{
  "name": "Storelayer",
  "description": "Install one origin-bound Storelayer storefront widget on the Free plan with one browser-safe paste and an independent exact-host proof.",
  "openapi": "https://storelayer.net/api/openapi.yaml",
  "agent_card": "https://storelayer.net/.well-known/agent-card.json",
  "llms": "https://storelayer.net/llms.txt",
  "support": {
    "email": "support@storelayer.net",
    "url": "https://storelayer.net/support",
    "safe_contact": "Include the storefront domain, widget name, error code, and expected result. Never send passwords, access tokens, signatures, proxy secrets, or payment-card details."
  },
  "escalation": {
    "missing_platform_permission": "Ask the site owner or merchant to grant the agent permission or publish the returned proof and embed code. Storelayer support cannot grant access to a third-party website.",
    "verification_not_found": "Confirm the exact proof is live at the returned HTTPS location, then retry verification.",
    "storelayer_failure": "Follow the error response's next_action and recovery fields. Contact Storelayer support only when the response assigns responsibility to storelayer or the documented recovery continues to fail."
  },
  "capabilities": {
    "public_free_install": {
      "start": "POST https://storelayer.net/api/agent/v1/free-install-sessions",
      "session_ttl_seconds": 1800,
      "requires_dashboard_token": false,
      "requires_account": false,
      "requires_payment": false,
      "requires_domain_verification": true,
      "requires_platform_editing_authority": true,
      "limit": "one new domain and one free widget",
      "branding": "Powered by Storelayer is required on Free",
      "workflow": [
        {
          "step": 1,
          "request": "POST /api/agent/v1/free-install-sessions",
          "body": null,
          "save": ["session_token"]
        },
        {
          "step": 2,
          "request": "POST /api/agent/v1/free-install-sessions/one-paste",
          "authorization": "Bearer <session_token>",
          "body": {"origin": "https://merchant.example", "widget_id": "<id from GET /api/agent/v1/catalog>"},
          "save": ["installation_id", "domain_id", "code"]
        },
        {
          "step": 3,
          "action": "Paste code exactly once into the published storefront. Do not add a challenge tag, server recorder, or second script."
        },
        {
          "step": 4,
          "request": "POST /api/agent/v1/free-install-sessions/domains/<domain_id>/verify",
          "authorization": "Bearer <session_token>",
          "body": null,
          "action": "Storelayer DNS-pinned-fetches the exact origin and activates only when the exact executable returned script is published."
        }
      ],
      "success": "The widget is active and origin-bound after independent published-code verification. A successful authorized browser script response then reserves Free usage atomically; no HMAC recorder is required. Account claiming and live verification are optional."
    },
    "expired_public_http_file_recovery": {
      "when": "Use only after a new public session's domain challenge is blocked by an old never-verified pending public HTTP-file reservation. It cannot recover a verified, formerly verified, account-owned, claimed, unexpired, installation-linked, or authority-linked domain.",
      "requires_platform_editing_authority": true,
      "workflow": [
        {
          "step": 1,
          "request": "POST /api/agent/v1/free-install-sessions/domain-recoveries",
          "authorization": "Bearer <new_session_token>",
          "body": {"origin": "https://merchant.example"},
          "save": ["verification_url", "expected_content", "recovery_token", "recovery_expires_at"]
        },
        {
          "step": 2,
          "action": "Before recovery_expires_at, publish expected_content unchanged at verification_url. Do not treat request headers, an old challenge file, or knowing a domain ID as proof."
        },
        {
          "step": 3,
          "request": "POST /api/agent/v1/free-install-sessions/domain-recoveries/verify",
          "authorization": "Bearer <new_session_token>",
          "body": {"recovery_token": "<returned recovery_token>"},
          "save": ["domain_id"]
        },
        {
          "step": 4,
          "request": "POST /api/agent/v1/free-install-sessions/installations",
          "authorization": "Bearer <new_session_token>",
          "body": {"domain_id": "<domain_id>", "widget_id": "<id from GET /api/agent/v1/catalog>"}
        }
      ],
      "stop_conditions": "Stop on domain_recovery_unavailable, invalid_recovery_proof, recovery_proof_expired, or any authority-race conflict; start a clean session/domain flow or use the existing billing authority. recovery_token is short-lived, session-bound, one-time recovery proof only, and is never a claim_token."
    }
  }
}