=== Codrva Inkflow - AI Content Generator ===
Contributors: codrva
Tags: ai, seo, content, blog, automation
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 2.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Drafts SEO-friendly blog posts with AI for you to review and publish, with built-in AI disclosure safeguards.

== Description ==

Codrva Inkflow is a free WordPress plugin that drafts SEO-friendly blog posts with AI for you to review and publish. It has three modes (Manual, Feed, Auto), multilingual support, related-term suggestions, internal linking, a Gutenberg block, a frontend request form, and built-in AI disclosure and review safeguards.

= Features =

**Core Functionality**

* Manual Blog Generation - Admin input or CSV-based content creation with preview functionality
* Feed-Based Drafting - Short, original summaries of RSS items with a visible credit link to the source (kept out of search results by default)
* Auto-Posting - Fully scheduled post generation via WordPress cron jobs
* Multi-AI Support - OpenAI, Gemini and Claude with your own keys, or the site's WordPress AI connection (Settings > Connectors, WordPress 7.0+)
* Abilities - AI agents and MCP clients can create drafts for review and read the review queue (WordPress 6.9+ Abilities API)
* Word Count Control - Configurable content length parameters (100-10,000 words)
* Multi-Language Support - Content generation in 10+ languages
* Internal Linking - Intelligent automatic linking to existing content
* Related Terms - Semantically related terms suggested to the AI to use where they fit naturally
* AI Disclosure - Visible AI label on posts published without human review, review tracking, accurate bylines, AI marker (IPTC) embedded in generated images, and a daily limit for automated posting
* Prompt Provider - Advanced prompt building and template system
* Blog Format Templates - Pre-defined content structure templates (Article, How-To, Listicle, Review, News, Tutorial)
* Frontend Request Form - Public-facing form (via shortcode) that lets visitors submit content requests, saved as Pending Review posts for editorial approval
* Gutenberg Block - "Inkflow AI Writer" writes a draft that becomes normal, editable blocks

**Security & Performance**

* Encrypted API keys - AES-256-GCM, keyed with a secret from wp-config.php so a copy of the database alone cannot reveal them
* Input Sanitization - All user inputs validated and sanitized
* CSRF Protection - Nonce validation on all forms and AJAX requests
* SQL Injection Prevention - Prepared statements for all database queries
* XSS Protection - Output escaping on all rendered data
* Optimized Performance - Asynchronous processing, caching, and database optimization
* Comprehensive Logging - Detailed activity tracking, error monitoring, and debugging
* Error Recovery - Robust error handling with fallback mechanisms

= Usage Modes =

**1. Manual Mode** - Perfect for hands-on content creation with full editorial control.
Navigate to Codrva Inkflow > Manual Generator, fill in your content parameters (title, keywords, tone, format), click "Generate Content", review, and publish.

**2. Feed Mode** - Automate content creation by monitoring RSS feeds.
Add RSS feed URLs, configure checking frequency, and the system automatically processes new feed items into draft posts for your review.

**3. Auto Mode** - Scheduled drafting from keyword pools.
Configure keyword pools, set schedules and limits, and the plugin drafts posts on schedule. Drafts are the default and recommended setting.

= Using AI content responsibly =

* Google asks for AI content to be reviewed by a person before it is published, and its spam policies act against publishing many AI pages without added value ("scaled content abuse") and against republishing feeds. Inkflow saves drafts by default, limits automated posting per day, and keeps feed-based posts out of search results unless you turn that off.
* The EU AI Act (from 2 August 2026) requires a clear AI label on AI-generated text that informs the public, unless a person has reviewed it and takes editorial responsibility. Inkflow counts a post as reviewed when an editor publishes, schedules or updates it, and always shows an AI label on posts that were published without review.
* Inkflow helps with these rules but does not guarantee compliance; you remain responsible for what you publish.

= API Cost Estimation (Bring Your Own Key) =

Codrva Inkflow is 100% free to use. You simply plug in your own API keys. You pay direct wholesale costs to the AI providers, which typically run fractions of a penny per article:
* OpenAI (GPT-5 mini), Google Gemini (2.5 Flash) and Anthropic Claude (Haiku) usually cost a few cents or less per article. Check each provider's current pricing page.

