+        if (is_string($choice) && trim($choice) !== '') {
+            return [trim($choice)];
+        }
+
+        return [];
+    }
+
+    /**
+     * @param  array<string, string>  $selected
+     * @param  array<string, mixed>  $payload
+     * @return array<string, string>
+     */
+    public static function applyChoices(array $selected, array $payload): array
+    {
+        foreach (self::choicePath($payload) as $choice) {
+            $selected = self::applyChoice($selected, $choice);
+        }
+
+        return $selected;
+    }
+
+    public static function applyChoice(array $selected, string $choice): array
+    {
+        if ($choice === '' || ! str_contains($choice, ':')) {
+            return $selected;
+        }
+
+        [$key, $value] = explode(':', $choice, 2);
+        $key = trim($key);
+        $value = trim($value);
+
+        if (str_starts_with($key, 'attribute_') && $value !== '') {
+            $selected[$key] = $value;
+        }
+
+        return $selected;
+    }
+
+    /**
+     * @param  array<int, mixed>  $rows
+     * @param  array<int, string>  $keys
+     * @param  array<string, string>  $selected
+     * @return array<int, array<string, mixed>>
+     */
+    public static function choicesTree(array $rows, array $keys, array $selected, object $product): array
+    {
+        if ($keys === []) {
+            return [];
+        }
+
+        $key = $keys[0];
+        $rest = array_slice($keys, 1);
+        $options = self::optionsForAttribute($rows, $key, $selected, $product);
+
+        if ($rest === []) {
+            return $options;
+        }
+
+        $nextMessage = sprintf(__('Which %s?', 'datalumo'), self::attributeLabel($rest[0]));
+        $tree = [];
+
+        foreach ($options as $option) {
+            $id = (string) ($option['id'] ?? '');
+            $value = str_contains($id, ':') ? trim(explode(':', $id, 2)[1]) : '';
+
+            if ($value === '') {
+                continue;
+            }
+
+            $nested = self::choicesTree($rows, $rest, array_merge($selected, [$key => $value]), $product);
+
+            if ($nested === []) {
+                continue;
+            }
+
+            $option['message'] = $nextMessage;
+            $option['choices'] = $nested;
+            $tree[] = $option;
+        }
+
+        return $tree;
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $choices
+     */
+    public static function choicesExceedMax(array $choices): bool
+    {
+        if (count($choices) > self::MAX_CHOICES) {
+            return true;
+        }
+
+        foreach ($choices as $choice) {
+            $nested = $choice['choices'] ?? null;
+
+            if (is_array($nested) && $nested !== [] && self::choicesExceedMax($nested)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param  array<int, mixed>  $rows
+     * @param  array<string, string>  $selected
+     * @return array<int, array{id: string, label: string}>
+     */
+    public static function optionsForAttribute(array $rows, string $key, array $selected, object $product): array
+    {
+        $fromRows = [];
+        $any = false;
+
+        foreach ($rows as $row) {
+            if (! is_array($row) || ! self::isAvailableVariation($row)) {
+                continue;
+            }
+
+            if (! self::variationMatches($row, $selected)) {
+                continue;
+            }
+
+            $value = trim((string) ($row['attributes'][$key] ?? ''));
+
+            if ($value === '') {
+                $any = true;
+
+                continue;
+            }
+
+            $fromRows[$value] = self::optionLabel($value);
+        }
+
+        if ($any || $fromRows === []) {
+            foreach (self::parentAttributeOptions($product, $key) as $slug => $label) {
+                $fromRows[$slug] = $label;
+            }
+        }
+
+        $choices = [];
+
+        foreach ($fromRows as $slug => $label) {
+            $choices[] = [
+                'id' => $key.':'.$slug,
+                'label' => $label,
+            ];
+        }
+
+        return $choices;
+    }
+
+    /**
+     * @param  array<int, mixed>  $rows
+     * @param  array<string, string>  $selected
+     */
+    public static function matchVariationId(array $rows, array $selected): int
+    {
+        foreach ($rows as $row) {
+            if (! is_array($row) || ! self::isAvailableVariation($row)) {
+                continue;
+            }
+
+            if (! self::variationMatches($row, $selected)) {
+                continue;
+            }
+
+            return (int) $row['variation_id'];
+        }
+
+        return 0;
+    }
+
+    /**
+     * @param  array<string, mixed>  $row
+     * @param  array<string, string>  $selected
+     */
+    public static function variationMatches(array $row, array $selected): bool
+    {
+        $attrs = is_array($row['attributes'] ?? null) ? $row['attributes'] : [];
+
+        foreach ($selected as $key => $value) {
+            if (! is_string($key) || trim((string) $value) === '') {
+                continue;
+            }
+
+            $rowValue = trim((string) ($attrs[$key] ?? ''));
+
+            if ($rowValue !== '' && $rowValue !== trim((string) $value)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public static function attributeKey(string $name): string
+    {
+        return str_starts_with($name, 'attribute_') ? $name : 'attribute_'.$name;
+    }
+
+    public static function attributeLabel(string $key): string
+    {
+        $name = str_starts_with($key, 'attribute_') ? substr($key, 10) : $key;
+
+        if (function_exists('wc_attribute_label')) {
+            $label = wc_attribute_label($name);
+
+            if (is_string($label) && trim($label) !== '') {
+                return trim($label);
+            }
+        }
+
+        if (str_starts_with($name, 'pa_')) {
+            $name = substr($name, 3);
+        }
+
+        return self::optionLabel($name);
+    }
+
+    public static function optionLabel(string $value): string
+    {
+        return ucfirst(str_replace(['-', '_'], ' ', $value));
+    }
+
+    /**
+     * @param  array<string, mixed>  $row
+     */
+    private static function isAvailableVariation(array $row): bool
+    {
+        if ((int) ($row['variation_id'] ?? 0) <= 0) {
+            return false;
+        }
+
+        if (array_key_exists('is_in_stock', $row) && ! $row['is_in_stock']) {
+            return false;
+        }
+
+        if (array_key_exists('is_purchasable', $row) && ! $row['is_purchasable']) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private static function parentAttributeOptions(object $product, string $key): array
+    {
+        if (! method_exists($product, 'get_variation_attributes')) {
+            return [];
+        }
+
+        $attrs = $product->get_variation_attributes();
+
+        if (! is_array($attrs)) {
+            return [];
+        }
+
+        $raw = $attrs[$key] ?? $attrs[self::unprefixedAttributeKey($key)] ?? null;
+
+        if (! is_array($raw)) {
+            return [];
+        }
+
+        $options = [];
+
+        foreach ($raw as $index => $value) {
+            if (is_int($index) || (is_string($index) && ctype_digit((string) $index))) {
+                $slug = trim((string) $value);
+
+                if ($slug !== '') {
+                    $options[$slug] = self::optionLabel($slug);
+                }
+
+                continue;
+            }
+
+            $slug = trim((string) $index);
+            $label = is_scalar($value) ? trim((string) $value) : '';
+
+            if ($slug !== '') {
+                $options[$slug] = $label !== '' ? $label : self::optionLabel($slug);
+            }
+        }
+
+        return $options;
+    }
+
+    private static function unprefixedAttributeKey(string $key): string
+    {
+        return str_starts_with($key, 'attribute_') ? substr($key, 10) : $key;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function requestPayload(): array
+    {
+        // phpcs:disable WordPress.Security.NonceVerification.Missing -- verified in handle().
+        $raw = wp_unslash($_POST['payload'] ?? '');
+        // phpcs:enable WordPress.Security.NonceVerification.Missing
+
+        if (is_string($raw) && $raw !== '') {
+            $decoded = json_decode($raw, true);
+
+            if (is_array($decoded)) {
+                return $decoded;
+            }
+        }
+
+        return [];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function cartFragments(): array
+    {
+        if (! function_exists('woocommerce_mini_cart')) {
+            return [];
+        }
+
+        ob_start();
+        woocommerce_mini_cart();
+        $miniCart = (string) ob_get_clean();
+
+        $fragments = apply_filters('woocommerce_add_to_cart_fragments', [
+            'div.widget_shopping_cart_content' => '<div class="widget_shopping_cart_content">' . $miniCart . '</div>',
+        ]);
+
+        return is_array($fragments) ? $fragments : [];
+    }
+
+    private function cartErrorMessage(): string
+    {
+        if (function_exists('wc_get_notices')) {
+            $notices = wc_get_notices('error');
+
+            if (function_exists('wc_clear_notices')) {
+                wc_clear_notices();
+            }
+
+            $first = is_array($notices) ? ($notices[0]['notice'] ?? '') : '';
+
+            if (is_string($first) && $first !== '') {
+                return wp_strip_all_tags($first);
+            }
+        }
+
+        return __('Could not add that to the cart.', 'datalumo');
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @param  array<int, string>  $keys
+     */
+    private static function firstPositiveInt(array $payload, array $keys): int
+    {
+        foreach ($keys as $key) {
+            if (! array_key_exists($key, $payload)) {
+                continue;
+            }
+
+            $value = $payload[$key];
+
+            if (is_int($value) && $value > 0) {
+                return $value;
+            }
+
+            if (is_float($value) && $value > 0 && $value === floor($value)) {
+                return (int) $value;
+            }
+
+            if (is_string($value)) {
+                $value = trim($value);
+
+                if ($value !== '' && ctype_digit($value)) {
+                    return (int) $value;
+                }
+            }
+        }
+
+        return 0;
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @param  array<int, string>  $keys
+     */
+    private static function firstString(array $payload, array $keys): string
+    {
+        foreach ($keys as $key) {
+            if (! array_key_exists($key, $payload)) {
+                continue;
+            }
+
+            $value = $payload[$key];
+
+            if (is_string($value) && trim($value) !== '') {
+                return trim($value);
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, string>
+     */
+    private static function variationAttributes(array $payload): array
+    {
+        $attributes = [];
+
+        foreach ($payload as $key => $value) {
+            if (! is_string($key) || ! str_starts_with($key, 'attribute_')) {
+                continue;
+            }
+
+            if (! is_scalar($value)) {
+                continue;
+            }
+
+            $attributes[$key] = (string) $value;
+        }
+
+        return $attributes;
+    }
+}
diff --git a/src/Integration/HostNavigation.php b/src/Integration/HostNavigation.php
new file mode 100644
index 0000000..8f918b8
--- /dev/null
+++ b/src/Integration/HostNavigation.php
@@ -0,0 +1,223 @@
+<?php
+
+namespace Datalumo\Wp\Integration;
+
+use Datalumo\Wp\Support\Assets;
+
+/**
+ * Listens for Datalumo host actions that open a page: the cart, checkout,
+ * or a WordPress post.
+ */
+class HostNavigation
+{
+    public const AJAX_ACTION = 'datalumo_host_navigation';
+
+    public const NONCE = 'datalumo_host_navigation';
+
+    public const EVENTS = ['view_cart', 'open_checkout', 'open_page'];
+
+    public function register(): void
+    {
+        add_action('wp_enqueue_scripts', [$this, 'enqueue']);
+        add_action('wp_ajax_' . self::AJAX_ACTION, [$this, 'handle']);
+        add_action('wp_ajax_nopriv_' . self::AJAX_ACTION, [$this, 'handle']);
+    }
+
+    public function enqueue(): void
+    {
+        wp_enqueue_script(
+            'datalumo-host-navigation',
+            DATALUMO_URL . 'resources/js/host-navigation.js',
+            [],
+            Assets::version(),
+            ['in_footer' => true],
+        );
+
+        wp_localize_script('datalumo-host-navigation', 'datalumoHostNavigation', [
+            'ajaxUrl' => admin_url('admin-ajax.php'),
+            'nonce' => wp_create_nonce(self::NONCE),
+            'events' => self::EVENTS,
+            'cartUrl' => $this->cartUrl(),
+            'checkoutUrl' => $this->checkoutUrl(),
+            'homeHost' => $this->homeHost(),
+            'i18n' => [
+                'failed' => __('Could not open that page.', 'datalumo'),
+                'no_page' => __('No page was specified.', 'datalumo'),
+                'no_cart' => __('The cart is not available.', 'datalumo'),
+                'no_checkout' => __('Checkout is not available.', 'datalumo'),
+            ],
+        ]);
+    }
+
+    public function handle(): void
+    {
+        check_ajax_referer(self::NONCE);
+
+        $payload = $this->requestPayload();
+        $event = sanitize_key((string) ($payload['event'] ?? ''));
+
+        if ($event !== 'open_page') {
+            wp_send_json_error(['message' => __('Unknown action.', 'datalumo')], 400);
+        }
+
+        $url = $this->resolveUrl($event, $payload);
+
+        if ($url === null) {
+            wp_send_json_error(['message' => __('No page was specified.', 'datalumo')], 422);
+        }
+
+        wp_send_json_success(['url' => $url]);
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public function resolveUrl(string $event, array $payload): ?string
+    {
+        if ($event === 'view_cart') {
+            return $this->cartUrl() ?: null;
+        }
+
+        if ($event === 'open_checkout') {
+            return $this->checkoutUrl() ?: null;
+        }
+
+        if ($event === 'open_page') {
+            return $this->publishedUrlFromPayload($payload);
+        }
+
+        return null;
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public function publishedUrlFromPayload(array $payload): ?string
+    {
+        $url = trim((string) ($payload['url'] ?? ''));
+
+        if ($url !== '' && $this->isSameSiteUrl($url)) {
+            return $url;
+        }
+
+        $id = $this->positiveId(
+            $payload['page_id'] ?? $payload['id'] ?? $payload['external_id'] ?? null,
+        );
+
+        if ($id !== null) {
+            $permalink = $this->publishedPermalink($id);
+
+            if ($permalink !== null) {
+                return $permalink;
+            }
+        }
+
+        $slug = trim((string) ($payload['slug'] ?? ''));
+
+        if ($slug !== '' && function_exists('get_page_by_path')) {
+            $page = get_page_by_path($slug);
+
+            if (is_object($page) && isset($page->ID)) {
+                return $this->publishedPermalink((int) $page->ID);
+            }
+        }
+
+        return null;
+    }
+
+    public function isSameSiteUrl(string $url): bool
+    {
+        $parts = parse_url($url);
+
+        if (! is_array($parts) || ! isset($parts['scheme'], $parts['host'])) {
+            return false;
+        }
+
+        if (! in_array(strtolower((string) $parts['scheme']), ['http', 'https'], true)) {
+            return false;
+        }
+
+        $host = strtolower((string) $parts['host']);
+        $home = $this->homeHost();
+
+        if ($home === '' || $host === '') {
+            return false;
+        }
+
+        return $host === $home || $host === 'www.' . $home || 'www.' . $host === $home;
+    }
+
+    public function cartUrl(): string
+    {
+        if (! function_exists('wc_get_cart_url')) {
+            return '';
+        }
+
+        $url = (string) wc_get_cart_url();
+
+        return $this->isSameSiteUrl($url) ? $url : '';
+    }
+
+    public function checkoutUrl(): string
+    {
+        if (! function_exists('wc_get_checkout_url')) {
+            return '';
+        }
+
+        $url = (string) wc_get_checkout_url();
+
+        return $this->isSameSiteUrl($url) ? $url : '';
+    }
+
+    private function homeHost(): string
+    {
+        $home = function_exists('home_url') ? home_url('/') : '';
+        $host = parse_url($home, PHP_URL_HOST);
+
+        return is_string($host) ? strtolower($host) : '';
+    }
+
+    private function publishedPermalink(int $id): ?string
+    {
+        if ($id <= 0 || ! function_exists('get_post') || ! function_exists('get_permalink')) {
+            return null;
+        }
+
+        $post = get_post($id);
+
+        if (! is_object($post) || ($post->post_status ?? '') !== 'publish') {
+            return null;
+        }
+
+        $permalink = (string) get_permalink($post);
+
+        return $this->isSameSiteUrl($permalink) ? $permalink : null;
+    }
+
+    private function positiveId(mixed $value): ?int
+    {
+        if (is_int($value) || is_float($value) || (is_string($value) && is_numeric($value))) {
+            $id = (int) $value;
+
+            return $id > 0 ? $id : null;
+        }
+
+        return null;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function requestPayload(): array
+    {
+        $raw = isset($_POST['payload']) ? wp_unslash($_POST['payload']) : '';
+
+        if (! is_string($raw) || $raw === '') {
+            return [];
+        }
+
+        $decoded = json_decode($raw, true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+}
diff --git a/src/Integration/WooCommerce.php b/src/Integration/WooCommerce.php
index 1894c68..930b18c 100644
--- a/src/Integration/WooCommerce.php
+++ b/src/Integration/WooCommerce.php
@@ -2,12 +2,14 @@
 
