=== Social Publisher by Calliope – Auto Post to 10+ Networks ===
Contributors: mairaforesto
Tags: social media, auto post, social posting, social automation, ai content
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 2.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Auto-post WordPress content to 10+ social networks with AI-assisted copy, image tools, publishing history, analytics, and sanitized logs.

== Description ==

Social Publisher by Calliope helps WordPress administrators publish from one WordPress dashboard to 10 social networks in Free, with additional destinations available in Pro.

Write the message once, choose the connected destinations, prepare an image, generate titles or captions with Gemini when you want help, and publish from WordPress. The plugin keeps each network connection in its own setup screen, shows clear connected/disconnected states, and keeps provider messages available in Logs when something needs attention.

= What you can do in Free =

* Publish manually from the dedicated Publisher tab in Social Publisher.
* Publish to multiple connected destinations in one run.
* Use a clean Publisher screen for title, content, link, hashtags, image, alt text, and destination selection.
* Use the built-in image workflow with Original, square, portrait, and landscape formats.
* Connect networks from dedicated setup panels with quick guides, OAuth actions, tests, and disconnect controls.
* Use the optional Gemini-powered AI composer to generate titles, captions, hashtags, or a complete post.
* Search WordPress posts, pages, and WooCommerce products to use as AI context.
* Read, copy, export, and clear sanitized Logs.
* Use a dedicated History tab with permanent destination-by-destination records, search, network/status filters, WordPress source links, account details, media/AI/source badges, provider results, errors, detail panels, and pagination.
* Use Settings for AI keys, model/language preferences, UTM tracking, failure-only email alerts, and plugin data cleanup behavior.

= Free network destinations =

Social Publisher Free includes connection and publishing support for:

* Bluesky
* Mastodon
* Tumblr
* Pinterest
* Threads
* Instagram
* LinkedIn personal profiles
* Blogger
* Telegram
* Facebook Pages

Support depends on each provider's account type, API permissions, app review status, and platform rules. LinkedIn publishing in this Free release is limited to personal profiles.

= Optional Pro destinations =

Social Publisher Pro adds these destinations to the same publishing workflow:

* YouTube / Shorts
* Discord
* Remote WordPress
* Custom Webhook

Pro availability, account permissions, privacy options, and media support depend on each provider's API rules. When Social Publisher Pro supplies a Multiple images / Carousel payload, compatible clients publish the full media set where the provider supports it, including Facebook Pages, Bluesky, Instagram, Threads, Blogger, and Telegram albums.

= AI generation =

The AI composer is included in the Free plugin. It uses your own Gemini API key, saved locally in your WordPress database. AI runs only when an administrator clicks an AI generation button.

You can:

* Generate a title.
* Generate post content.
* Generate hashtags.
* Generate a complete social post.
* Add a private prompt for the current publication.
* Use WordPress content search as factual context.
* Choose the Gemini model and default generation language in Settings.

Gemini is optional. Social Publisher can connect networks, publish posts, and show logs without a Gemini API key.

= Professional workflow =

1. Open Connections and configure one network.
2. Test the connection or complete OAuth when the network provides it.
3. Open Settings and connect AI if you want Gemini generation.
4. Open Publisher, write or generate the content, prepare media, and choose connected destinations.
5. Publish, then review Logs for provider responses and diagnostics.

Platform-specific connection tutorials and video guides are maintained on the CalliopeWP website so setup instructions can stay current without waiting for a plugin release. Visit:
https://pluginswordpress.calliope.com.ar/calliope-social-publisher/

= Privacy and local storage =

Provider credentials and tokens are stored locally in the WordPress database for the current site. Do not share them.

Logs and admin messages are designed not to expose full tokens, secrets, authorization codes, passwords, bearer credentials, or API keys. Social Publisher does not track visitors, does not send telemetry, does not display advertising, does not add automatic credits, does not call provider APIs on normal admin page load, and does not execute remote code.

Deleting the plugin preserves saved data by default. If you want WordPress to remove Social Publisher data when the plugin is deleted, enable the cleanup option in Settings before deleting the plugin.

== External services ==

Social Publisher connects to external services only when a site administrator configures a provider, starts authorization, tests a connection, opens a supported share action, requests AI generation, or publishes content.

No data is sent to a provider unless that integration is configured and used.

= Google Gemini / Google AI =

Used only when a site administrator saves a Gemini API key and clicks an AI generation button.

Endpoint: https://generativelanguage.googleapis.com/

Data may include the selected Gemini model, site name, default generation language, current title, content, link, hashtags, selected WordPress post/page/product context, per-publication AI prompt, and requested generation field. The Gemini API key is stored locally in the WordPress database.

