=== Publicator AI ===
Contributors: publicatorai
Tags: ai, content, publishing, automation, seo
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 8.3.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Official Publicator AI integration. Auto-publish AI-written articles, sync taxonomies, and manage SEO metadata — all from one dashboard.

== Description ==

**Publicator AI is an AI-powered content marketing platform that researches keywords, writes SEO-optimised articles in your brand voice, and publishes them straight to your WordPress site on a schedule you control.**

This is the official WordPress companion plugin. Once you install it and connect your site to your Publicator AI project, every piece of content you approve in the Publicator AI dashboard appears on your blog automatically — fully formatted, with the right categories, tags, featured image and SEO meta tags already in place. No copy-pasting. No CMS context-switching. No broken HTML.

= Why use Publicator AI? =

Most WordPress site owners juggle a separate AI writer, an SEO plugin, an image generator and a copy-paste workflow. Publicator AI replaces that loop with a single platform that:

* **Researches what your audience is actually searching for** and turns it into a content plan you can edit.
* **Writes long-form articles** that match your brand voice, tone and length preferences.
* **Generates or sources featured images** so every post ships ready to publish.
* **Publishes directly to WordPress** via this plugin — instantly or on a future schedule.
* **Keeps your taxonomies in sync** so the AI knows which categories and tags actually exist on your site.
* **Writes the SEO meta** (title, description) and hands it to Yoast, Rank Math or All in One SEO automatically.

= What this plugin does =

* Connects your WordPress site to your Publicator AI project with a single sign-in flow, **or** by pasting an API key copied from your Publicator AI dashboard — pick whichever fits your account type.
* Receives finished posts from Publicator AI and creates them as native WordPress posts (status: published or scheduled).
* Re-publishes updates idempotently using an external ID, so re-running a publish never duplicates content.
* Sideloads the featured image into your Media Library with proper alt text.
* Resolves and creates categories and tags on the fly, and syncs the full taxonomy back to Publicator AI on demand.
* Writes SEO title and meta description into Yoast SEO, Rank Math or All in One SEO automatically — whichever you have active.
* Exposes a small, locked-down REST API namespace (`publicator-ai/v1`) authenticated with a project-scoped key — no Application Password or admin credentials are ever sent over the wire after the initial setup.
* Ships a clean, modern settings screen — no buried admin pages, no clutter.

= Security =

* All requests to the Publicator AI platform go over HTTPS to our Supabase Edge Functions.
* The plugin stores only a session token and a project-scoped API key. Your Publicator AI account password is never stored.
* Inbound REST requests are validated with a hashed-comparison check against the per-project API key.
* Deactivating the plugin tells the Publicator AI platform that the connection is offline, so scheduled posts can pause cleanly.

= Who is it for? =

* Content teams running AI-assisted publishing at scale.
* SEO agencies managing multiple client sites who want one dashboard instead of N WordPress logins.
* Solo bloggers and SaaS marketing teams who want a steady cadence of well-optimised content without hiring a full editorial team.

More information and full documentation: [https://publicator.ai/](https://publicator.ai/)

== External Services ==

This plugin connects to external services to provide its functionality. By installing and activating the plugin, you agree to the following:

**1. Publicator AI (https://publicator.ai/)**

The core service this plugin integrates with. Used for authentication, project management, content publishing, and taxonomy synchronisation.

* Privacy Policy: https://publicator.ai/privacy-policy
* Terms of Service: https://publicator.ai/aszf
* Cookie Policy: https://publicator.ai/cookie-policy

**2. Supabase (https://supabase.com)**

Publicator AI uses Supabase as its backend infrastructure. The plugin communicates directly with Publicator AI's Supabase Edge Functions (https://wfjirakgiglsowunllsq.supabase.co/functions/v1/) to handle authentication, project data, and taxonomy synchronisation. No Supabase credentials are stored in the plugin — the Edge Functions handle all authentication internally.