 namespace Datalumo\Wp\Integration;
 
+use WP_Post;
 use WP_Query;
 
 /**
  * WooCommerce search behaviour on the interceptor's hooks: catalog sorts,
- * hidden-product exclusion, and the price-filter widget. Registered only
- * when WooCommerce is active.
+ * hidden-product exclusion, and the price-filter widget. Also registers
+ * add-to-cart for Datalumo host actions. Registered only when WooCommerce
+ * is active.
  */
 class WooCommerce
 {
@@ -20,6 +22,272 @@ public function register(): void
     {
         add_filter('datalumo_sort_map', [$this, 'sortMap']);
         add_filter('datalumo_resolve_args', [$this, 'resolveArgs'], 10, 2);
+        add_filter('datalumo_page_payload', [$this, 'enrichProduct'], 10, 2);
+
+        (new AddToCart())->register();
+    }
+
+    /**
+     * Default product fields for search and chat: short description,
+     * product categories/tags, visible attributes, and SKU (including
+     * variation SKUs). A mapping that already set sku is left alone.
+     *
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    public function enrichProduct(array $payload, WP_Post $post): array
+    {
+        if (! in_array($post->post_type, ['product', 'product_variation'], true)
+            || ! function_exists('wc_get_product')) {
+            return $payload;
+        }
+
+        $product = wc_get_product($post->ID);
+
+        if (! $product) {
+            return $payload;
+        }
+
+        $payload = $this->attachShortDescription($payload, $product);
+        $payload = $this->attachTaxonomies($payload, $post);
+        $payload = $this->attachAttributes($payload, $product);
+
+        return $this->attachSku($payload, $product);
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function attachShortDescription(array $payload, object $product): array
+    {
+        if (! method_exists($product, 'get_short_description')) {
+            return $payload;
+        }
+
+        $short = trim(wp_strip_all_tags((string) $product->get_short_description()));
+
+        if ($short === '') {
+            return $payload;
+        }
+
+        $html = '<p>'.esc_html($short).'</p>';
+        $content = trim((string) ($payload['content'] ?? ''));
+
+        if ($content === '') {
+            $payload['content'] = $html;
+        } elseif (! str_contains($content, $short)) {
+            $payload['content'] = $html."\n\n".$content;
+        }
+
+        return $payload;
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function attachTaxonomies(array $payload, WP_Post $post): array
+    {
+        $categoryNames = $this->termField($post->ID, 'product_cat', 'name');
+        $categorySlugs = $this->termField($post->ID, 'product_cat', 'slug');
+        $tagNames = $this->termField($post->ID, 'product_tag', 'name');
+        $tagSlugs = $this->termField($post->ID, 'product_tag', 'slug');
+        $meta = is_array($payload['meta'] ?? null) ? $payload['meta'] : [];
+        $lines = [];
+
+        if ($categorySlugs !== []) {
+            $meta['categories'] = $categorySlugs;
+            $lines[] = 'category: '.implode(', ', $categoryNames !== [] ? $categoryNames : $categorySlugs);
+        }
+
+        if ($tagSlugs !== []) {
+            $meta['tags'] = $tagSlugs;
+            $lines[] = 'tag: '.implode(', ', $tagNames !== [] ? $tagNames : $tagSlugs);
+        }
+
+        $payload['meta'] = $meta;
+
+        return $this->appendSearchableLines($payload, $lines);
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function attachAttributes(array $payload, object $product): array
+    {
+        if (! method_exists($product, 'get_attributes')) {
+            return $payload;
+        }
+
+        $attributes = [];
+        $lines = [];
+
+        foreach ($product->get_attributes() as $attribute) {
+            if (! is_object($attribute)) {
+                continue;
+            }
+
+            if (method_exists($attribute, 'get_visible') && ! $attribute->get_visible()) {
+                continue;
+            }
+
+            $label = $this->attributeLabel($attribute);
+            $values = $this->attributeValues($product, $attribute);
+
+            if ($label === '' || $values === []) {
+                continue;
+            }
+
+            $attributes[$label] = $values;
+            $lines[] = $label.': '.implode(', ', $values);
+        }
+
+        if ($attributes === []) {
+            return $payload;
+        }
+
+        $meta = is_array($payload['meta'] ?? null) ? $payload['meta'] : [];
+
+        if (! isset($meta['attributes'])) {
+            $meta['attributes'] = $attributes;
+            $payload['meta'] = $meta;
+        }
+
+        return $this->appendSearchableLines($payload, $lines);
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function attachSku(array $payload, object $product): array
+    {
+        $skus = $this->productSkus($product);
+
+        if ($skus === []) {
+            return $payload;
+        }
+
+        $meta = is_array($payload['meta'] ?? null) ? $payload['meta'] : [];
+
+        if (isset($meta['sku']) && $meta['sku'] !== '' && $meta['sku'] !== []) {
+            return $payload;
+        }
+
+        $meta['sku'] = count($skus) === 1 ? $skus[0] : $skus;
+        $payload['meta'] = $meta;
+
+        return $this->appendSearchableLines($payload, ['sku: '.implode(', ', $skus)]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function productSkus(object $product): array
+    {
+        $skus = [];
+        $own = trim((string) $product->get_sku());
+
+        if ($own !== '') {
+            $skus[] = $own;
+        }
+
+        if (method_exists($product, 'is_type') && $product->is_type('variable') && method_exists($product, 'get_children')) {
+            foreach ($product->get_children() as $childId) {
+                $child = wc_get_product((int) $childId);
+
+                if (! $child) {
+                    continue;
+                }
+
+                $sku = trim((string) $child->get_sku());
+
+                if ($sku !== '') {
+                    $skus[] = $sku;
+                }
+            }
+        }
+
+        return array_values(array_unique($skus));
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function termField(int $postId, string $taxonomy, string $field): array
+    {
+        $terms = get_the_terms($postId, $taxonomy);
+
+        if (! is_array($terms)) {
+            return [];
+        }
+
+        $values = [];
+
+        foreach ($terms as $term) {
+            $value = trim((string) (is_object($term) ? ($term->{$field} ?? '') : ''));
+
+            if ($value !== '') {
+                $values[] = $value;
+            }
+        }
+
+        return array_values(array_unique($values));
+    }
+
+    private function attributeLabel(object $attribute): string
+    {
+        $name = method_exists($attribute, 'get_name') ? (string) $attribute->get_name() : '';
+
+        if (function_exists('wc_attribute_label') && $name !== '') {
+            $label = trim((string) wc_attribute_label($name));
+
+            if ($label !== '') {
+                return $label;
+            }
+        }
+
+        return $name;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function attributeValues(object $product, object $attribute): array
+    {
+        if (method_exists($attribute, 'is_taxonomy') && $attribute->is_taxonomy()
+            && method_exists($attribute, 'get_name')
+            && function_exists('wc_get_product_terms')) {
+            $id = method_exists($product, 'get_id') ? (int) $product->get_id() : 0;
+            $terms = wc_get_product_terms($id, $attribute->get_name(), ['fields' => 'names']);
+
+            return is_array($terms)
+                ? array_values(array_filter(array_map(strval(...), $terms)))
+                : [];
+        }
+
+        $options = method_exists($attribute, 'get_options') ? $attribute->get_options() : [];
+
+        return array_values(array_filter(array_map(strval(...), (array) $options)));
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @param  array<int, string>  $lines
+     * @return array<string, mixed>
+     */
+    private function appendSearchableLines(array $payload, array $lines): array
+    {
+        if ($lines === []) {
+            return $payload;
+        }
+
+        $payload['content'] = rtrim((string) ($payload['content'] ?? ''))
+            ."\n\n<p>".esc_html(implode("\n", $lines)).'</p>';
+
+        return $payload;
     }
 