= Advanced Features =

**SEO Optimization**

* Related Terms - Semantically related terms suggested to the AI
* Internal Linking - Smart linking to existing content
* Meta Descriptions - Auto-generated SEO descriptions
* FAQ Sections - Optional FAQ section in plain HTML
* Heading Structure - Proper H1-H6 hierarchy

**Monitoring & Analytics**

* Content generation queue status
* API usage and cost tracking
* Feed source monitoring
* Provider performance metrics
* Detailed activity logs

== External Services ==

This plugin connects to third-party AI services that you configure with your own API keys. Data is sent when you generate content, and also automatically on a schedule if you turn on Feed mode or Auto mode (via WP-Cron). In Feed mode, the text of the feed items you subscribe to is sent to your AI provider to write the summary. API keys are stored encrypted in your database.

**WordPress AI connection (optional)**

If your site has an AI provider set up in Settings > Connectors (WordPress 7.0+), Inkflow can send its prompts through it instead of its own keys. Data is then sent to whichever provider you connected there, under that provider's terms. You choose whether Inkflow uses it (Settings > AI Providers).

**OpenAI API**

Used for text generation via GPT models and, if enabled, image generation via gpt-image models.

* What data is sent: Your content prompts, keywords, tone, format and word count; in Feed mode, the feed item text; image prompts derived from your post. No personal user data is transmitted.
* When it is sent: When you generate content, and on schedule when Feed or Auto mode is on, with OpenAI enabled.
* Service URL: https://api.openai.com
* Privacy Policy: https://openai.com/privacy/
* Terms of Service: https://openai.com/terms/

**Google Gemini API**

Used for text content generation via Gemini models.

* What data is sent: Your content prompts, keywords, tone, format and word count; in Feed mode, the feed item text. No personal user data is transmitted.
* When it is sent: When you generate content, and on schedule when Feed or Auto mode is on, with Gemini enabled.
* Service URL: https://generativelanguage.googleapis.com
* Privacy Policy: https://policies.google.com/privacy
* Terms of Service: https://policies.google.com/terms

**Anthropic Claude API**

Used for text content generation via Claude models.

* What data is sent: Your content prompts, keywords, tone, format and word count; in Feed mode, the feed item text. No personal user data is transmitted.
* When it is sent: When you generate content, and on schedule when Feed or Auto mode is on, with Claude enabled.
* Service URL: https://api.anthropic.com
* Privacy Policy: https://www.anthropic.com/privacy
* Terms of Service: https://www.anthropic.com/terms

**Stability AI API (Image Generation - Optional)**

Used for AI image generation when the Stability AI provider is configured and enabled.

* What data is sent: Image generation prompts derived from your post content. No personal user data is transmitted.
* When it is sent: When image generation is enabled with Stability AI configured, including scheduled Feed and Auto runs.
* Service URL: https://api.stability.ai (Stable Image API v2beta)
* Privacy Policy: https://stability.ai/privacy-policy
* Terms of Service: https://stability.ai/terms-of-service

**TextRazor API (LSI Keywords - Optional)**

Used for enhanced semantic keyword extraction when selected as the LSI provider.

* What data is sent: A portion of your generated content text (up to 5,000 characters). No personal user data is transmitted.
* When it is sent: Only when TextRazor is selected as the LSI provider and a valid API key is configured.
* Service URL: https://api.textrazor.com
* Privacy Policy: https://www.textrazor.com/privacy
* Terms of Service: https://www.textrazor.com/terms

**RSS Feed Fetching**

The Feed Generator mode fetches publicly available RSS/Atom feeds from URLs you provide. The plugin uses the WordPress HTTP API (wp_remote_get) to retrieve feed content. No user data is transmitted - only a standard HTTP request is made to the feed URL you configure.

You can disable any provider at any time in plugin settings. All external API calls are logged for transparency and debugging.

== Installation ==

1. Upload the `codrva-inkflow` folder to `/wp-content/plugins/`
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Navigate to Codrva Inkflow > Settings and configure your AI provider API keys
4. Start generating content!

= AI Provider Setup =

1. OpenAI - Get your API key from https://platform.openai.com/. Offers the GPT-5 family and GPT-4.1.
2. Google Gemini - Get your API key from https://aistudio.google.com/. Offers Gemini 2.5 Flash, Pro and Flash-Lite.
3. Anthropic Claude - Get your API key from https://console.anthropic.com/. Offers Claude Sonnet, Opus and Haiku.

Each provider's settings also accept a newer model ID typed by hand, so you can use models released after this version.

== Frequently Asked Questions ==

= What AI providers are supported? =

Codrva Inkflow supports OpenAI (GPT-5 family, GPT-4.1), Google Gemini (2.5) and Anthropic Claude. You can configure one or more providers and the plugin will use them based on priority settings.

= Do I need API keys to use this plugin? =

Yes. You need at least one API key from a supported AI provider. The plugin does not include any AI functionality itself - it acts as an interface to external AI services.