Data sent, and when:

* **Administrator email address and password** — sent once during sign-in. Credentials are not stored by the plugin; only the returned session tokens are stored in the WordPress options table.
* **WordPress site URL and plugin version** — sent when an administrator connects a project.
* **Category and tag names, slugs and IDs** — sent when an administrator manually triggers a taxonomy synchronisation.
* **Connection status (connected / disconnected)** — sent on connect and disconnect.
* **Theme appearance settings (colours, fonts, font sizes, content width, button radius)** — detected from the active theme and sent to Publicator AI, either automatically (to pre-fill personalisation) or when an administrator reviews and approves them via the "Synchronize appearance" button. These describe the theme's design tokens only; no visitor or personal data is included.

No data is sent automatically or without a deliberate action by the site administrator. End-user (visitor) data is never collected or transmitted.

* Privacy Policy: https://supabase.com/privacy
* Terms of Service: https://supabase.com/terms

== Installation ==

1. Upload the `publicator-ai` folder to `/wp-content/plugins/`, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Open the **Publicator AI** menu item in the WordPress sidebar.
4. Pick a connection method:
   * **Email + password** — sign in with your Publicator AI account, pick the project you want to connect, and click **Connect**.
   * **API key** — open the Publicator AI dashboard, copy your project's API key (`sk_…`), paste it into the API key field, and click **Connect**. Recommended for accounts that signed up via Google or another social login, since those accounts don't have a password to sign in with.

That's it — your site is now wired up. Any content you publish from the Publicator AI dashboard will appear here automatically.

== Frequently Asked Questions ==

= Do I need a Publicator AI account to use this plugin? =

Yes. The plugin is the bridge between WordPress and your Publicator AI project. You can create an account at [https://publicator.ai/](https://publicator.ai/).

= I signed up with Google — how do I connect the plugin? =

Use the **API key** connection method. Open your Publicator AI dashboard, copy your project's API key (it starts with `sk_`), paste it into the API key field on the plugin settings page, and click **Connect**. The email + password option only works for accounts that have a Publicator AI password set.

= Is the plugin free? =

The plugin itself is free and open source (GPLv2). It connects to the Publicator AI platform, which has its own subscription plans.

= What WordPress and PHP versions are supported? =

WordPress 5.8 or newer, and PHP 7.4 or newer. WordPress Application Passwords must be enabled (they are enabled by default on a standard WordPress install).

= Does it work with my SEO plugin? =

Yes. The plugin auto-detects Yoast SEO, Rank Math and All in One SEO, and writes the SEO title and meta description to whichever is active. If none is active, the values are stored as standard post meta you can read with any tool.

= Will publishing overwrite my existing posts? =

No. Every post is tagged with an `external_id` from Publicator AI. The first publish creates a new post; subsequent publishes with the same `external_id` update that same post. Posts not created by Publicator AI are never touched.

= Where are my credentials stored? =

Your Publicator AI password is **not stored**. Only the short-lived session token (JWT), refresh token and the project-scoped API key are stored in the WordPress `options` table. You can revoke access at any time from the plugin's settings page or from your Publicator AI dashboard.

= How do I disconnect a site? =

Open the **Publicator AI** menu in WordPress and click **Disconnect**. This notifies the Publicator AI platform and removes the stored tokens from this site.

= Does the plugin send any visitor data to a third party? =

No. The plugin only acts on explicit administrator actions (sign in, connect project, sync taxonomies, receive a publish call). No analytics, tracking or visitor data is collected.

= I uninstalled the plugin — is my data cleaned up? =

Yes. When you delete the plugin from WordPress (not just deactivate), the `uninstall.php` routine removes the stored connection options and session transients.

== Screenshots ==

1. The Publicator AI settings screen after a successful connection — shows the masked project API key, the connection timestamp, the connected site URL, and a one-click taxonomy sync. Disconnecting is one button away.
2. First-time setup: a four-step onboarding panel and the secure sign-in form for your Publicator AI account. No API keys to copy or configure manually.
3. After signing in, pick which Publicator AI project to wire this WordPress site to and click Connect — the plugin handles the rest.