     /**
@@ -90,8 +358,13 @@ private function excludeHidden(array $args): array
      */
     private function applyPriceFilter(array $args): array
     {
-        $min = isset($_GET['min_price']) && is_numeric($_GET['min_price']) ? (float) $_GET['min_price'] : null;
-        $max = isset($_GET['max_price']) && is_numeric($_GET['max_price']) ? (float) $_GET['max_price'] : null;
+        // phpcs:disable WordPress.Security.NonceVerification.Recommended -- public WooCommerce price-filter query args.
+        $minRaw = isset($_GET['min_price']) ? sanitize_text_field(wp_unslash($_GET['min_price'])) : '';
+        $maxRaw = isset($_GET['max_price']) ? sanitize_text_field(wp_unslash($_GET['max_price'])) : '';
+        // phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+        $min = $minRaw !== '' && is_numeric($minRaw) ? (float) $minRaw : null;
+        $max = $maxRaw !== '' && is_numeric($maxRaw) ? (float) $maxRaw : null;
 
         if ($min === null && $max === null) {
             return $args;
@@ -106,6 +379,7 @@ private function applyPriceFilter(array $args): array
         }
 
         $existing = $args['meta_query'] ?? [];
+        // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- WooCommerce price filter on the result pool.
         $args['meta_query'] = $existing ? ['relation' => 'AND', $existing, $clause] : [$clause];
 
         return $args;
diff --git a/src/Integration/index.php b/src/Integration/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Integration/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Plugin.php b/src/Plugin.php
index 16fab40..c3adc3a 100644
--- a/src/Plugin.php
+++ b/src/Plugin.php
@@ -4,11 +4,12 @@
 
 use Datalumo\Wp\Admin\Ajax;
 use Datalumo\Wp\Admin\SettingsPage;
+use Datalumo\Wp\Connect\Grant;
 use Datalumo\Wp\Embed\Embed;
 use Datalumo\Wp\Search\ClickTracking;
 use Datalumo\Wp\Search\Interceptor;
 use Datalumo\Wp\Search\Summary;
-use Datalumo\Wp\Support\UpdateChecker;
+use Datalumo\Wp\Support\Assets;
 use Datalumo\Wp\Sync\BulkSync;
 use Datalumo\Wp\Sync\ContentSync;
 
@@ -31,12 +32,7 @@ public function boot(): void
 
         $this->booted = true;
 
-        // Outside admin-only hooks so WP-CLI and management tools see updates too.
-        UpdateChecker::register();
-
         add_action('plugins_loaded', function (): void {
-            load_plugin_textdomain('datalumo', false, dirname(plugin_basename(DATALUMO_FILE)) . '/languages');
-
             // Deferred — WooCommerce may load after us.
             if (Integration\WooCommerce::isActive()) {
                 (new Integration\WooCommerce())->register();
@@ -46,6 +42,7 @@ public function boot(): void
         if (is_admin()) {
             (new SettingsPage())->register();
             (new Ajax())->register();
+            Grant::register();
         }
 
         (new ContentSync())->register();
@@ -54,30 +51,61 @@ public function boot(): void
         (new Summary())->register();
         (new ClickTracking())->register();
         (new Embed())->register();
+        (new Integration\HostNavigation())->register();
 
+        add_action('admin_enqueue_scripts', [$this, 'enqueueSetupNotice']);
         add_action('admin_notices', [$this, 'configurationNotice']);
     }
 
-    public function configurationNotice(): void
+    public function enqueueSetupNotice(string $hook): void
     {
-        if (! current_user_can('manage_options') || Support\Options::get('api_token')) {
+        if ($hook !== 'index.php' || ! $this->shouldShowSetupNotice()) {
             return;
         }
 
-        $screen = function_exists('get_current_screen') ? get_current_screen() : null;
+        wp_enqueue_script(
+            'datalumo-setup-notice',
+            DATALUMO_URL . 'resources/js/setup-notice.js',
+            [],
+            Assets::version(),
+            ['in_footer' => true],
+        );
 
-        if ($screen !== null && $screen->id === 'settings_page_datalumo') {
+        wp_localize_script('datalumo-setup-notice', 'datalumoSetupNotice', [
+            'ajaxUrl' => admin_url('admin-ajax.php'),
+            'nonce' => wp_create_nonce(Ajax::NONCE),
+        ]);
+    }
+
+    public function configurationNotice(): void
+    {
+        if (! $this->shouldShowSetupNotice()) {
             return;
         }
 
         printf(
-            '<div class="notice notice-info"><p>%s <a href="%s">%s</a></p></div>',
+            '<div class="notice notice-info is-dismissible datalumo-setup-notice"><p>%s <a href="%s">%s</a></p></div>',
             esc_html__('Datalumo is almost ready — connect your account to start syncing content.', 'datalumo'),
             esc_url(admin_url('options-general.php?page=datalumo')),
             esc_html__('Open settings', 'datalumo'),
         );
     }
 
+    private function shouldShowSetupNotice(): bool
+    {
+        if (! is_admin() || ! current_user_can('manage_options') || Support\Options::get('api_token')) {
+            return false;
+        }
+
+        if (get_user_meta(get_current_user_id(), 'datalumo_hide_setup_notice', true)) {
+            return false;
+        }
+
+        $screen = function_exists('get_current_screen') ? get_current_screen() : null;
+
+        return $screen !== null && $screen->id === 'dashboard';
+    }
+
     public static function deactivate(): void
     {
         if (! function_exists('as_unschedule_all_actions')) {
diff --git a/src/Search/ClickTracking.php b/src/Search/ClickTracking.php
index a7949da..a8129eb 100644
--- a/src/Search/ClickTracking.php
+++ b/src/Search/ClickTracking.php
@@ -3,6 +3,7 @@
 namespace Datalumo\Wp\Search;
 
 use Datalumo\Wp\Embed\Embed;
+use Datalumo\Wp\Support\Assets;
 use Datalumo\Wp\Support\Options;
 
 /**
@@ -51,7 +52,7 @@ public function enqueue(): void
             'datalumo-clicks',
             DATALUMO_URL . 'resources/js/click-tracking.js',
             [Embed::SCRIPT_HANDLE],
-            DATALUMO_VERSION,
+            Assets::version(),
             ['in_footer' => true],
         );
 
diff --git a/src/Search/Interceptor.php b/src/Search/Interceptor.php
index 7500ba9..1967616 100644
--- a/src/Search/Interceptor.php
+++ b/src/Search/Interceptor.php
@@ -58,9 +58,7 @@ public function intercept(?array $posts, WP_Query $query): ?array
                 (string) $query->get('s'),
                 min(self::MAX_RESULTS, (int) apply_filters('datalumo_search_max_results', self::MAX_RESULTS)),
             );
-        } catch (ApiException $e) {
-            error_log(sprintf('[Datalumo] search failed (%d): %s — falling back to native.', $e->status, $e->getMessage()));
-
+        } catch (ApiException) {
             return null;
         }
 
@@ -126,16 +124,17 @@ private function resolvePool(array $ids, WP_Query $query): array
             'post_status' => 'publish',
             'posts_per_page' => count($ids),
             'ignore_sticky_posts' => true,
-            'suppress_filters' => true,
         ];
 
         $metaQuery = $query->get('meta_query');
 
         if (is_array($metaQuery) && $metaQuery !== []) {
+            // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- copied from the main search query.
             $args['meta_query'] = $metaQuery;
         }
 
         if (! empty($query->tax_query->queries)) {
+            // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- copied from the main search query.
             $args['tax_query'] = $query->tax_query->queries;
         }
 
@@ -144,8 +143,8 @@ private function resolvePool(array $ids, WP_Query $query): array
         $posts = get_posts($args);
 
         // orderby => post__in isn't reliable: other plugins (Woo catalog
-        // ordering) hook pre_get_posts and reset the order, which
-        // suppress_filters doesn't prevent — so enforce the ranking in PHP.
+        // ordering) hook pre_get_posts and reset the order, so enforce
+        // the ranking in PHP.
         $rank = array_flip(array_values($ids));
 
         usort($posts, fn ($a, $b) => ($rank[$a->ID] ?? PHP_INT_MAX) <=> ($rank[$b->ID] ?? PHP_INT_MAX));
@@ -162,6 +161,7 @@ private function resolvePool(array $ids, WP_Query $query): array
      */
     private function reorder(array $pool, WP_Query $query): array
     {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- public search sort query arg.
         $orderby = isset($_GET['orderby']) ? sanitize_key((string) wp_unslash($_GET['orderby'])) : '';
 
         if ($orderby === '' || $orderby === 'relevance' || $pool === []) {
diff --git a/src/Search/Summary.php b/src/Search/Summary.php
index dc61f70..7aac9a3 100644
--- a/src/Search/Summary.php
+++ b/src/Search/Summary.php
@@ -3,6 +3,7 @@
 namespace Datalumo\Wp\Search;
 
 use Datalumo\Wp\Embed\Embed;
+use Datalumo\Wp\Support\Assets;
 use Datalumo\Wp\Support\Options;
 
