=== BulkPublishing.AI Connector ===
Contributors: bulkpublishingai
Tags: publishing, ai, content, automation, rest-api
Requires at least: 5.6
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

One-click secure connection between your WordPress site and BulkPublishing.AI. No Application Passwords, no REST API setup — just click Connect and publish.

== Description ==

The BulkPublishing.AI Connector links your WordPress site to your BulkPublishing.AI account with a single click. Once connected, you can generate and publish articles — complete with images, categories, tags, SEO slugs and excerpts — straight from your BulkPublishing.AI dashboard.

**Why use the connector instead of Application Passwords?**

* **One click.** No copying Application Passwords, no enabling the REST API, no pasting credentials.
* **More secure.** The connector never stores your raw API token. Only a SHA-256 hash is kept on your site, and tokens are verified in constant time.
* **Owner-aware.** Posts are attributed to the WordPress user who created the connection unless you choose another author.
* **Clean uninstall.** Removing the plugin deletes every option it created and never touches your content.

**What you can do once connected:**

* Publish or update posts (title, content, status, slug, excerpt, author).
* Assign categories (by ID or name — new categories are created on demand) and tags.
* Set a featured image by media ID or by sideloading from a URL.
* Upload images directly to your Media Library.

== How the connection works ==

1. Click **Connect to BulkPublishing.AI**. A secure page opens on BulkPublishing.AI.
2. Sign in and choose which project to link to this site.
3. Approve. You are returned to your site and the connection completes automatically.

Behind the scenes the plugin uses an OAuth-style handshake: it generates a one-time secret, BulkPublishing.AI mints an API token and keeps only its hash, and the plugin claims that hash over an encrypted server-to-server call. The raw token never touches your WordPress site.

== Installation ==

1. Upload the `bulkpublishing-connector` folder to `/wp-content/plugins/`, or install the ZIP via **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the **Plugins** screen.
3. Open **BulkPublishing.AI** in the admin menu and click **Connect**.

== Frequently Asked Questions ==

= Do I still need an Application Password? =

No. The connector replaces Application Passwords entirely.

= Where is my token stored? =

Your raw API token is never stored on your site. Only a SHA-256 hash is kept, and it is used solely to verify incoming requests.

= Can I disconnect at any time? =

Yes. Open the BulkPublishing.AI admin page and click **Disconnect**. The local connection is removed immediately and BulkPublishing.AI is notified to revoke the token.

= What happens when I delete the plugin? =

All connector options are removed. Your posts, media, categories and users are left untouched.

== Changelog ==

= 1.0.2 =
* Fixed: connections could stay on "Not connected" after approving on BulkPublishing.AI if the browser returned without the completion flag or the page was re-opened. The connector now resumes and completes any pending handshake, with a manual "Complete connection" fallback.
* Improved: the secure claim now succeeds even when the site URL is reported slightly differently (www, scheme, or trailing slash) between approval and completion.
* Improved: pending connection requests now stay valid for 60 minutes to tolerate slower sign-ins.

= 1.0.1 =
* Branding and admin UI polish for the connector settings screen.

= 1.0.0 =
* Initial release: one-click connect handshake, secure token verification, and the publishing REST contract (publish, media upload, categories, authors, site info).