== Changelog ==

= 8.3.3 =
* **Webapp-identical visual layer.** Loads Inter for body and Space Grotesk for headings (matching the Publicator AI web app), true-black primary buttons and toggles, softer signature card shadow, locked-down 8/12/16/24 radius scale, 256px sidebar, lucide-style stroked icons throughout, animated tab transitions, and a horizontal-scroll tab strip on mobile.
* **KPI overview tiles.** Published / Scheduled / Categories / Tags are now full webapp-style cards with colored icon tiles, Space Grotesk numbers, hover lift, and click-through to the matching Publicator AI dashboard view.
* **Recent publications panel.** The Overview tab now lists the 5 most recent Publicator AI posts on this site with native status badges (Published / Scheduled / Draft / Pending / Private) and direct permalinks.
* **Live CTA preview** on the Appearance tab — the button reflects the chosen primary colour and corner radius in real time as you edit.
* **Sidebar account card** with project initial, status dot, and a dropdown for *Open in Publicator AI*, *Plugin settings*, and *Disconnect*. The plugin is tied to a single project per site so no project switcher is needed; the card stays focused on this site's connection.
* **Toast notifications.** New top-right toast queue (success / error / warning / info) replaces inline notices for transient feedback after sync, copy, and connection actions.
* **Custom modal** replaces native `confirm()` for the disconnect flow — branded, focus-trapped, ESC to close, keyboard-friendly.
* **Test connection button** on the Connection tab gives an instant *Publicator AI is reachable* health check without leaving the settings screen.
* **Disconnect & clear connection (keep posts).** New Settings action removes the link between this site and Publicator AI and clears the brand cache, while every post already published by Publicator AI stays on your site untouched.
* **WordPress admin bar status.** A small connection dot in the top admin bar tells you at a glance whether the plugin is live, with quick links to the plugin settings and the Publicator AI dashboard.
* **Plugin row links.** *Settings* and *Open Publicator AI* appear next to Deactivate on the Plugins screen; *Documentation* and *Support* land in the row metadata.
* **Site Health checks.** *Connection state*, *HTTPS*, and *Recent publish failures* now appear in *Tools → Site Health*, giving admins a single place to verify the integration.
* **GDPR exporters and erasers.** Personal data requests against the connected admin's email address now resolve through the standard WordPress privacy tooling.
* **Failure notifications to ops.** Publish failures are written to a local rolling log and, throttled to one mail per (code, day), emailed to `balint@publicator.ai` and `milan@publicator.ai` with a slim diagnostic payload — the team hears about problems before customers report them.
* **Hardened CORS.** REST cross-origin access is now restricted to `publicator.ai`, `*.publicator.ai` and `*.supabase.co` instead of mirroring whatever origin asks. Filterable via the `publicator_ai_allowed_origins` filter for staging hosts.
* **HTTPS enforced for sign-in.** Email + password login is refused when the WordPress admin itself is not on HTTPS. The API-key connection method remains available as a workaround.
* **Better client IP detection** behind reverse proxies for CTA-click rate limiting (Cloudflare / Nginx `X-Forwarded-For` is honoured).
* **Unified HTTP client** with bounded retries + exponential backoff is now used for all outbound calls to the Publicator AI server, so transient network blips are absorbed instead of escalated.
* **Configurable API base.** Define `PUBLICATOR_AI_API_BASE` (via `define('PUBLICATOR_API_BASE', '...')` in `wp-config.php`) to point staging sites at a different Edge Functions host without editing the plugin.
* **Per-author publishing.** A new *Default author for Publicator AI posts* picker on the Settings tab lets you pick which WordPress user owns posts published by the platform. When the publish payload includes an explicit `author.email` that matches a user on this site, that user is used instead. The fallback chain ends at the oldest administrator, so a post always has a real author.
* **Onboarding wizard.** On first connect, the Overview tab now shows a four-step setup card: *Connect → Sync categories & tags → Review appearance → Test connection*. Each step is auto-marked done when the underlying action succeeds; the card disappears once all four are complete (or the user skips). State persists across reloads.