Google APIs Terms of Service: https://developers.google.com/terms
Google Privacy Policy: https://policies.google.com/privacy
Gemini API documentation: https://ai.google.dev/gemini-api/docs

= Bluesky =

Used for authentication, media upload, and post creation.

Endpoint: https://bsky.social/xrpc/

Data may include the configured handle, app password, post text, link, optional image/media data, and account identifiers.

Terms: https://bsky.social/about/support/tos
Privacy policy: https://bsky.social/about/support/privacy-policy

= Mastodon =

Used for OAuth/app registration, account validation, media upload/status checks, and publishing on the administrator-selected Mastodon instance.

Endpoint: the selected public HTTPS Mastodon server.

Data may include the instance host, callback details, OAuth app data, authorization code, client credentials, access token, status text, link, visibility, and optional media files. Localhost, private/reserved IPs, ambiguous hosts, and non-HTTPS instance URLs are rejected.

Terms and privacy policies are published by each Mastodon instance. Examples:
https://mastodon.social/terms
https://mastodon.social/privacy-policy

= Tumblr =

Used for OAuth, blog validation, and publishing.

Endpoints:
https://www.tumblr.com/oauth/
https://api.tumblr.com/v2/

Data may include Consumer Key/Secret, OAuth verifier/callback data, token/secret, blog identifier, title/text, link, tags, and optional media data.

Terms: https://www.tumblr.com/policy/en/terms-of-service
Privacy policy: https://www.tumblr.com/privacy/en

= Pinterest =

Used for OAuth, board selection, sandbox or production validation, and Pin publishing.

Endpoints:
https://www.pinterest.com/oauth/
https://api.pinterest.com/v5/
https://api-sandbox.pinterest.com/v5/

Data may include App ID/Secret, callback URL, authorization code, requested scopes, token data, Pin title/description, destination link, selected board, and optional image URL/media data.

Terms: https://policy.pinterest.com/en/terms-of-service
Developer/API terms: https://developers.pinterest.com/terms/
Privacy policy: https://policy.pinterest.com/en/privacy-policy

= Threads =

Used for OAuth, token exchange/refresh, account validation, media containers, status checks, and publishing.

Endpoints:
https://threads.net/oauth/
https://graph.threads.net/

Data may include App ID/Secret, callback URL, authorization code, scopes, access token data, post text, link, media URL/data, container IDs, and account identifier.

Meta Platform Terms: https://developers.facebook.com/terms/dfc_platform_terms/
Threads API documentation: https://developers.facebook.com/docs/threads/
Meta Privacy Policy: https://www.facebook.com/privacy/policy/

= Instagram =

Used for OAuth, token exchange, account validation, media containers, and publishing when permissions allow it.

Endpoints:
https://www.instagram.com/oauth/
https://api.instagram.com/oauth/
https://graph.instagram.com/

Data may include Client/App ID/Secret, callback URL, authorization code, scopes, token data, caption/text, link when supported, media URL/data, container IDs, and account identifier.

Meta Platform Terms: https://developers.facebook.com/terms/dfc_platform_terms/
Meta Privacy Policy: https://www.facebook.com/privacy/policy/

= LinkedIn =

Used for OAuth, personal profile detection, validation, image upload preparation/upload, and publishing to a personal profile.

Endpoints:
https://www.linkedin.com/oauth/v2/
https://api.linkedin.com/

Data may include Client ID/Secret, callback URL, authorization code, member scopes, token data, personal profile author URN, post text, link, optional image data, upload URL data, and access token. Company pages and organization publishing are not documented as stable Free destinations in this release.

User Agreement: https://www.linkedin.com/legal/user-agreement
API Terms of Use: https://legal.linkedin.com/api-terms-of-use
Privacy policy: https://www.linkedin.com/legal/privacy-policy

= Blogger / Google =

Used for OAuth, token refresh, blog selection, tests, and publishing to Blogger.

Endpoints:
https://accounts.google.com/o/oauth2/v2/auth
https://oauth2.googleapis.com/token
https://www.googleapis.com/blogger/v3/

Data may include Client ID/Secret, callback URL, authorization code, Blogger scopes, refresh/access token data, blog ID, post title/content, and labels when used.

Google APIs Terms of Service: https://developers.google.com/terms
Google Terms of Service: https://policies.google.com/terms
Google Privacy Policy: https://policies.google.com/privacy

= Telegram =

Used for bot/chat validation and publishing.

Endpoint: https://api.telegram.org/

Data may include Bot Token, chat ID, optional message thread/topic ID, post title/text, link, hashtags, and optional image URL/media data.