 /**
@@ -50,14 +51,14 @@ public function enqueue(): void
             'datalumo-summary',
             DATALUMO_URL . 'resources/css/summary.css',
             [],
-            DATALUMO_VERSION,
+            Assets::version(),
         );
 
         wp_enqueue_script(
             'datalumo-summary',
             DATALUMO_URL . 'resources/js/summary.js',
             [Embed::SCRIPT_HANDLE],
-            DATALUMO_VERSION,
+            Assets::version(),
             ['in_footer' => true],
         );
 
diff --git a/src/Search/index.php b/src/Search/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Search/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Support/Assets.php b/src/Support/Assets.php
new file mode 100644
index 0000000..abb00fe
--- /dev/null
+++ b/src/Support/Assets.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace Datalumo\Wp\Support;
+
+class Assets
+{
+    public static function version(): string
+    {
+        $environment = defined('WP_ENVIRONMENT_TYPE')
+            ? (string) WP_ENVIRONMENT_TYPE
+            : (string) getenv('WP_ENVIRONMENT_TYPE');
+
+        if ($environment === 'local') {
+            return (string) time();
+        }
+
+        return DATALUMO_VERSION;
+    }
+}
diff --git a/src/Support/Credentials.php b/src/Support/Credentials.php
new file mode 100644
index 0000000..c2652c0
--- /dev/null
+++ b/src/Support/Credentials.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Datalumo\Wp\Support;
+
+class Credentials
+{
+    public static function looksLikeWidgetKey(string $value): bool
+    {
+        $value = trim($value);
+
+        if ($value === '' || str_starts_with($value, 'dl_')) {
+            return false;
+        }
+
+        $parts = explode('/', $value, 2);
+
+        return count($parts) === 2 && $parts[0] !== '' && $parts[1] !== '';
+    }
+
+    public static function looksLikeSecret(string $value): bool
+    {
+        return str_starts_with(trim($value), 'dl_');
+    }
+}
diff --git a/src/Support/UpdateChecker.php b/src/Support/UpdateChecker.php
deleted file mode 100644
index d2d4a76..0000000
--- a/src/Support/UpdateChecker.php
+++ /dev/null
@@ -1,34 +0,0 @@
-<?php
-
-namespace Datalumo\Wp\Support;
-
-use YahnisElsts\PluginUpdateChecker\v5\PucFactory;
-
-/**
- * Pulls updates from the public GitHub repo via Plugin Update Checker.
- *
- * To release, create a GitHub release. Prefer attaching a zip asset that
- * includes vendor/ so Composer deps ship with the update; without one, PUC
- * falls back to GitHub's source archive.
- */
-class UpdateChecker
-{
-    public static function register(): void
-    {
-        if (! class_exists(PucFactory::class)) {
-            return;
-        }
-
-        $checker = PucFactory::buildUpdateChecker(
-            'https://github.com/datalumo/wordpress/',
-            DATALUMO_FILE,
-            'datalumo',
-        );
-
-        $api = $checker->getVcsApi();
-
-        if ($api !== null && method_exists($api, 'enableReleaseAssets')) {
-            $api->enableReleaseAssets('/\.zip($|[?&#])/i');
-        }
-    }
-}
diff --git a/src/Support/index.php b/src/Support/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Support/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/Sync/BulkSync.php b/src/Sync/BulkSync.php
index f58962f..8c2e79a 100644
--- a/src/Sync/BulkSync.php
+++ b/src/Sync/BulkSync.php
@@ -117,8 +117,7 @@ public function processBatch(string $syncId, int $offset, string $run = ''): voi
             if ($this->isCurrentRun($syncId, $run)) {
                 try {
                     $this->client()->indexSource($sync['source_id']);
-                } catch (ApiException $e) {
-                    error_log(sprintf('[Datalumo] index kick for %s failed (%d): %s', $sync['source_id'], $e->status, $e->getMessage()));
+                } catch (ApiException) {
                 }
             }
 
@@ -142,8 +141,6 @@ public function processBatch(string $syncId, int $offset, string $run = ''): voi
                 $this->client()->pushBatch($sync['source_id'], $pages);
             }
         } catch (ApiException $e) {
-            error_log(sprintf('[Datalumo] bulk batch at %d failed (%d): %s', $offset, $e->status, $e->getMessage()));
-
             $this->handleBatchError($syncId, $run, $offset, $e);
 
             return;
diff --git a/src/Sync/ContentSync.php b/src/Sync/ContentSync.php
index 6e4269a..830dd4f 100644
--- a/src/Sync/ContentSync.php
+++ b/src/Sync/ContentSync.php
@@ -130,8 +130,6 @@ private function schedule(string $hook, array $args): void
 
     private function retryLater(string $hook, array $args, ApiException $e): void
     {
-        error_log(sprintf('[Datalumo] %s failed (%d): %s', $hook, $e->status, $e->getMessage()));
-
         // Auth failures and a full plan won't heal on retry — don't reschedule.
         if ($e->isAuthentication() || $e->isQuota() || ! function_exists('as_schedule_single_action')) {
             return;
diff --git a/src/Sync/PagePreparer.php b/src/Sync/PagePreparer.php
index 40a0e90..b42e30d 100644
--- a/src/Sync/PagePreparer.php
+++ b/src/Sync/PagePreparer.php
@@ -22,10 +22,6 @@ public function prepare(WP_Post $post, array $metaMappings = []): ?array
 
         $content = $this->cleanContent($post);
 
-        if ($content === '') {
-            return null;
-        }
-
         $meta = [
             'post_type' => $post->post_type,
             'categories' => $this->termSlugs($post->ID, 'category'),
@@ -70,7 +66,18 @@ public function prepare(WP_Post $post, array $metaMappings = []): ?array
             'meta' => array_filter($meta, fn ($value) => $value !== null && $value !== '' && $value !== []),
         ];
 
-        return apply_filters('datalumo_page_payload', $payload, $post);
+        $payload = apply_filters('datalumo_page_payload', $payload, $post);
+
+        if (! is_array($payload)) {
+            return null;
+        }
+
+        // WooCommerce may fill an empty body (short description, SKU, attributes).
+        if (trim(wp_strip_all_tags((string) ($payload['content'] ?? ''))) === '') {
+            return null;
+        }
+
+        return $payload;
     }
 
     /**
@@ -80,17 +87,45 @@ public function prepare(WP_Post $post, array $metaMappings = []): ?array
      */
     private function cleanContent(WP_Post $post): string
     {
+        $this->ensureWooCommerceNotices();
+
         $raw = (string) $post->post_content;
 
         $raw = apply_filters('datalumo_render_shortcodes', false)
             ? do_shortcode($raw)
             : strip_shortcodes($raw);
 
-        $html = wp_filter_content_tags(wptexturize(do_blocks(wpautop($raw))));
+        $raw = wpautop($raw);
+
+        try {
+            $html = wp_filter_content_tags(wptexturize(do_blocks($raw)));
+        } catch (\Throwable) {
+            // WooCommerce Blocks (cart, checkout) call frontend helpers that
+            // are not loaded under WP-Cron. Keep the rest of the batch going.
+            $html = wp_filter_content_tags(wptexturize($raw));
+        }
 