= 8.3.2 =
* Admin polish: black active / grey hover sidebar items (matching the web app), an account card in the sidebar (site + plan status), and a Disconnect option in the Settings tab as well.
* Reworked the Appearance tab into a clear "currently saved → new (from your theme)" comparison with a Detect theme button. Font sizes, content width and button radius are now foolproof dropdowns (fixed pixel values), and colours have proper pickers and examples.

= 8.3.1 =
* Redesigned admin screen: a clean white, left-sidebar layout that matches the Publicator AI web app, with the brand colours.
* Fixed: the admin interface is now fully translated (the navigation no longer showed English labels when the plugin language was set to Hungarian or another language).
* Fixed: the connection status badge now aligns correctly.
* Fixed: taxonomy sync now works for API-key connections too (not only email-login); the misleading note was removed.

= 8.3.0 =
* New: full-page tabbed admin screen (Overview, Connection, Appearance, Categories & tags, Settings) replacing the single settings page and the appearance popup. The Overview tab pulls live publication stats from your Publicator AI project.
* New: call-to-action click tracking. Clicks on Publicator AI CTA buttons are measured and reported to your Publicator AI analytics. The button carries a `data-cta-id`; the click is forwarded server-side so the project key is never exposed in the browser.
* Improved: the appearance review now reads back the values currently stored in Publicator AI, and approving reliably saves the full set (colours, fonts, sizes, content width, button radius).
* Improved: post status reverse-sync now also reports the numeric WordPress post ID.

= 8.2.1 =
* New: one-click appearance sync. A "Synchronize appearance" button opens a popup that shows the colours, fonts, sizes and content width detected from your theme — side by side with what is currently stored in Publicator AI. Review or edit any value and approve to save it to your Publicator AI brand settings.
* New: optional on-site typography. From the same popup you can choose to apply the approved fonts and sizes to posts published by Publicator AI. It is off by default, so your theme keeps full control unless you opt in.
* Improved: theme style detection now also reads heading fonts, named font sizes and the button corner radius.

= 8.2.0 =
* New: server-side call-to-action blocks. CTAs are now rendered by the plugin from structured data, so their appearance can be restyled with a plugin update — no article re-generation required.
* New: front-end protection stylesheet and JSON-LD schema output. Publicator posts load a scoped stylesheet that works across classic themes, block themes and page builders, and emit their stored schema into the page <head> for richer search results.
* New: theme style detection. The plugin reads your active theme's colours, fonts and content width and shares them with Publicator AI so content personalisation is pre-filled instead of guessed.
* New: reverse sync. When you change a Publicator post's status or edit it in WordPress, the change is reported back to the Publicator AI platform.
* Improved: the publishing pipeline now honours an explicit post status (publish, draft or pending) from the payload, and post content is sanitised through a tightened allowlist.

= 8.1.2 =
* Fix: API-key mode now notifies the server on deactivation; email mode now notifies on uninstall. Disconnects are recorded immediately in both auth modes regardless of how the plugin is removed.

= 8.1.1 =
* New: language picker on the settings screen. Choose the plugin interface language independently from your WordPress site locale — supported languages: English, German, Spanish, Italian, Slovak, and Hungarian. Hungarian is the default.
* Improved: the connection status badge and the auth-method chip now line up on the same row at the same height in the connected state.