Terms: https://telegram.org/tos
Bot API documentation: https://core.telegram.org/bots/api
Privacy policy: https://telegram.org/privacy

= Facebook Pages =

Used for OAuth, Page discovery, Page token resolution, tests, diagnostics, publishing, and the optional public Facebook share action.

Endpoints:
https://www.facebook.com/v20.0/dialog/oauth
https://graph.facebook.com/v20.0/

Data may include App ID/Secret, callback URL, authorization code, scopes, token data, Page identifiers/names, selected Page token, post message, link, optional media data, and the Page URL when using the public share action.

Meta Platform Terms: https://developers.facebook.com/terms/dfc_platform_terms/
Meta Privacy Policy: https://www.facebook.com/privacy/policy/

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP from **Plugins > Add New**.
2. Activate **Social Publisher**.
3. Open **Social Publisher** in the WordPress admin area.
4. Open **Connections** and configure the networks you want to use.
5. Optional: open **Settings** and add a Gemini API key for AI generation.
6. Open **Publisher**, prepare the post, select connected destinations, and publish.

== Frequently Asked Questions ==

= Can I publish to multiple networks at once? =

Yes. Select multiple connected destinations before publishing. Social Publisher records per-network results so one provider failure does not hide the outcome of the others.

= Does Social Publisher post automatically to new WordPress posts? =

The plugin includes supported block editor publishing options. Manual publishing from the Social Publisher dashboard remains the primary workflow in this Free release.

= Does Free include AI generation? =

Yes. The Gemini-powered AI composer is included in Free. You provide your own Gemini API key in Settings, and AI generation runs only when you click a generation button.

= Does the plugin store tokens or API keys? =

Yes. Provider credentials, OAuth tokens, and the optional Gemini API key are stored locally in the WordPress database for the current site. Logs are sanitized to avoid showing full secrets.

= Does Social Publisher schedule future posts? =

No. This Free release focuses on immediate publishing and supported editor publishing flows. Scheduling and additional video workflows may be provided by the optional Pro add-on.

= Why is a network disabled in Publisher? =

Disconnected or incomplete destinations remain disabled until their connection is configured and verified in the Connections tab.

= Why are disconnected tabs gray? =

Provider colors are reserved for connected destinations. Gray tabs make it easier to see which integrations still need setup.

= Where can I find setup tutorials? =

Use the Documentation button in the Social Publisher header or visit:
https://pluginswordpress.calliope.com.ar/calliope-social-publisher/

== Changelog ==
= 2.0.1 =
* Renamed the public plugin listing to Social Publisher by Calliope – Auto Post to 10+ Networks while preserving the existing calliope-social-publisher slug, text domain, settings, storage, and upgrade path.
* Reworked the WordPress.org summary and tags to surface the 10-network Free publishing scope, AI-assisted copy, automation positioning, and sanitized logs more clearly.
* Consolidated three separate public-host/SSRF validation implementations into one shared validator used by Mastodon, Gemini URL context, and reusable host-validation flows.
* Strengthened configurable-host validation consistently against private/reserved IPs, special-use IPv4 ranges, IPv4-mapped IPv6, numeric IP spellings, localhost-style names, and common localhost tunnel domains.
* No connections, credentials, History records, templates, settings, database tables, slugs, or Pro extension boundaries are renamed or reset by this update.

= 2.0.0 =
* Finalized the production-ready Free 2.x baseline after end-to-end Free/Pro compatibility, connection, publishing, history, analytics, and updater QA.
* Keeps the ten Free destinations: Bluesky, Mastodon, Tumblr, Pinterest, Threads, Instagram, LinkedIn personal profiles, Blogger, Telegram, and Facebook Pages.
* Keeps Gemini optional and user-supplied, preserves the built-in image workflow, permanent destination-level History, Free Analytics, Social Templates, Smart Tags, retry tooling, and sanitized Logs.
* Preserves the extension boundaries used by Social Publisher Pro 1.0 for Pro destinations, account workflows, scheduling, automation, richer media, templates, and analytics.
* Points connection help to the maintained CalliopeWP web documentation and video tutorial library.
* No destructive data reset is performed when upgrading from the 1.5.x line; saved connections, settings, history, templates, and publication data remain in place.

= 1.5.64 =
* Added safe Smart Tag catalog, group, and value extension points so licensed add-ons can contribute provider-specific tags without changing the Free tag set.
* Keeps add-on values inside the existing sanitization and unresolved-placeholder protection used by Social Templates and Platform Preview.