= Is my API key secure? =

API keys are encrypted with AES-256-GCM before being stored. The encryption key combines a random value in the database with a secret from wp-config.php, so a copy of the database alone is not enough to read them. To use your own secret, add `define( 'CODRVA_INKFLOW_ENCRYPTION_KEY', 'a-long-random-string' );` to wp-config.php before entering your keys. If you change the WordPress salts (or that constant), re-enter your API keys.

= Does this plugin work with the block editor (Gutenberg)? =

Yes. Codrva Inkflow includes a native Gutenberg block that generates content directly inside the editor (for logged-in users who can edit posts), plus a shortcode [codrva_inkflow_form] that places a public request form. Submitted requests are stored as Pending Review posts for an editor to approve — public submissions never trigger automatic (paid) generation.

= Can I generate content in multiple languages? =

Yes. Codrva Inkflow supports content generation in 10+ languages including English, Spanish, French, German, Italian, Portuguese, Dutch, Russian, Japanese, and Chinese.

= What content formats are supported? =

The plugin supports Article, How-To, Listicle, Review, News, and Tutorial formats with configurable word count (100-10,000 words).

= Is the generated content unique? =

Each generation is new text, and feed mode skips items it has already processed. Unique text is not enough to rank, though: review drafts, add your own expertise, and avoid publishing in bulk.

= Does the plugin label AI content? =

Yes. Posts published by Feed or Auto mode without a person reviewing them always show a short AI notice at the top. You can also show a notice on reviewed posts, and change both texts, in Settings > AI Disclosure. Generated images carry the IPTC "trainedAlgorithmicMedia" marker in the file and the caption "AI-generated image".

= What about image generation? =

The plugin supports optional AI image generation via OpenAI (gpt-image) and Stability AI (Stable Image Core, Ultra and Stable Diffusion 3.5). Configure your preferred provider in Settings > Image Providers.

= Can AI agents use Inkflow? =

On WordPress 6.9+ Inkflow registers two abilities: "Generate a blog post draft" (always a draft, counted in the daily limit, Authors and above) and "List AI posts waiting for review". With the MCP Adapter plugin, MCP clients can use them as the logged-in user. There is deliberately no ability to publish or to mark a post reviewed.

== Screenshots ==

1. Manual content generator with keyword, tone, and format options
2. Settings page with AI provider configuration
3. Feed-based content generation management
4. Auto-posting configuration and scheduling
5. Activity logs and diagnostics dashboard
6. Security settings: frontend form access control and public submission options

== Changelog ==

= 2.2.1 =
* Fixed: On sites set to discourage search engines, posts made from feeds got a contradictory robots tag ("noindex, nofollow, follow"). Feed posts now add "follow" only when the site has not already set "nofollow".

= 2.2.0 =
* New: Settings > AI Disclosure. Posts published without human review always show an AI label (optional label for reviewed posts); a post counts as reviewed when an editor publishes, schedules or updates it.
* New: Daily limit for posts created without a person starting them (Feed, Auto and AI agents together, default 10).
* New: Byline (author) setting for Feed and Auto mode.
* New: Use the site's WordPress AI connection (Settings > Connectors, WordPress 7.0+) as a provider, first or as a fallback, without a separate key in Inkflow.
* New: Abilities API support (WordPress 6.9+): "Generate a blog post draft" and "List AI posts waiting for review", available to AI agents and MCP clients. Agents cannot publish or mark posts reviewed.
* New: "Inkflow AI Writer" block (block.json, API version 3). The draft is inserted as normal paragraph, heading and list blocks; posts made with the old block keep working and can be converted with one click.
* Changed: Current AI models (GPT-5 family, Gemini 2.5, Claude Sonnet/Opus/Haiku 5.5). Saved retired models switch to the current default automatically, and you can type a newer model ID.
* Changed: Feed mode writes a short original summary with a visible credit link to the source instead of rewriting the full article, and keeps those posts out of search results by default.
* Changed: Prompts no longer ask for statistics, external links or "honest reviews"; the AI is told not to invent facts, quotes, prices or personal experience. Review-type auto titles are now buyer's-guide titles.
* Changed: Related (LSI) terms are suggested to the AI instead of being appended as filler sentences.
* Changed: Generated images carry the IPTC "trainedAlgorithmicMedia" marker, the caption "AI-generated image" and alt text that describes the post or section.
* Changed: Stability AI uses the Stable Image API (Core, Ultra, Stable Diffusion 3.5).
* Changed: All code, options, post meta, tables, scheduled events and AJAX actions use the codrva_inkflow prefix. Existing data is moved automatically on first load.
* Security: Feed, Auto and Manual actions require an administrator; generating from the block editor requires Author or above (filter: codrva_inkflow_generate_capability). Previously a Contributor could publish feed posts and spend the site's API credits.
* Security: API requests no longer retry with SSL certificate checks turned off; the Gemini key is sent in a header instead of the URL.
* Security: API keys use AES-256-GCM with a key that needs both the database and wp-config.php; existing keys are re-encrypted automatically. Optional CODRVA_INKFLOW_ENCRYPTION_KEY constant.
* Security: Feed-based and block-generated content is filtered with wp_kses_post.
* Security: The logs folder has an unguessable name (protects logs on nginx too) plus deny rules for Apache and IIS; the old logs folder is deleted. The settings debug action no longer returns API keys.
* Fixed: Claude and Gemini did not work out of the box because their default models had been retired; GPT-5 models get the request format they require; long articles are no longer cut off at 4,000 tokens.
* Fixed: The editor block was never registered, so it did not appear in the block editor.
* Fixed: "Schedule for Future" in Auto mode published posts immediately; scheduled posts now get their date in the site's time zone.
* Fixed: Activating on a fresh site printed a database error ("Duplicate key name").
* Fixed: The Stability AI model choice was not being saved.
* Fixed: Block generation now uses the right length range for the requested word count.
* Fixed: Uninstall now removes every option and table the plugin created.
* Removed: Midjourney (no public API) and Leonardo AI (did not work) image providers, and FAQ microdata that WordPress removed on save anyway.