= 8.1.0 =
* New: second connection method — paste a project API key copied from your Publicator AI dashboard instead of signing in with email and password. Recommended for accounts that signed up via Google or another social login. The disconnected settings screen now exposes a pill toggle to switch between the two methods, and the connected screen shows which method is in use.
* New: automatic-updates toggle on the settings screen. When enabled, WordPress core installs new releases of the plugin from the official directory within ~12 hours of publication, with no admin action required. Shipped off by default with a (Recommended) hint.
* Improved: disconnect now flows through the correct backend path for each connection mode (JWT-based for email login, key-based for API-key connections) so the project status on the Publicator AI dashboard flips to disconnected immediately.
* Improved: uninstall notifies the Publicator AI platform for API-key connections so the project state is cleaned up server-side even when the plugin is deleted from WP-Admin.

= 8.0.2 =
* Replace the WordPress.org directory header banner with the official Publicator AI brand wordmark for a consistent, recognisable listing across the catalog and inside WordPress admin.

= 8.0.1 =
* New: incoming `post.excerpt` from the publishing payload is now mapped to the WordPress Excerpt field. Posts that arrive with an excerpt no longer end up with an empty Kivonat.
* New: full English-primary copy across the plugin header, settings screen, and admin notices; Hungarian translation shipped (`hu_HU`, 47 strings) so existing Hungarian sites keep their native UI.
* New: WordPress.org directory assets — high-resolution logo icon (128×128 and 256×256), header banners (772×250 and 1544×500), and three screenshots of the connection flow.
* New: proper `uninstall.php` removes the stored connection option, login transients, and the multisite variant when the plugin is deleted.
* Fix: REST route `/taxonomies/{term_id}` regex was double-escaped and never matched a numeric term ID — DELETE now works as documented.
* Fix: sideloaded featured-image filename fallback regex was double-escaped — extension-less image URLs now get a `.jpg` suffix as intended.
* Improved: connection timestamp uses the WordPress site's own date/time format instead of a hard-coded Hungarian pattern.
* Improved: rewritten readme.txt with a clear value proposition, expanded FAQ, real screenshot captions, and proper changelog/upgrade-notice blocks.

= 8.0.0 =
* First public release on the WordPress.org plugin directory.
* Sign-in based onboarding — no manual API-key handling.
* Idempotent publishing keyed by `external_id`.
* Featured image sideloading with alt text.
* Category and tag auto-creation plus on-demand full sync.
* SEO meta integration for Yoast SEO, Rank Math and All in One SEO.
* Hungarian translation included (`hu_HU`).

== Upgrade Notice ==

= 8.3.3 =
100% web-app visual parity (Inter + Space Grotesk, true-black CTAs, soft signature shadow, lucide icons), KPI overview tiles with a recent publications panel, live CTA preview, toast notifications, branded confirmation modal, *Test connection* button, *Disconnect & clear (keep posts)*, WP admin-bar status dot, Site Health checks, GDPR exporters/erasers, failure email to the Publicator AI ops team, hardened CORS, HTTPS-required sign-in, retrying HTTP client. Plus a *Default author* picker for per-author publishing and a four-step onboarding wizard on the Overview tab. Safe in-place upgrade.

= 8.1.2 =
Disconnects now reach the Publicator AI server reliably in both connection modes, whether the plugin is deactivated or deleted. Safe in-place upgrade.

= 8.1.1 =
Adds a language picker (English, German, Spanish, Italian, Slovak, Hungarian — Hungarian by default) and fixes the alignment of the connection-status row. Safe in-place upgrade.

= 8.1.0 =
Adds an API-key connection method for Google-signup accounts, an automatic-updates toggle on the settings screen, and cleaner disconnect/uninstall handling for both connection modes. Safe in-place upgrade.

= 8.0.2 =
Cosmetic update — the WordPress.org directory banner now uses the official Publicator AI wordmark. No code changes.

= 8.0.1 =
Maintenance release: excerpts sent from Publicator AI now land in the WordPress Kivonat field, full English UI with Hungarian translation, branded directory assets, and small REST/sideload bug fixes. Safe in-place upgrade.

= 8.0.0 =
First public release. Connect your site once and any future content from your Publicator AI project will publish here automatically.