= 1.5.63 =
* Added the safe extension boundary used by Pro to select a specific reusable template per destination without changing the one-template Free limit.
* Keeps selected Pro templates in manual drafts and refreshes Platform Preview when a template selection changes.
* Lets a licensed Pro extension replace the Social Templates roadmap teaser with its live template library inside the existing Settings form.

= 1.5.62 =
* Raised the Free/Pro compatibility boundary used by normalized real network statistics.

= 1.5.61 =
* Added a safe Analytics view boundary so an active Pro license can replace the complete basic report instead of appending duplicate statistics below it.
* Kept the complete Free Analytics summary as the fallback whenever Pro is absent, inactive, or unable to load.

= 1.5.60 =
* Kept the Publisher columns flush on desktop by stretching Content to the combined Publication type and Media height.
* Preserved natural card heights when the Publisher switches to its stacked responsive layout.

= 1.5.59 =
* Refined the Publisher right rail so Publication type is presented as a cohesive card aligned with Content and Media.
* Improved option spacing, heading hierarchy, and visual separation without changing Standard post or Pro Video post behavior.

= 1.5.58 =
* Completed Step 12 cleanup and migration hardening for the new Free base without changing publishing behavior or adding new user-facing strings.
* Upgraded persistent History storage to schema v4 with a concurrency-safe migration lock, request-level table-existence caching, and indexes for status/date and network/date Dashboard/Analytics queries.
* Kept a single publication-history table and made schema activation/upgrade safer on multisite, including batched network activation and automatic storage initialization for sites created after network activation.
* Reworked uninstall cleanup for multisite so each site keeps or removes its own data according to its cleanup preference; options, transients, post meta, generated uploads, and the site-specific History table are cleaned only when requested.
* Added one-time data hygiene for legacy Facebook caches/options, sanitized stored Logs, Social Templates and Tracking settings, and stale Telegram discovery data from the removed experiment.
* Removed duplicate Blogger setting registration and tightened request normalization/output escaping in affected admin paths.
* Limited maintenance, migrations, History schema checks, heavy media/Preview assets, Templates/Tracking scripts, Facebook connection JavaScript, and queue scans to the Social Publisher screens/tabs where they are actually needed.
* Removed obsolete Dashboard CSS and unused legacy image assets while keeping the active logo/menu assets.
* Reviewed write permissions/nonces and OAuth state guards, responsive breakpoints, database ownership, uninstall behavior, and frontend loading; no duplicate plugin tables were introduced.
* Updated translation metadata and rebuilt all PO/MO catalogs; rebuilt the Gutenberg JavaScript translation catalogs to remove old encoding corruption in Spanish, French, Italian, Brazilian Portuguese, and Simplified Chinese.

= 1.5.57 =
* Refined the Publisher into a cleaner two-column composer: Content stays in the main column while publication type and Media are grouped in the right-hand rail.
* Removed the full-width publication-type strip from the visual flow without changing Standard post or Pro Video post behavior.
* Standard post, Video post PRO, and media-mode controls now stack vertically for faster scanning and a more compact composer.
* Content spans the height of the publication controls and Media card, while AI generation and Platform preview remain full-width below the composer.
* Added responsive fallbacks so publication type, Content, and Media stack naturally on narrower screens.
* No publishing, media, AI, destination, Preview, History, Analytics, Tracking, Alerts, Dashboard, scheduling, or Pro behavior was changed.

= 1.5.56 =
* Reworked the main screen into a dedicated operational Dashboard and moved manual publishing to its own Publisher tab.
* Dashboard shows only high-value status: needs attention, 7-day activity, recent runs, connected networks, alerts, and UTM state.
* Pro installations replace the single Free teaser with live scheduling and advanced-destination dashboard context.
* Added and rebuilt all included translations for the Dashboard labels.

= 1.5.55 =
* Added a compact Today summary to the main Publisher dashboard with completed publications, successful/failed outcomes, the most active network, and a direct View Analytics link.
* Today uses the WordPress site timezone and reuses persistent History data without duplicating the full Analytics page.
* Added and rebuilt all included translations for the new dashboard labels.

* Full release history is included in `CHANGELOG.md` inside the plugin package.

== Upgrade Notice ==
= 2.0.1 =
Branding and security-maintenance update. The plugin slug, text domain, saved connections, settings, history, templates, publication data, and Pro compatibility remain unchanged.

= 2.0.0 =
Production-ready 2.x baseline. Existing connections, settings, history, templates, and publication data are preserved when upgrading from 1.5.x. Social Publisher Pro 1.0.0 or newer requires Free 2.0.0 or newer.