         return trim(wp_strip_all_tags($html) === '' ? '' : $html);
     }
 
+    /**
+     * WooCommerce only loads notice helpers on the storefront. Action
+     * Scheduler still runs do_blocks(), and Hydration::cache_store_notices()
+     * fatals if wc_get_notices() is missing.
+     */
+    private function ensureWooCommerceNotices(): void
+    {
+        if (function_exists('wc_get_notices') || ! defined('WC_ABSPATH')) {
+            return;
+        }
+
+        $file = WC_ABSPATH.'includes/wc-notice-functions.php';
+
+        if (is_readable($file)) {
+            require_once $file;
+        }
+    }
+
     /**
      * @return array<int, string>
      */
diff --git a/src/Sync/index.php b/src/Sync/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/Sync/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/src/index.php b/src/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/src/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/tests/Unit/AddToCartTest.php b/tests/Unit/AddToCartTest.php
new file mode 100644
index 0000000..2759ee7
--- /dev/null
+++ b/tests/Unit/AddToCartTest.php
@@ -0,0 +1,466 @@
+<?php
+
+use Brain\Monkey\Actions;
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Integration\AddToCart;
+use Datalumo\Wp\Integration\WooCommerce;
+
+if (! defined('DATALUMO_URL')) {
+    define('DATALUMO_URL', 'https://example.com/wp-content/plugins/datalumo/');
+}
+
+if (! defined('DATALUMO_VERSION')) {
+    define('DATALUMO_VERSION', '0.0.8');
+}
+
+it('registers the ajax handlers and script hook', function () {
+    (new AddToCart())->register();
+
+    expect(Actions\has('wp_enqueue_scripts'))->not->toBeFalse()
+        ->and(Actions\has('wp_ajax_datalumo_add_to_cart'))->not->toBeFalse()
+        ->and(Actions\has('wp_ajax_nopriv_datalumo_add_to_cart'))->not->toBeFalse();
+});
+
+it('registers add-to-cart when the WooCommerce integration boots', function () {
+    (new WooCommerce())->register();
+
+    expect(Actions\has('wp_ajax_datalumo_add_to_cart'))->not->toBeFalse()
+        ->and(Actions\has('wp_ajax_nopriv_datalumo_add_to_cart'))->not->toBeFalse();
+});
+
+it('localises the frontend script with the event name and nonce', function () {
+    Functions\when('apply_filters')->returnArg(2);
+    Functions\when('is_product')->justReturn(false);
+    Functions\when('admin_url')->justReturn('https://example.com/wp-admin/admin-ajax.php');
+    Functions\when('wp_create_nonce')->justReturn('test-nonce');
+    Functions\when('wp_enqueue_script')->justReturn(true);
+
+    $localised = null;
+    Functions\when('wp_localize_script')->alias(function ($handle, $name, $data) use (&$localised) {
+        $localised = ['handle' => $handle, 'name' => $name, 'data' => $data];
+
+        return true;
+    });
+
+    (new AddToCart())->enqueue();
+
+    expect($localised['handle'])->toBe('datalumo-add-to-cart')
+        ->and($localised['name'])->toBe('datalumoAddToCart')
+        ->and($localised['data']['event'])->toBe('add_to_cart')
+        ->and($localised['data']['nonce'])->toBe('test-nonce')
+        ->and($localised['data']['productId'])->toBe(0)
+        ->and($localised['data']['ajaxUrl'])->toBe('https://example.com/wp-admin/admin-ajax.php');
+});
+
+it('localises the current product id on a product page', function () {
+    Functions\when('apply_filters')->returnArg(2);
+    Functions\when('is_product')->justReturn(true);
+    Functions\when('get_the_ID')->justReturn(1842);
+    Functions\when('admin_url')->justReturn('https://example.com/wp-admin/admin-ajax.php');
+    Functions\when('wp_create_nonce')->justReturn('test-nonce');
+    Functions\when('wp_enqueue_script')->justReturn(true);
+
+    $localised = null;
+    Functions\when('wp_localize_script')->alias(function ($handle, $name, $data) use (&$localised) {
+        $localised = $data;
+
+        return true;
+    });
+
+    (new AddToCart())->enqueue();
+
+    expect($localised['productId'])->toBe(1842);
+});
+
+it('reads product_id aliases and defaults quantity to 1', function (array $payload, array $expected) {
+    expect(AddToCart::resolvePayload($payload))->toMatchArray($expected);
+})->with([
+    'product_id string' => [
+        ['product_id' => '1842'],
+        ['product_id' => 1842, 'quantity' => 1, 'variation_id' => 0, 'sku' => ''],
+    ],
+    'external_id' => [
+        ['external_id' => '99', 'qty' => '3'],
+        ['product_id' => 99, 'quantity' => 3, 'variation_id' => 0, 'sku' => ''],
+    ],
+    'id + sku + variation' => [
+        ['id' => 12, 'sku' => 'MUG-BLU', 'variation_id' => 44, 'quantity' => 2],
+        ['product_id' => 12, 'quantity' => 2, 'variation_id' => 44, 'sku' => 'MUG-BLU'],
+    ],
+    'choice is the variation id' => [
+        ['product_id' => 1842, 'choice' => '99'],
+        ['product_id' => 1842, 'quantity' => 1, 'variation_id' => 99, 'sku' => ''],
+    ],
+    'encoded attribute choice is not a variation id' => [
+        ['product_id' => 1842, 'choice' => 'attribute_pa_color:blue'],
+        ['product_id' => 1842, 'quantity' => 1, 'variation_id' => 0, 'sku' => ''],
+    ],
+    'choice path is not a variation id' => [
+        ['product_id' => 1842, 'choice' => ['attribute_pa_color:blue', 'attribute_pa_size:small']],
+        ['product_id' => 1842, 'quantity' => 1, 'variation_id' => 0, 'sku' => ''],
+    ],
+    'caps quantity' => [
+        ['product_id' => 1, 'quantity' => 500],
+        ['product_id' => 1, 'quantity' => 99],
+    ],
+    'ignores non-numeric id' => [
+        ['id' => 'abc', 'sku' => 'SKU-1'],
+        ['product_id' => 0, 'sku' => 'SKU-1'],
+    ],
+]);
+
+it('collects variation attributes from the payload', function () {
+    $resolved = AddToCart::resolvePayload([
+        'product_id' => 10,
+        'attribute_pa_color' => 'blue',
+        'label' => 'ignored',
+    ]);
+
+    expect($resolved['variation'])->toBe(['attribute_pa_color' => 'blue']);
+});
+
+it('fails when no product id or sku can be resolved', function () {
+    Functions\when('apply_filters')->returnArg(2);
+
+    expect((new AddToCart())->addFromPayload(['label' => 'mug']))
+        ->toMatchArray(['ok' => false, 'message' => 'No product was specified.']);
+});
+
+it('resolves the product from the page url when the payload has no id', function () {
+    Functions\when('apply_filters')->returnArg(2);
+    Functions\when('url_to_postid')->justReturn(1842);
+    Functions\when('wc_get_product')->alias(fn ($id) => (int) $id === 1842 ? purchasableProduct() : null);
+    stubCart(fn () => 'item-key');
+
+    $result = (new AddToCart())->addFromPayload([
+        'page_url' => 'https://store.test/product/v-neck-t-shirt',
+    ]);
+
+    expect($result['ok'])->toBeTrue()
+        ->and($result['message'])->toBe('Blue mug added to your cart.');
+});
+
+it('resolves a sku when product_id is missing', function () {
+    Functions\when('apply_filters')->returnArg(2);
+    Functions\when('wc_get_product_id_by_sku')->justReturn(77);
+    Functions\when('wc_get_product')->alias(fn ($id) => (int) $id === 77 ? purchasableProduct() : null);
+    stubCart(fn () => 'item-key');
+
+    $result = (new AddToCart())->addFromPayload(['sku' => 'MUG-BLU']);
+
+    expect($result['ok'])->toBeTrue()
+        ->and($result['message'])->toBe('Blue mug added to your cart.');
+});
+
+it('rejects a missing product', function () {
+    Functions\when('wc_get_product')->justReturn(false);
+    Functions\when('WC')->justReturn((object) ['cart' => (object) []]);
+
+    expect((new AddToCart())->add(1842, 1))
+        ->toMatchArray(['ok' => false, 'message' => 'That product could not be found.']);
+});
+
+it('rejects a variable product without a variation', function () {
+    Functions\when('wc_get_product')->justReturn(purchasableProduct(variable: true));
+    Functions\when('WC')->justReturn((object) ['cart' => (object) []]);
+
+    expect((new AddToCart())->add(1842, 1))
+        ->toMatchArray(['ok' => false, 'message' => 'This product needs a variation.']);
+});
+
+it('asks for colour then size then adds the matching variation', function () {
+    $parent = purchasableProduct(
+        variable: true,
+        variations: [
+            [
+                'variation_id' => 11,
+                'attributes' => ['attribute_pa_color' => 'blue', 'attribute_pa_size' => 'small'],
+                'is_in_stock' => true,
+                'is_purchasable' => true,
+            ],
+            [
+                'variation_id' => 12,
+                'attributes' => ['attribute_pa_color' => 'white', 'attribute_pa_size' => 'small'],
+                'is_in_stock' => true,
+                'is_purchasable' => true,
+            ],
+        ],
+        permalink: 'https://store.test/vneck',
+        attributeOptions: [
+            'pa_color' => ['blue', 'white'],
+            'pa_size' => ['small', 'large'],
+        ],
+    );
+
+    Functions\when('apply_filters')->returnArg(2);
+    Functions\when('wc_get_product')->alias(fn ($id) => (int) $id === 1842 ? $parent : purchasableProduct());
+    Functions\when('WC')->justReturn((object) ['cart' => (object) []]);
+
+    $first = (new AddToCart())->addFromPayload(['product_id' => 1842]);
+
+    expect($first)->toMatchArray([
+        'ok' => false,
+        'status' => 'choices',
+        'layout' => 'options',
+        'message' => 'Which Color?',
+        'url' => 'https://store.test/vneck',
+        'choices' => [
+            [
+                'id' => 'attribute_pa_color:blue',
+                'label' => 'Blue',
+                'message' => 'Which Size?',
+                'choices' => [
+                    ['id' => 'attribute_pa_size:small', 'label' => 'Small'],
+                ],
+            ],
+            [
+                'id' => 'attribute_pa_color:white',
+                'label' => 'White',
+                'message' => 'Which Size?',
+                'choices' => [
+                    ['id' => 'attribute_pa_size:small', 'label' => 'Small'],
+                ],
+            ],
+        ],
+    ]);
+
+    $second = (new AddToCart())->addFromPayload([
+        'product_id' => 1842,
+        'choice' => 'attribute_pa_color:blue',
+    ]);
+
+    expect($second)->toMatchArray([
+        'ok' => false,
+        'status' => 'choices',
+        'message' => 'Which Size?',
+        'choices' => [
+            ['id' => 'attribute_pa_size:small', 'label' => 'Small'],
+        ],
+    ]);
+
+    $seen = null;
+    stubCart(function ($productId, $quantity, $variationId, $variation) use (&$seen) {
+        $seen = [$productId, $quantity, $variationId, $variation];
+
+        return 'item-key';
+    });
+
+    $added = (new AddToCart())->addFromPayload([
+        'product_id' => 1842,
+        'choice' => ['attribute_pa_color:blue', 'attribute_pa_size:small'],
+    ]);
+
+    expect($added['ok'])->toBeTrue()
+        ->and($seen)->toBe([
+            1842,
+            1,
+            11,
+            [
