=== AI View Sync ===
Contributors: gcco
Tags: llms-txt, llms-file, ga4, seo, ai
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.1.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

LLMS.txt plugin: publish at /llms.txt, GA4-ranked sync (AI View), merge WordPress URLs, exclusions. No API keys by default.

== Description ==

**AI View Sync** is a WordPress plugin built around the **llms.txt** convention: a small text file at **`https://yoursite.com/llms.txt`** that tells AI systems and crawlers how to interpret your site—similar in spirit to `robots.txt`, but aimed at **LLM** and AI discovery rather than crawl rules alone.

### Why llms.txt / LLMS.txt?

The **llms.txt** file (often written **LLMS.txt**) is becoming a common way to publish machine-readable hints for large language models: preferred pages, policies, and pointers to content you want highlighted. This plugin makes it straightforward to **host llms.txt on WordPress** at the standard location so tools that look for **`/llms.txt`** find your file.

### What this plugin does for your llms.txt

* **Connect to GcCo AI View** — Link your site and pick a GA4 property. Each sync pulls **LLMS.txt** content from your account so your **llms.txt** reflects traffic-ranked, GA4-informed URLs.
* **Merge with WordPress** — Optionally append published URLs from your site that are not already in the **llms.txt** body: GA4-ranked lines stay first; extra pages follow. Use path patterns and post-type exclusions so your **llms.txt** stays clean.
* **Manual llms.txt** — Prefer full control? Paste and save your own **LLMS.txt** body; the plugin still serves it at **`/llms.txt`** when that mode is active.
* **WordPress-only URL list (no account)** — If you do not connect to GcCo AI View, use **Add published URLs from WordPress** to append your site's published URLs to your saved manual file (or a short starter if the box was empty). No GA4 ranking—just your WordPress content.
* **Optional physical file** — If your host allows writes, the plugin can also create a real **`llms.txt`** file in the site root (in addition to the pretty URL).

### Who should use this llms.txt plugin?

Site owners who want a maintained **llms.txt for WordPress**, care about **AI SEO** and **LLM** visibility, and optionally want **GA4**-aware content combined with a full sitemap-style URL list—without hand-editing **llms.txt** every week.

== Installation ==

1. Upload the `ai-view-sync` folder to `/wp-content/plugins/` (or install the ZIP from Plugins → Add New → Upload). The ZIP root should be `ai-view-sync/` containing `ai-view-sync.php`.
2. Activate **AI View Sync** through the **Plugins** screen. If you are replacing an older folder named `gcco-ai-view-sync`, deactivate and delete that copy first, then install this one (WordPress treats it as a new plugin path).
3. Open **AI View Sync** from the WordPress admin menu (left sidebar).
4. Either **Connect to GcCo AI View** and complete GA4 setup, or paste your **llms.txt** / **LLMS.txt** content manually and save.

After activation, visitors and crawlers can request your file at **`https://example.com/llms.txt`** (pretty permalinks recommended). Verify in a browser or with `curl` that **`/llms.txt`** returns your text.

== Frequently Asked Questions ==

= What is llms.txt? =

**llms.txt** (often written **LLMS.txt**) is a plain-text file at **`/llms.txt`**. It signals to AI and LLM tools what to prioritize on your site (separate from **robots.txt**, which controls crawling). This plugin helps you **publish and update llms.txt on WordPress** without FTP.

= Do I need an API key? =

No. A normal install does not require API keys. Optional **wp-config.php** constants (for example `AIVISY_APP_URL` or custom sync URLs) exist only for advanced or self-hosted setups.

= Do I need GcCo AI View to use the plugin? =

No. You can paste **LLMS.txt** manually, or use **Add published URLs from WordPress** (when not connected) to append published URLs without an account. Connecting to **GcCo AI View** adds automatic sync and GA4-informed prioritization from your account.

= What makes this different from other llms.txt plugins? =

Many plugins only **serve** a file you write yourself. **AI View Sync** can **fill** that file using traffic-aware ordering from **GA4** (via GcCo AI View), then **merge** in extra WordPress URLs so newer or sitemap-only pages are not missed. You can also set **path and post-type exclusions** (connected flow) and optionally write a physical **`llms.txt`** on disk in addition to the pretty URL.

= Where does the file get published? =

Your live file is served at **`https://yoursite.com/llms.txt`** (pretty permalinks recommended). The plugin may also write **`llms.txt`** in your site root when the server allows it.

= Can I resync the file later? =

Yes. After you connect, use **Sync now** in the plugin admin whenever you want to pull the latest **LLMS.txt** from GcCo AI View and re-run the WordPress merge. There is **no built-in WordPress cron** in this plugin yet—refresh is **on demand** unless you add your own automation outside the plugin.

= Can I include WordPress pages that are new and not yet in GA4? =

Yes. On sync, the plugin can **append** eligible published URLs from WordPress that are not already listed in the synced body, subject to your exclusion rules.

= Can I build llms.txt from WordPress only, without GA4? =

Yes. When you are **not** connected, use **Add published URLs from WordPress** on the manual panel. That uses your saved manual text as the base (or a short starter if empty). It does **not** apply GA4 ranking—that comes from connecting and syncing.

