=== Eldrafto ===
Contributors: eldrafto
Tags: ai, content, elementor, publishing, automation
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.5.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Publish AI-generated content from the Eldrafto content service straight to WordPress, as Elementor layouts or Gutenberg blocks.

== Description ==

Eldrafto connects your WordPress site to the **Eldrafto content service** (https://eldrafto.com), a third-party AI service that researches a topic, generates the content, and sends it to your site to be published as an Elementor layout or as Gutenberg blocks.

This plugin is the WordPress-side receiver. It exposes a small, token-authenticated REST API that the Eldrafto service calls to:

* create and update draft or published posts,
* build native Elementor container layouts (or fall back to Gutenberg blocks when Elementor is not installed),
* report a post's status and Elementor state back to your Eldrafto account,
* add a machine-readable AI provenance statement to the pages it creates.

You stay in control: in manual mode the service saves a draft and stops so you can review and publish it yourself; in auto mode it publishes immediately.

= AI provenance marking =

Pages created by this plugin carry a small, signed JSON-LD statement in the page head declaring that the content was generated by AI, using the IPTC `digitalSourceType` vocabulary. The statement itself is invisible to readers and exists so the content stays identifiable as AI-generated. Pages that Eldrafto publishes without human review additionally carry a small visible "AI-generated" label at the top of the content; site owners can restyle it via the `eldrafto_ai_disclosure_text` filter or remove it via `eldrafto_ai_disclosure_enabled`. This is required of the Eldrafto service by Article 50 of the EU AI Act (Regulation (EU) 2024/1689).

It is added only to posts this plugin created. Nothing else on your site is touched.

= External service (required reading) =

**This plugin requires an account on the Eldrafto service (https://eldrafto.com) and does nothing on its own.** The article content is generated on Eldrafto's servers, not on your site.

What the plugin sends out: when you configure an API Callback URL in the settings, the plugin sends post-status changes and Elementor activation/upgrade state to that URL so your Eldrafto dashboard stays in sync. Each callback is signed with the shared secret token; no content is sent anywhere until you enter that token and callback URL.

What the plugin receives: article titles, body text, layout structure, and image references that the Eldrafto service generates for you, delivered over the authenticated REST endpoints.

The plugin only ever contacts the callback URL **you** enter on its settings page. It does not phone home to any other server.

* Service: https://eldrafto.com
* Terms of Service: https://eldrafto.com/terms
* Privacy Policy: https://eldrafto.com/privacy

The Eldrafto service may be a paid subscription. See https://eldrafto.com for current plans and terms.

== Installation ==

1. Install and activate the plugin through the WordPress "Plugins" screen, or upload the `eldrafto` folder to `/wp-content/plugins/`.
2. In your Eldrafto dashboard (https://eldrafto.com), connect a new WordPress site to obtain a secret token.
3. In WordPress, go to **Settings -> Eldrafto** and paste the secret token. (The API Callback URL is normally filled in automatically when Eldrafto first contacts your site; you can also set it here.)
4. Optionally, choose the System User used for editor "Take Over" handovers.
5. Create content from your Eldrafto dashboard; drafts appear under Posts for review (manual mode) or are published automatically (auto mode).

Elementor (free or Pro) is recommended for full layout support but is not required; without it, content is published as Gutenberg blocks.

== Frequently Asked Questions ==

= Do I need an Eldrafto account? =

Yes. This plugin is a receiver for the Eldrafto content service. Without an active account at https://eldrafto.com it has nothing to publish.

= What data leaves my site? =

Only post-status changes and Elementor state, signed with your secret token, sent to the API Callback URL you configure. Nothing is transmitted until you enter a token and callback URL.

= Does it require Elementor? =

No. Elementor (free or Pro) unlocks full container layouts. If Elementor is not active, content is published as standard Gutenberg blocks.

= Is the service free? =

The plugin is free and GPL-licensed. The Eldrafto service it connects to may require a paid subscription; see https://eldrafto.com.

= How is the connection secured? =

All REST requests from the service carry a secret token that must match the one saved on the settings page (compared in constant time). All outbound callbacks are signed with an HMAC-SHA256 signature derived from that same token.

== Screenshots ==

1. The Eldrafto settings screen, where you paste the secret token and callback URL.
2. An AI-generated article published as an Elementor container layout.

== Changelog ==

= 1.5.1 =
* Pages published before 1.5.0 now show the "AI-generated" label too. They carry no disclosure flag at all, and the label was previously shown only when a flag was present, so older AI-published pages stayed unlabelled. A missing flag now means show the label, which is what the receiving side already assumed.
* A page you reviewed and published yourself before 1.5.0 is labelled as well, because nothing stored on the site tells the two apart. Remove it from any page with the `eldrafto_ai_disclosure_enabled` filter.

= 1.5.0 =
* Pages published without human review now show a small visible "AI-generated" label at the top of the content, alongside the existing machine-readable statement in the page head. Required by EU AI Act Article 50(4).
* The label can be restyled with the `eldrafto_ai_disclosure_text` filter or switched on/off for every page with `eldrafto_ai_disclosure_enabled`. Pages you review and publish yourself do not carry it.

= 1.4.0 =
* Generated pages now carry a machine-readable provenance statement in the page head, declaring the content as AI-generated (IPTC digitalSourceType, signed and timestamped). Required by EU AI Act Article 50(2).
* Internal: the shared post meta applied by every publish route moved into one helper, so the three routes can no longer drift apart.

= 1.3.4 =
* New token-gated /widget-schema REST route: returns Elementor's registered control schema per widget (dev tool for the mold-authoring pipeline).

= 1.3.3 =
* The frontend cover-fill CSS is now registered through wp_enqueue_style()/wp_add_inline_style() instead of being printed inline in the page head.

= 1.3.2 =
* New signed "Open in WordPress" deep link: reaches the right editor whether or not you are logged in, including on sites that hide their login page.

= 1.3.1 =
* Security: the public health-check endpoint no longer accepts the webhook callback URL; it is registered only over the token-authenticated site-info route.

= 1.3.0 =
* Report the site's real login URL over the token-authenticated site-info route so "Open in WordPress" links route through the correct login.

= 1.0.0 =
* First public release on WordPress.org.

== Upgrade Notice ==

= 1.3.2 =
"Open in WordPress" links now work reliably on sites with hidden login pages. Update recommended.