+                'attribute_pa_color' => 'blue',
+                'attribute_pa_size' => 'small',
+            ],
+        ]);
+});
+
+it('turns a long variation list into a product link', function () {
+    $rows = [];
+
+    for ($i = 1; $i <= 9; $i++) {
+        $rows[] = [
+            'variation_id' => $i,
+            'attributes' => ['attribute_pa_size' => 's'.$i],
+            'is_in_stock' => true,
+            'is_purchasable' => true,
+        ];
+    }
+
+    Functions\when('wc_get_product')->justReturn(purchasableProduct(
+        variable: true,
+        variations: $rows,
+        permalink: 'https://store.test/vneck',
+    ));
+    Functions\when('WC')->justReturn((object) ['cart' => (object) []]);
+
+    expect((new AddToCart())->add(1842, 1))->toMatchArray([
+        'ok' => false,
+        'message' => 'This product has many options. Open the product to pick one.',
+        'url' => 'https://store.test/vneck',
+    ]);
+});
+
+it('rejects a product that is not purchasable', function () {
+    Functions\when('wc_get_product')->justReturn(purchasableProduct(purchasable: false));
+    Functions\when('WC')->justReturn((object) ['cart' => (object) []]);
+
+    expect((new AddToCart())->add(1842, 1))
+        ->toMatchArray(['ok' => false, 'message' => 'That product cannot be purchased.']);
+});
+
+it('fills variation attributes from the variation product', function () {
+    Functions\when('wc_get_product')->alias(function ($id) {
+        if ((int) $id === 99) {
+            return new class
+            {
+                public function is_purchasable(): bool
+                {
+                    return true;
+                }
+
+                public function is_type(string $type): bool
+                {
+                    return $type === 'variation';
+                }
+
+                public function get_name(): string
+                {
+                    return 'V-Neck T-Shirt - Blue, Large';
+                }
+
+                public function get_max_purchase_quantity(): int
+                {
+                    return -1;
+                }
+
+                public function get_variation_attributes(): array
+                {
+                    return [
+                        'attribute_pa_color' => 'blue',
+                        'attribute_pa_size' => 'large',
+                    ];
+                }
+            };
+        }
+
+        return purchasableProduct(variable: true);
+    });
+
+    $seen = null;
+    stubCart(function ($productId, $quantity, $variationId, $variation) use (&$seen) {
+        $seen = [$productId, $quantity, $variationId, $variation];
+
+        return 'item-key';
+    });
+    Functions\when('wp_strip_all_tags')->returnArg(1);
+
+    expect((new AddToCart())->add(1842, 1, 99)['ok'])->toBeTrue()
+        ->and($seen)->toBe([
+            1842,
+            1,
+            99,
+            [
+                'attribute_pa_color' => 'blue',
+                'attribute_pa_size' => 'large',
+            ],
+        ]);
+});
+
+it('adds a simple product to the cart', function () {
+    Functions\when('wc_get_product')->justReturn(purchasableProduct());
+    stubCart(fn ($productId, $quantity, $variationId, $variation) => (
+        $productId === 1842 && $quantity === 2 && $variationId === 0 && $variation === []
+            ? 'item-key'
+            : false
+    ));
+
+    $result = (new AddToCart())->add(1842, 2);
+
+    expect($result['ok'])->toBeTrue()
+        ->and($result['message'])->toBe('Blue mug added to your cart.')
+        ->and($result['cart_hash'])->toBe('cart-hash')
+        ->and($result['fragments'])->toBe([]);
+});
+
+it('surfaces the WooCommerce notice when add_to_cart fails', function () {
+    Functions\when('wc_get_product')->justReturn(purchasableProduct());
+    stubCart(fn () => false);
+    Functions\when('wc_get_notices')->justReturn([['notice' => 'Out of stock.']]);
+    Functions\when('wc_clear_notices')->justReturn(true);
+
+    expect((new AddToCart())->add(1842, 1))
+        ->toMatchArray(['ok' => false, 'message' => 'Out of stock.']);
+});
+
+function purchasableProduct(
+    bool $purchasable = true,
+    bool $variable = false,
+    array $variations = [],
+    string $permalink = '',
+    array $attributeOptions = [],
+): object {
+    return new class($purchasable, $variable, $variations, $permalink, $attributeOptions)
+    {
+        /**
+         * @param  array<int, mixed>  $variations
+         * @param  array<string, mixed>  $attributeOptions
+         */
+        public function __construct(
+            private bool $purchasable,
+            private bool $variable,
+            private array $variations,
+            private string $permalink,
+            private array $attributeOptions,
+        ) {}
+
+        public function is_purchasable(): bool
+        {
+            return $this->purchasable;
+        }
+
+        public function is_type(string $type): bool
+        {
+            return $this->variable && $type === 'variable';
+        }
+
+        public function get_name(): string
+        {
+            return 'Blue mug';
+        }
+
+        public function get_max_purchase_quantity(): int
+        {
+            return -1;
+        }
+
+        /**
+         * @return array<int, mixed>
+         */
+        public function get_available_variations(): array
+        {
+            return $this->variations;
+        }
+
+        public function get_permalink(): string
+        {
+            return $this->permalink;
+        }
+
+        /**
+         * @return array<string, mixed>
+         */
+        public function get_variation_attributes(): array
+        {
+            return $this->attributeOptions;
+        }
+    };
+}
+
+function stubCart(callable $addToCart): void
+{
+    $cart = new class($addToCart)
+    {
+        public function __construct(private $addToCart) {}
+
+        public function add_to_cart(int $productId, int $quantity = 1, int $variationId = 0, array $variation = []): string|false
+        {
+            return ($this->addToCart)($productId, $quantity, $variationId, $variation);
+        }
+
+        public function get_cart_hash(): string
+        {
+            return 'cart-hash';
+        }
+    };
+
+    Functions\when('WC')->justReturn((object) ['cart' => $cart]);
+    Functions\when('wp_strip_all_tags')->returnArg(1);
+}
diff --git a/tests/Unit/AssetsTest.php b/tests/Unit/AssetsTest.php
new file mode 100644
index 0000000..d99e660
--- /dev/null
+++ b/tests/Unit/AssetsTest.php
@@ -0,0 +1,28 @@
+<?php
+
+use Datalumo\Wp\Support\Assets;
+
+if (! defined('DATALUMO_VERSION')) {
+    define('DATALUMO_VERSION', '0.0.8');
+}
+
+it('uses a timestamp when the site environment is local', function () {
+    putenv('WP_ENVIRONMENT_TYPE=local');
+
+    try {
+        expect(Assets::version())->toMatch('/^\d+$/')
+            ->and((int) Assets::version())->toBeGreaterThanOrEqual(time() - 1);
+    } finally {
+        putenv('WP_ENVIRONMENT_TYPE');
+    }
+});
+
+it('uses the plugin version outside local', function () {
+    putenv('WP_ENVIRONMENT_TYPE=production');
+
+    try {
+        expect(Assets::version())->toBe(DATALUMO_VERSION);
+    } finally {
+        putenv('WP_ENVIRONMENT_TYPE');
+    }
+});
diff --git a/tests/Unit/ClientConnectTest.php b/tests/Unit/ClientConnectTest.php
new file mode 100644
index 0000000..e6f0eb6
--- /dev/null
+++ b/tests/Unit/ClientConnectTest.php
@@ -0,0 +1,52 @@
+<?php
+
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Api\ApiException;
+use Datalumo\Wp\Api\Client;
+
+it('calls org-less /me when the organisation id is empty', function () {
+    Functions\when('is_wp_error')->justReturn(false);
+    Functions\when('wp_json_encode')->alias(fn ($value) => json_encode($value));
+    Functions\when('wp_remote_retrieve_response_code')->justReturn(200);
+    Functions\when('wp_remote_retrieve_body')->justReturn('{"organisation":{"id":"org-1"}}');
+    Functions\when('wp_remote_retrieve_header')->justReturn('');
+
+    $seen = null;
+    Functions\when('wp_remote_request')->alias(function (string $url) use (&$seen) {
+        $seen = $url;
+
+        return ['response' => ['code' => 200], 'body' => '{"organisation":{"id":"org-1"}}'];
+    });
+
+    $result = (new Client())->me('', 'plain-token');
+
+    expect($seen)->toBe('https://datalumo.app/api/v1/me')
+        ->and($result['organisation']['id'])->toBe('org-1');
+});
+
+it('keeps the org-scoped /me path when an organisation id is given', function () {
+    Functions\when('is_wp_error')->justReturn(false);
+    Functions\when('wp_json_encode')->alias(fn ($value) => json_encode($value));
+    Functions\when('wp_remote_retrieve_response_code')->justReturn(200);
+    Functions\when('wp_remote_retrieve_body')->justReturn('{"organisation":{"id":"org-1"}}');
+    Functions\when('wp_remote_retrieve_header')->justReturn('');
+
+    $seen = null;
+    Functions\when('wp_remote_request')->alias(function (string $url) use (&$seen) {
+        $seen = $url;
+
+        return ['response' => ['code' => 200], 'body' => '{"organisation":{"id":"org-1"}}'];
+    });
+
+    (new Client())->me('org-1', 'plain-token');
+
+    expect($seen)->toBe('https://datalumo.app/api/v1/org-1/me');
+});
+
+it('parses a compound widget key and rejects a secret', function () {
+    Functions\when('esc_html__')->returnArg(1);
+
+    expect((new Client())->parseWidgetKey('org-1/widget-2'))->toBe(['org-1', 'widget-2'])
+        ->and(fn () => (new Client())->parseWidgetKey('dl_secret'))
+        ->toThrow(ApiException::class);
+});
diff --git a/tests/Unit/CredentialsTest.php b/tests/Unit/CredentialsTest.php
new file mode 100644
index 0000000..ae95fe8
--- /dev/null
+++ b/tests/Unit/CredentialsTest.php
@@ -0,0 +1,20 @@
+<?php
+
+use Datalumo\Wp\Support\Credentials;
+
+it('recognises a compound widget key', function () {
+    expect(Credentials::looksLikeWidgetKey('org-1/widget-2'))->toBeTrue();
+});
+
+it('does not treat a secret as a widget key', function () {
+    expect(Credentials::looksLikeWidgetKey('dl_abc123'))->toBeFalse();
+});
+
+it('does not treat a bare token as a widget key', function () {
+    expect(Credentials::looksLikeWidgetKey('1|plain-api-token'))->toBeFalse();
+});
+
+it('recognises a dl_ secret', function () {
+    expect(Credentials::looksLikeSecret('dl_abc123'))->toBeTrue()
+        ->and(Credentials::looksLikeSecret('1|plain-api-token'))->toBeFalse();
+});
diff --git a/tests/Unit/EmbedTest.php b/tests/Unit/EmbedTest.php
new file mode 100644
index 0000000..9440927
--- /dev/null
+++ b/tests/Unit/EmbedTest.php
@@ -0,0 +1,43 @@
+<?php
+
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Embed\Embed;
+
+it('sends no page context off a singular view', function () {
+    Functions\when('is_product')->justReturn(false);
+    Functions\when('is_singular')->justReturn(false);
+    Functions\when('apply_filters')->returnArg(2);