= What happens on "Sync" (connected)? =

The plugin fetches **LLMS.txt** from your GcCo AI View account, merges in additional WordPress URLs, applies exclusions, updates what is served at **`/llms.txt`**, and shows last sync time plus counts (URLs from the synced body vs appended).

= Will this replace my theme or SEO plugin? =

No. It only registers the **llms.txt** route and settings; it does not change posts or theme output.

= Where is content stored? =

Settings and the synced or manual **llms.txt** body are stored in the WordPress options table (`aivisy_settings`).

= WordPress.org says my text domain does not match the plugin slug. What should I do? =

The Text Domain is **`ai-view-sync`**. It must match your **WordPress.org plugin slug** and the **top-level folder name** in the ZIP (`ai-view-sync/`). That is independent of the admin URL parameter `page=aivisy-settings` used for OAuth callbacks.

== External services ==

This plugin connects to **GcCo AI View** (gcco.io), a third-party analytics and LLMS.txt generation service operated by GCCO LLC.

**What the service does:** AI View uses your Google Analytics 4 (GA4) data to rank your site's pages by traffic and generate an LLMS.txt file tailored to your content.

**When data is sent:** Data is transmitted to gcco.io only when you actively use the Connect flow or click "Sync now." Specifically:

* **Connect flow** — Your WordPress site URL and a temporary OAuth state token are sent to gcco.io/ai-dashboard so you can authorize the plugin with your AI View account.
* **Sync** — Your connection token, site URL, and selected GA4 property ID are sent to gcco.io to fetch the generated LLMS.txt content for your account.
* **Property list** — Your connection token and site URL are sent to retrieve the list of GA4 properties associated with your account.
* **Property bind** — Your connection token, site URL, and chosen property ID are sent to link that property to this WordPress installation.

No data is sent automatically (no cron or background requests). All requests are made over HTTPS.

Service provider: GCCO LLC
Service website: https://gcco.io
Terms of Service: https://gcco.io/terms/
Privacy Policy: https://gcco.io/privacy-policy/

== Screenshots ==

1. Settings — connect, GA4 property, exclusions, and sync for **llms.txt**.
2. Connected state — last sync and GA4 vs appended URL counts for your **LLMS.txt**.
3. Manual paste and preview of the live **llms.txt** output.

== Changelog ==

= 1.1.4 =
* WordPress.org review: replaced FILTER_DEFAULT (unsanitized) in Connector helper methods with direct $_GET access followed by proper sanitization (sanitize_text_field / esc_url_raw).
* WordPress.org review: added nonce verification to admin notice display (maybe_notice, render_settings_page). All post-action redirects now embed a nonce via aivisy_make_notice_url() and the display layer verifies it with wp_verify_nonce().
* WordPress.org review: added sanitize_textarea_field() at the point of reading $_POST for manual LLMS.txt content and exclude-path patterns, before passing to Settings sanitizer.
* WordPress.org review: physical file copy now written to wp-content/uploads/ai-view-sync/llms.txt (uses wp_upload_dir()) instead of the site root (ABSPATH). The canonical /llms.txt URL continues to be served virtually via the existing rewrite rule; the uploads copy is a backup only.
* WordPress.org review: plain-text output (class-output.php) now uses esc_html() as the late-escaping wrapper, satisfying WPCS EscapeOutput requirements while preserving all LLMS.txt markdown characters. The text/plain Content-Type header remains the primary XSS barrier.
* WordPress.org review: updated readme.txt External services section with correct Terms of Service (https://gcco.io/terms/) and Privacy Policy (https://gcco.io/privacy-policy/) URLs.

= 1.1.3 =
* WordPress.org review: replaced generic `AI_VIEW_*` / `ai_view_llms_*` prefixes with unique `AIVISY_*` / `aivisy_*` prefix throughout (constants, options, transients, hooks, admin slugs).
* WordPress.org review: added External Services section to readme with Terms of Service and Privacy Policy links for gcco.io.

= 1.1.2 =
* WordPress.org: readme "Tested up to" and Stable tag aligned with the plugin version; Text Domain `ai-view-sync`; package folder and main file use the same slug (`ai-view-sync/ai-view-sync.php`).

= 1.1.0 =
* GA4 + WordPress URL merge with path/post-type exclusions for richer **llms.txt** output.
* Admin dashboard: last sync, counts, manual sync, link to live **`/llms.txt`**.
* **Add published URLs from WordPress** — build **llms.txt** from site URLs without connecting (manual panel).
* First release track as **AI View Sync**; earlier dev copies may have used a different folder name.

== Upgrade Notice ==

= 1.1.4 =
Security hardening: nonce verification added to admin notice display; POST inputs sanitized earlier; physical llms.txt copy now writes to uploads directory instead of site root. No configuration changes needed.

= 1.1.3 =
Prefix rename for WordPress.org compliance. If you used wp-config.php constants (`AI_VIEW_APP_URL`, etc.) rename them to `AIVISY_APP_URL`, `AIVISY_CONNECT_BASE`, `AIVISY_SYNC_API_URL`, `AIVISY_PROPERTIES_API_URL`, `AIVISY_BIND_API_URL`.

= 1.1.2 =
Maintenance release (WordPress.org compliance). No behavior change for sites already on 1.1.x.

= 1.1.0 =
First public release on this slug; if you used a development copy under another folder name, deactivate the old plugin and activate this one.