= 2.0.2 =
* Fixed: Feed posts now honor the "Generated Post Status" setting (e.g. Publish Immediately) instead of always saving as draft.
* Fixed: Feed posts generated during scheduled (cron) runs are now assigned a valid author instead of having no author.
* Fixed: Posts set to "Publish" are no longer silently downgraded to draft during scheduled (cron) runs.
* Fixed: Feed "Check Frequency" setting now actually reschedules the background check (including a new 15-minute interval) instead of being ignored.
* Fixed: Bulk CSV upload now generates the posts immediately instead of queuing them to a processor that never ran (up to 25 rows per upload).
* Fixed: LSI / semantic keyword enrichment now inserts keywords without breaking the article's HTML, and is enabled again.
* Fixed: Auto-posting no longer silently skips the whole day when WP-Cron fires a few minutes late on low-traffic sites; a scheduled time now posts as soon as its slot has arrived (catch-up), still capped by the daily post limit.

= 2.0.1 =
* Refreshed all admin icons with a clean, modern line-icon style and replaced the emoji in the support banners with a proper icon. Visual-only.

= 2.0.0 =
* Redesigned admin interface: a calmer, more compact, and consistent UI across all pages (Dashboard, Settings, Manual, Feeds, Auto, Diagnostics, Logs). Flatter cards, a refined header, subtle badges, compact buttons and forms, denser layouts (less scrolling). Visual-only update — no change to functionality, settings, or data.

= 1.2.0 =
* New: Manual Generator can now let you choose exactly which sections get inline images. Select "Let me choose which sections get images" for placement, generate the article, then tick the headings you want and generate images for just those sections.

= 1.1.0 =
* Auto Posting now fully honors its configuration: it generates featured and inline images (per the toggles, count, and image-style pool), varies word length and language from their pools, and applies your configured tags.
* Frontend form now enforces the "Max Requests per Hour" rate limit and the "Allowed User Roles" restriction from Settings > Security.
* AI API calls now honor the "Request Timeout" setting.
* Removed settings controls that had no effect (CAPTCHA, admin-approval toggle, max concurrent requests, content compression, keyword density target, meta description length, and the API/user-action log toggles) so the UI only shows options that actually work.

= 1.0.9 =
* Improved image generation options: the selected Image Style is now applied to every image prompt (including feed featured images); added an Image Quality control (auto/low/medium/high); featured/thumbnail images are now generated in landscape for better headers while inline images keep their configured size.

= 1.0.8 =
* Fixed: AI image generation was failing on current OpenAI API keys. The plugin now uses OpenAI's current image models (gpt-image-1) instead of the retired DALL-E models, and no longer sends parameters OpenAI rejects (response_format, style). Existing DALL-E selections are migrated automatically.
* Fixed: Image saving could fatally error during feed/auto/scheduled generation because WordPress media functions were not loaded in those contexts. The required dependencies are now loaded before image processing.
* Both featured (thumbnail) and inline images now generate and embed correctly, including for feed-based posts.
* Settings: image model/size choices updated to the gpt-image options.

= 1.0.7 =
* UI: Refined the admin interface with calmer, less oversized typography (smaller headings, lighter weights, tidier spacing). No functional changes.