+
+    expect((new Embed())->pageContext())->toBe([]);
+});
+
+it('puts the current page id in chat context on a singular view', function () {
+    Functions\when('is_product')->justReturn(false);
+    Functions\when('is_singular')->justReturn(true);
+    Functions\when('get_the_ID')->justReturn(42);
+    Functions\when('apply_filters')->returnArg(2);
+
+    expect((new Embed())->pageContext())->toBe([
+        'page_id' => '42',
+    ]);
+});
+
+it('puts the current product id in chat context on a product page', function () {
+    Functions\when('is_product')->justReturn(true);
+    Functions\when('is_singular')->justReturn(true);
+    Functions\when('get_the_ID')->justReturn(1842);
+    Functions\when('wc_get_product')->justReturn(new class
+    {
+        public function get_sku(): string
+        {
+            return 'VNECK-BLU';
+        }
+    });
+    Functions\when('apply_filters')->returnArg(2);
+
+    expect((new Embed())->pageContext())->toBe([
+        'page_id' => '1842',
+        'product_id' => '1842',
+        'sku' => 'VNECK-BLU',
+    ]);
+});
diff --git a/tests/Unit/GrantTest.php b/tests/Unit/GrantTest.php
new file mode 100644
index 0000000..83fcf33
--- /dev/null
+++ b/tests/Unit/GrantTest.php
@@ -0,0 +1,104 @@
+<?php
+
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Connect\Grant;
+use Datalumo\Wp\Support\Options;
+
+it('builds a start URL from the plugin base, site host, and admin callback', function () {
+    Functions\when('home_url')->justReturn('https://shop.example/');
+    Functions\when('admin_url')->alias(fn (string $path) => 'https://shop.example/wp-admin/'.$path);
+    Functions\when('wp_parse_url')->alias(fn (string $url, int $component = -1) => parse_url($url, $component));
+
+    expect(Grant::startUrl('https://datalumo.app', 'state-1'))->toBe(
+        'https://datalumo.app/integrations/wordpress?'.http_build_query([
+            'site' => 'shop.example',
+            'site_url' => 'https://shop.example/',
+            'return' => 'https://shop.example/wp-admin/admin-post.php?action=datalumo_oauth_callback',
+            'cancel' => 'https://shop.example/wp-admin/options-general.php?page=datalumo&tab=connection',
+            'state' => 'state-1',
+        ]),
+    );
+});
+
+it('maps an exchange payload onto stored options', function () {
+    Grant::apply([
+        'token' => 'tok_1',
+        'organisation' => ['id' => 'org_1', 'name' => 'Acme'],
+        'sources' => [['id' => 'src_1', 'name' => 'shop.example']],
+        'source' => ['id' => 'src_1', 'name' => 'shop.example'],
+        'chatbot' => ['widget_key' => 'org_1/chat_1', 'signing_secret' => 'dl_secret'],
+        'search' => ['widget_key' => 'org_1/search_1'],
+    ]);
+
+    expect(Options::get('api_token'))->toBe('tok_1')
+        ->and(Options::get('organisation.id'))->toBe('org_1')
+        ->and(Options::get('setup_pending'))->toBeTrue()
+        ->and(Options::get('setup_source_id'))->toBe('src_1')
+        ->and(Options::get('connected_via'))->toBe('grant')
+        ->and(Options::get('chatbot.widget_key'))->toBe('org_1/chat_1')
+        ->and(Options::get('chatbot.signing_secret'))->toBe('dl_secret')
+        ->and(Options::get('search_box.widget_key'))->toBe('org_1/search_1')
+        ->and(Options::get('enhanced.widget_key'))->toBe('org_1/search_1')
+        ->and(Options::get('syncs.0.source_id'))->toBe('src_1')
+        ->and(Options::get('syncs.0.post_types'))->toBe(['post', 'page']);
+});
+
+it('sends the browser to Datalumo with wp_redirect so an off-site host is not rewritten', function () {
+    Functions\when('current_user_can')->justReturn(true);
+    Functions\when('check_admin_referer')->justReturn(true);
+    Functions\when('set_transient')->justReturn(true);
+    Functions\when('get_current_user_id')->justReturn(1);
+    Functions\when('esc_url_raw')->returnArg(1);
+    Functions\when('wp_unslash')->returnArg(1);
+    Functions\when('home_url')->justReturn('http://datalumo-wp.test/');
+    Functions\when('admin_url')->alias(fn (string $path) => 'http://datalumo-wp.test/wp-admin/'.$path);
+    Functions\when('wp_parse_url')->alias(fn (string $url, int $component = -1) => parse_url($url, $component));
+
+    $_POST = ['api_url' => 'https://dl.test'];
+
+    $redirected = null;
+    Functions\expect('wp_redirect')->once()->andReturnUsing(function (string $url) use (&$redirected): void {
+        $redirected = $url;
+        throw new RuntimeException('redirect');
+    });
+    Functions\expect('wp_safe_redirect')->never();
+
+    try {
+        Grant::start();
+        expect(false)->toBeTrue();
+    } catch (RuntimeException $e) {
+        expect($e->getMessage())->toBe('redirect');
+    }
+
+    expect($redirected)->toStartWith('https://dl.test/integrations/wordpress?');
+});
+
+it('rejects a callback when the stored state does not match', function () {
+    Functions\when('current_user_can')->justReturn(true);
+    Functions\when('get_current_user_id')->justReturn(1);
+    Functions\when('get_transient')->justReturn('expected-state');
+    Functions\when('delete_transient')->justReturn(true);
+    Functions\when('sanitize_text_field')->returnArg(1);
+    Functions\when('wp_unslash')->returnArg(1);
+    Functions\when('wp_create_nonce')->justReturn('nonce');
+    Functions\when('admin_url')->justReturn('https://shop.example/wp-admin/options-general.php');
+    Functions\when('add_query_arg')->alias(fn (array $args, string $url) => $url.'?'.http_build_query($args));
+
+    $redirected = null;
+    Functions\when('wp_safe_redirect')->alias(function (string $url) use (&$redirected): void {
+        $redirected = $url;
+        throw new RuntimeException('redirect');
+    });
+
+    $_GET = ['state' => 'wrong-state', 'code' => 'abc'];
+
+    try {
+        Grant::callback();
+        expect(false)->toBeTrue();
+    } catch (RuntimeException $e) {
+        expect($e->getMessage())->toBe('redirect');
+    }
+
+    expect($redirected)->toContain('grant_failed')
+        ->and($redirected)->not->toContain('connected');
+});
diff --git a/tests/Unit/HostNavigationTest.php b/tests/Unit/HostNavigationTest.php
new file mode 100644
index 0000000..2daedb0
--- /dev/null
+++ b/tests/Unit/HostNavigationTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use Brain\Monkey\Actions;
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Integration\HostNavigation;
+
+if (! defined('DATALUMO_URL')) {
+    define('DATALUMO_URL', 'https://example.com/wp-content/plugins/datalumo/');
+}
+
+if (! defined('DATALUMO_VERSION')) {
+    define('DATALUMO_VERSION', '0.0.8');
+}
+
+function hostNav(): HostNavigation
+{
+    Functions\when('home_url')->justReturn('https://shop.test/');
+
+    return new HostNavigation();
+}
+
+it('registers the ajax handlers and script hook', function () {
+    (new HostNavigation())->register();
+
+    expect(Actions\has('wp_enqueue_scripts'))->not->toBeFalse()
+        ->and(Actions\has('wp_ajax_datalumo_host_navigation'))->not->toBeFalse()
+        ->and(Actions\has('wp_ajax_nopriv_datalumo_host_navigation'))->not->toBeFalse();
+});
+
+it('resolves the WooCommerce cart and checkout urls', function () {
+    Functions\when('wc_get_cart_url')->justReturn('https://shop.test/cart/');
+    Functions\when('wc_get_checkout_url')->justReturn('https://shop.test/checkout/');
+
+    $nav = hostNav();
+
+    expect($nav->resolveUrl('view_cart', []))->toBe('https://shop.test/cart/')
+        ->and($nav->resolveUrl('open_checkout', []))->toBe('https://shop.test/checkout/');
+});
+
+it('rejects an off-site cart url', function () {
+    Functions\when('wc_get_cart_url')->justReturn('https://evil.test/cart/');
+
+    expect(hostNav()->resolveUrl('view_cart', []))->toBeNull();
+});
+
+it('opens a published page by id', function () {
+    Functions\when('get_post')->justReturn((object) ['ID' => 42, 'post_status' => 'publish']);
+    Functions\when('get_permalink')->justReturn('https://shop.test/about/');
+
+    expect(hostNav()->publishedUrlFromPayload(['page_id' => '42']))->toBe('https://shop.test/about/');
+});
+
+it('does not open a draft page', function () {
+    Functions\when('get_post')->justReturn((object) ['ID' => 42, 'post_status' => 'draft']);
+    Functions\when('get_permalink')->justReturn('https://shop.test/?p=42&preview=true');
+
+    expect(hostNav()->publishedUrlFromPayload(['page_id' => '42']))->toBeNull();
+});
+
+it('opens a same-site url and rejects javascript or off-site urls', function () {
+    $nav = hostNav();
+
+    expect($nav->publishedUrlFromPayload(['url' => 'https://shop.test/contact/']))->toBe('https://shop.test/contact/')
+        ->and($nav->isSameSiteUrl('javascript:alert(1)'))->toBeFalse()
+        ->and($nav->isSameSiteUrl('https://evil.test/contact/'))->toBeFalse();
+});
+
+it('opens a page by slug', function () {
+    Functions\when('get_page_by_path')->justReturn((object) ['ID' => 9]);
+    Functions\when('get_post')->justReturn((object) ['ID' => 9, 'post_status' => 'publish']);
+    Functions\when('get_permalink')->justReturn('https://shop.test/contact/');
+
+    expect(hostNav()->publishedUrlFromPayload(['slug' => 'contact']))->toBe('https://shop.test/contact/');
+});
+
+it('ignores start_form', function () {
+    expect(hostNav()->resolveUrl('start_form', ['page_id' => '9']))->toBeNull();
+});
diff --git a/tests/Unit/IndexPhpTest.php b/tests/Unit/IndexPhpTest.php
new file mode 100644
index 0000000..18dcb4e
--- /dev/null
+++ b/tests/Unit/IndexPhpTest.php
@@ -0,0 +1,35 @@
+<?php
+
+it('has a silence is golden index.php in every first-party folder', function () {
+    $root = dirname(__DIR__, 2);
+    $skip = ['.git', '.github', '.slimm', '.phpunit.cache', 'vendor'];
+    $iterator = new RecursiveIteratorIterator(
+        new RecursiveCallbackFilterIterator(
+            new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
+            function (SplFileInfo $current) use ($skip): bool {
+                return ! $current->isDir() || ! in_array($current->getFilename(), $skip, true);
+            },
+        ),
+        RecursiveIteratorIterator::SELF_FIRST,
+    );
+
+    $missing = [];
+
+    foreach (array_merge([$root], iterator_to_array($iterator)) as $file) {
+        $dir = $file instanceof SplFileInfo
+            ? ($file->isDir() ? $file->getPathname() : null)
+            : $file;
+
+        if ($dir === null) {
+            continue;
+        }
+
+        $index = $dir.'/index.php';
+
+        if (! is_file($index) || ! str_contains((string) file_get_contents($index), 'Silence is golden')) {
+            $missing[] = $dir;
+        }
+    }
+
+    expect($missing)->toBe([]);
+});
diff --git a/tests/Unit/PagePreparerTest.php b/tests/Unit/PagePreparerTest.php
index 31c9c5b..b413063 100644
--- a/tests/Unit/PagePreparerTest.php
+++ b/tests/Unit/PagePreparerTest.php
@@ -33,6 +33,18 @@
         ->and($payload['content_mime'])->toBe('text/html');
 });
 
+it('falls back when block rendering fatals', function () {
+    Functions\when('get_the_title')->justReturn('Product');
+    Functions\when('do_blocks')->alias(function (): string {
+        throw new Error('Call to undefined function Automattic\WooCommerce\Blocks\Domain\Services\wc_get_notices()');
+    });
+
+    $post = new WP_Post();
+    $post->post_content = '<p>Ceramic mug</p>';
+
+    expect((new PagePreparer())->prepare($post)['content'])->toBe('<p>Ceramic mug</p>');
+});
+
 it('skips a post with no content', function () {
     Functions\when('get_the_title')->justReturn('Empty');
     Functions\when('wp_strip_all_tags')->justReturn('');
@@ -42,3 +54,19 @@
 
     expect((new PagePreparer())->prepare($post))->toBeNull();
 });
+
+it('keeps a payload the filter filled after an empty body', function () {
+    Functions\when('get_the_title')->justReturn('Mug');
+    Functions\when('apply_filters')->alias(function (string $hook, mixed $value) {
+        if ($hook === 'datalumo_page_payload' && is_array($value)) {
+            $value['content'] = '<p>A ceramic mug.</p>';
+        }
+
+        return $value;
+    });
+
+    $post = new WP_Post();
+    $post->post_content = '';
+
+    expect((new PagePreparer())->prepare($post)['content'])->toBe('<p>A ceramic mug.</p>');
+});
diff --git a/tests/Unit/SettingsPageTest.php b/tests/Unit/SettingsPageTest.php
new file mode 100644
index 0000000..ada4439
--- /dev/null
+++ b/tests/Unit/SettingsPageTest.php
@@ -0,0 +1,73 @@
+<?php
+
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Admin\SettingsPage;
+use Datalumo\Wp\Support\Options;
+
+it('rejects a secret or token in a widget key field and keeps the current value', function (string $pasted) {
+    Functions\when('sanitize_text_field')->returnArg(1);
+
+    $page = new SettingsPage();
+    $method = new ReflectionMethod(SettingsPage::class, 'sanitizeWidgetKey');
+    $rejected = new ReflectionProperty(SettingsPage::class, 'widgetKeyRejected');
+
+    expect($method->invoke($page, $pasted, 'org-1/widget-2'))->toBe('org-1/widget-2')
+        ->and($rejected->getValue($page))->toBeTrue();
+})->with([
+    'dl_secret',
+    '1|plain-api-token',
+    'not-a-key',
+]);
+
+it('does not print a second Settings saved notice', function () {
+    $view = (string) file_get_contents(dirname(__DIR__, 2).'/resources/views/settings.php');
+
+    expect($view)->not->toContain("esc_html_e('Settings saved.'");
+});
+
+it('points settings help at the WordPress plugin docs', function () {
+    expect(SettingsPage::docsUrl())->toBe('https://datalumo.app/docs/wordpress')
+        ->and(SettingsPage::docsUrl('chat-page-actions'))->toBe('https://datalumo.app/docs/wordpress#chat-page-actions')
+        ->and(SettingsPage::helpUrl())->toBe('https://datalumo.app/docs/wordpress')
+        ->and(SettingsPage::ASK_MAX_LENGTH)->toBe(280);
+});
+
+it('hides the self-hosted URL behind a disclosure on connect', function () {
+    $view = (string) file_get_contents(dirname(__DIR__, 2).'/resources/views/settings.php');
+
+    expect($view)->toContain('datalumo-self-host')
+        ->and($view)->toContain("Using a self-hosted Datalumo?")
+        ->and($view)->toContain('datalumo-grant-api-url');
+});
+
+it('hides the settings sidebar until setup is ready', function () {
+    $view = (string) file_get_contents(dirname(__DIR__, 2).'/resources/views/settings.php');
+
+    expect($view)->toContain('datalumo-settings-aside')
+        ->and(substr_count($view, 'if (SettingsPage::setupIsReady())'))->toBe(2);
+});
+
+it('hides other tabs until the post-connect checklist is saved', function () {
+    Options::merge([
+        'api_token' => 'tok_1',
+        'organisation' => ['id' => 'org_1'],
+        'setup_pending' => true,
+    ]);
+
+    expect(SettingsPage::setupIsReady())->toBeFalse();
+
+    Options::set('setup_pending', false);
+
+    expect(SettingsPage::setupIsReady())->toBeTrue();
+});
+
+it('accepts a compound widget key', function () {
+    Functions\when('sanitize_text_field')->returnArg(1);
+
+    $page = new SettingsPage();
+    $method = new ReflectionMethod(SettingsPage::class, 'sanitizeWidgetKey');
+    $rejected = new ReflectionProperty(SettingsPage::class, 'widgetKeyRejected');
+
+    expect($method->invoke($page, 'org-1/widget-2', ''))->toBe('org-1/widget-2')
+        ->and($rejected->getValue($page))->toBeFalse();
+});
diff --git a/tests/Unit/WooCommerceSkuTest.php b/tests/Unit/WooCommerceSkuTest.php
new file mode 100644
index 0000000..cad9da3
--- /dev/null
+++ b/tests/Unit/WooCommerceSkuTest.php
@@ -0,0 +1,230 @@
+<?php
+
+use Brain\Monkey\Functions;
+use Datalumo\Wp\Integration\WooCommerce;
+
+function wcProduct(
+    string $sku = '',
+    string $type = 'simple',
+    array $children = [],
+    string $shortDescription = '',
+    array $attributes = [],
+    int $id = 1,
+): object {
+    return new class($sku, $type, $children, $shortDescription, $attributes, $id)
+    {
+        public function __construct(
+            private string $sku,
+            private string $type,
+            private array $children,
+            private string $shortDescription,
+            private array $attributes,
+            private int $id,
+        ) {}
+
+        public function get_id(): int
+        {
+            return $this->id;
+        }
+
+        public function get_sku(): string
+        {
+            return $this->sku;
+        }
+
+        public function get_short_description(): string
+        {
+            return $this->shortDescription;
+        }
+
+        public function get_attributes(): array
+        {
+            return $this->attributes;
+        }
+
+        public function is_type(string $type): bool
+        {
+            return $this->type === $type;
+        }
+
+        public function get_children(): array
+        {
+            return $this->children;
+        }
+    };
+}
+
+function wcAttribute(string $name, array $options, bool $visible = true, bool $taxonomy = false): object
+{
+    return new class($name, $options, $visible, $taxonomy)
+    {
+        public function __construct(
+            private string $name,
+            private array $options,
+            private bool $visible,
+            private bool $taxonomy,
+        ) {}
+
+        public function get_name(): string
+        {
+            return $this->name;
+        }
+
+        public function get_visible(): bool
+        {
+            return $this->visible;
+        }
+
+        public function is_taxonomy(): bool
+        {
+            return $this->taxonomy;
+        }
+
+        public function get_options(): array
+        {
+            return $this->options;
+        }
+    };
+}
+
+beforeEach(function () {
+    Functions\when('wp_strip_all_tags')->returnArg(1);
+    Functions\when('wc_attribute_label')->returnArg(1);
+    Functions\when('get_the_terms')->justReturn([]);
+});
+
+it('leaves non-product payloads alone', function () {
+    $post = new WP_Post();
+    $post->post_type = 'page';
+
+    $payload = ['content' => '<p>About</p>', 'meta' => ['post_type' => 'page']];
+
+    expect((new WooCommerce())->enrichProduct($payload, $post))->toBe($payload);
+});
+
+it('adds a simple product sku to meta and searchable content', function () {
+    Functions\when('wc_get_product')->justReturn(wcProduct(sku: 'VNECK-BLU'));
+
+    $post = new WP_Post();
+    $post->ID = 12;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '<p>A blue v-neck.</p>',
+        'meta' => ['post_type' => 'product'],
+    ], $post);
+
+    expect($payload['meta']['sku'])->toBe('VNECK-BLU')
+        ->and($payload['content'])->toContain('sku: VNECK-BLU');
+});
+
+it('includes variation skus on a variable product', function () {
+    Functions\when('wc_get_product')->alias(function (int $id) {
+        return match ($id) {
+            10 => wcProduct(sku: 'jacket', type: 'variable', children: [11, 12], id: 10),
+            11 => wcProduct(sku: 'jacket-blue-m', id: 11),
+            12 => wcProduct(sku: 'jacket-red-l', id: 12),
+            default => null,
+        };
+    });
+
+    $post = new WP_Post();
+    $post->ID = 10;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '<p>A jacket.</p>',
+        'meta' => ['post_type' => 'product'],
+    ], $post);
+
+    expect($payload['meta']['sku'])->toBe(['jacket', 'jacket-blue-m', 'jacket-red-l'])
+        ->and($payload['content'])->toContain('sku: jacket, jacket-blue-m, jacket-red-l');
+});
+
+it('does not overwrite an existing sku mapping', function () {
+    Functions\when('wc_get_product')->justReturn(wcProduct(sku: 'FROM-WC'));
+
+    $post = new WP_Post();
+    $post->ID = 3;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '<p>Mapped.</p>',
+        'meta' => ['sku' => 'FROM-MAP'],
+    ], $post);
+
+    expect($payload['meta']['sku'])->toBe('FROM-MAP')
+        ->and($payload['content'])->toBe('<p>Mapped.</p>');
+});
+
+it('prepends the short description when the body is empty', function () {
+    Functions\when('wc_get_product')->justReturn(wcProduct(
+        sku: 'MUG-1',
+        shortDescription: 'A ceramic mug.',
+    ));
+
+    $post = new WP_Post();
+    $post->ID = 4;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '',
+        'meta' => ['post_type' => 'product'],
+    ], $post);
+
+    expect($payload['content'])->toStartWith('<p>A ceramic mug.</p>')
+        ->and($payload['content'])->toContain('sku: MUG-1');
+});
+
+it('adds product categories and tags as searchable meta', function () {
+    Functions\when('wc_get_product')->justReturn(wcProduct(sku: 'SHOE-1'));
+    Functions\when('get_the_terms')->alias(function (int $id, string $taxonomy) {
+        return match ($taxonomy) {
+            'product_cat' => [
+                (object) ['name' => 'Running', 'slug' => 'running'],
+                (object) ['name' => 'Mens', 'slug' => 'mens'],
+            ],
+            'product_tag' => [
+                (object) ['name' => 'Sale', 'slug' => 'sale'],
+            ],
+            default => [],
+        };
+    });
+
+    $post = new WP_Post();
+    $post->ID = 8;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '<p>Trail shoe.</p>',
+        'meta' => ['post_type' => 'product'],
+    ], $post);
+
+    expect($payload['meta']['categories'])->toBe(['running', 'mens'])
+        ->and($payload['meta']['tags'])->toBe(['sale'])
+        ->and($payload['content'])->toContain('category: Running, Mens')
+        ->and($payload['content'])->toContain('tag: Sale');
+});
+
+it('adds visible attributes and skips hidden ones', function () {
+    Functions\when('wc_get_product')->justReturn(wcProduct(
+        sku: 'JKT-1',
+        attributes: [
+            wcAttribute('Color', ['Blue', 'Red']),
+            wcAttribute('Internal', ['secret'], visible: false),
+        ],
+    ));
+
+    $post = new WP_Post();
+    $post->ID = 9;
+    $post->post_type = 'product';
+
+    $payload = (new WooCommerce())->enrichProduct([
+        'content' => '<p>A jacket.</p>',
+        'meta' => ['post_type' => 'product'],
+    ], $post);
+
+    expect($payload['meta']['attributes'])->toBe(['Color' => ['Blue', 'Red']])
+        ->and($payload['content'])->toContain('Color: Blue, Red')
+        ->and($payload['content'])->not->toContain('Internal');
+});
diff --git a/tests/Unit/index.php b/tests/Unit/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/tests/Unit/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/tests/index.php b/tests/index.php
new file mode 100644
index 0000000..6220032
--- /dev/null
+++ b/tests/index.php
@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.
diff --git a/uninstall.php b/uninstall.php
index 75a68d2..af2017f 100644
--- a/uninstall.php
+++ b/uninstall.php
@@ -6,9 +6,10 @@
 
 delete_option('datalumo_settings');
 delete_option('datalumo_sync_state');
+delete_metadata('user', 0, 'datalumo_hide_setup_notice', '', true);
 
 if (function_exists('as_unschedule_all_actions')) {
-    foreach (['datalumo_push_page', 'datalumo_push_batch', 'datalumo_delete_page'] as $hook) {
-        as_unschedule_all_actions($hook, [], 'datalumo');
+    foreach (['datalumo_push_page', 'datalumo_push_batch', 'datalumo_delete_page'] as $datalumo_hook) {
+        as_unschedule_all_actions($datalumo_hook, [], 'datalumo');
     }
 }