= 1.0.6 =
* Fixed: Feed settings appeared to save ("saved successfully") but reverted after refresh. The save now writes to the same option the form and the feed engine read, so settings persist correctly.
* Fixed: Auto-posting engine read its settings from a separate option that the save never updated, so it ran on stale/default values. The save now keeps that option in sync.
* Improved: Feed image generation now honors your saved image settings — the featured-image toggle, image style, preferred provider, and inline-image count (inline images are now generated for feed posts when enabled).

= 1.0.5 =
* Fixed: admin pages' JavaScript did not initialize after the plugin rename, which broke the Settings tabs and prevented API keys/settings from saving. All admin pages now initialize correctly.
* Updated AI model choices for OpenAI, Google Gemini, and Anthropic Claude (added current models, removed retired ones) and refreshed the default model for each provider.
* Settings: AI provider configuration is now shown in a responsive two-column layout.

= 1.0.4 =
* Updated the plugin display name to "Codrva Inkflow - AI Content Generator" for clarity

= 1.0.3 =
* Security: Added nonce (CSRF) verification to the diagnostics AJAX handler
* Frontend request form is now fully functional via the [codrva_inkflow_form] shortcode (submits content requests as Pending Review posts; includes honeypot and per-IP rate limiting; public submissions are opt-in)
* Gutenberg "Content Generator" block now works, generating content directly in the editor for users who can edit posts
* Added "Allow logged-out visitors to submit requests" option under Settings > Security
* Improved and simplified AI image-generation prompt logic (single shared style map)
* Featured/thumbnail image now renders the post title as a clean cover headline
* New "Inline Image Placement" option (after each heading, after the first few headings, or evenly) to control where in-between images are inserted
* Tested up to WordPress 7.0
* Removed development artifacts accidentally included in the package

= 1.0.1 =
* Renamed plugin to Codrva Inkflow to comply with WordPress.org trademark guidelines
* Added comprehensive external services documentation
* Improved input sanitization across all form handlers
* Fixed PHP syntax error in diagnostics page
* Scoped set_time_limit() to specific function only

= 1.0.0 =
* Initial release
* Manual, Feed, and Auto content generation modes
* Multi-AI provider support (OpenAI, Gemini, Claude)
* SEO optimization features (LSI keywords, internal linking, meta descriptions)
* Comprehensive admin interface
* Frontend form via shortcode and Gutenberg block
* Security features (AES-256 encryption, input sanitization, CSRF protection)
* Performance optimizations (caching, asynchronous processing)
* Comprehensive logging and diagnostics

== Upgrade Notice ==

= 2.2.1 =
Small fix to the robots tag on feed-based posts.

= 2.2.0 =
Important: Claude and Gemini work again (retired models replaced). Adds AI disclosure labels, review tracking and a daily posting limit, the WordPress AI connection, Abilities and a rebuilt editor block, and tightens security. Settings and data move to the new codrva_inkflow names automatically; back up your site before updating.

= 2.0.2 =
Feed posts now respect the Publish Immediately setting and get a valid author on scheduled runs.

= 2.0.1 =
Modernized admin icons and removed emoji from the support banners. Visual-only.

= 2.0.0 =
Redesigned, cleaner and more compact admin interface. Visual-only — no functional changes.

= 1.2.0 =
New: choose exactly which article sections get inline images in the Manual Generator.

= 1.1.0 =
Auto Posting now generates images and honors its pools/tags; frontend rate limit and user-role restriction now enforced; request timeout applied; non-functional settings removed.

= 1.0.9 =
Better image options: style applied to all prompts, image quality control, and landscape featured images.

= 1.0.8 =
Important fix: AI image generation now works with current OpenAI keys (gpt-image models) and no longer fatals during feed/auto generation. Recommended for anyone using images.

= 1.0.7 =
Visual refinement of the admin UI (calmer typography). No functional changes.

= 1.0.6 =
Fixes feed settings not persisting after save, auto-posting using stale settings, and feed image generation now respecting your image options. Recommended.

= 1.0.5 =
Important fix: restores the Settings tabs and saving of API keys/settings (broken since the rename). Also refreshes AI model choices. Recommended for all users.

= 1.0.4 =
Display name updated to "Codrva Inkflow - AI Content Generator". No functional changes.

= 1.0.3 =
Security fix (diagnostics nonce), working frontend request form and Gutenberg block, improved image prompts (title on thumbnail, inline placement control). Recommended update.

= 1.0.1 =
Plugin renamed to Codrva Inkflow. Please update your bookmarks. All functionality remains the same.
