=== CaptureRelay ===
Tags: media, photos, mobile, camera
Requires at least: 6.6
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.5.6
License: Proprietary

Securely approve CaptureRelay devices and deliver correctly sized images directly to the WordPress Media Library.

== Description ==

CaptureRelay works with any WordPress website running this plugin. Administrators approve each device before it can upload. Every device receives an independent, revocable credential and every upload is signed, replay-protected, rate-limited, and idempotent.

After activation, find all CaptureRelay controls under **Tools > CaptureRelay**. Open the **Settings** tab to establish the final Media Library format, image quality, upload limits, notifications, security limits, and retention before inviting app users.

CaptureRelay is developed and published by Skyrocket Radio in Mississippi. CaptureRelay is the product name of the mobile app and companion WordPress plugin.

The plugin creates normal WordPress attachments. It does not create or publish posts. Each website controls the required width and height, final Media Library image format (JPEG or WebP when supported), image quality, and maximum file size in KB. Approved apps refresh those requirements automatically, and contributors do not override them. The website can optionally send CaptureRelay-branded HTML notifications for new approval requests and successful uploads.

Approved-device uploads and new connection requests have independent controls. Administrators may pause new requests while existing approved devices continue delivering images, or pause uploads without revoking devices.

== Installation ==

1. Upload `capture-relay.zip` through Plugins > Add New > Upload Plugin.
2. Activate CaptureRelay.
3. Confirm HTTPS is active.
4. Open Tools > CaptureRelay > Diagnostics.

Use Tools > CaptureRelay and its Settings tab to choose whether uploads and new requests are accepted, then set the website's required image dimensions, final JPEG or WebP Media Library format, image quality, maximum upload size in KB, notification recipients, email preferences, abuse limits, and data-retention periods. WebP requires image-processing support from the website server; JPEG remains the universal default. Approved apps refresh the website-controlled delivery requirements automatically. The Documentation tab contains the complete administrator and app-user guide, including optional original-photo backups to Apple Photos and the Android gallery.

No `wp-config.php` change is required. Activating the plugin enables CaptureRelay connections.

== Security ==

Only an administrator-approved device receives an upload credential. Approved-device requests use HMAC-SHA256 signatures, short-lived timestamps, one-time nonces, replay protection, revocable credentials, and persistent rate limits. Device credentials are encrypted at rest with AES-256-GCM using site-specific WordPress key material.

Uploads require HTTPS outside local development, accept signed JPEG files from the app, verify the signed file hash and dimensions, enforce compressed-file and server-memory limits, and are rewritten through the WordPress image editor as the configured JPEG or WebP Media Library format. A fixed, non-configurable forty-million-pixel decoded-image ceiling protects PHP memory from decompression-bomb uploads. Rewriting removes embedded image metadata.

Connection requests are public by design because an unpaired app has no credential yet. A public request cannot upload files and must be approved by a WordPress administrator. Optional Apple App Attest and Google Play Integrity verification requires a separately configured server-side verifier; it is never simulated with a secret embedded in the mobile app.

For security updates, install CaptureRelay only from `https://www.capturerelay.app/`. The plugin declares a non-WordPress.org Update URI so an unrelated repository plugin cannot replace this installation.

== Self-hosted updates ==

CaptureRelay checks `https://www.capturerelay.app/plugin/update.json` through the normal WordPress plugin-update system. No account, license key, or additional setting is required. When a newer compatible version is published, WordPress shows the normal update notice, the View details dialog includes the published release notes, and administrators can use the normal one-click or auto-update controls.

Before WordPress installs a CaptureRelay package, the plugin downloads it through WordPress's HTTPS upgrader and verifies its SHA-256 checksum against the published HTTPS manifest. A missing, invalid, unreachable, or mismatched manifest/package stops only that update attempt and leaves the installed plugin unchanged. Other plugins and the WordPress dashboard continue to work normally.

== Privacy ==

CaptureRelay stores device and delivery information needed to review connection requests, prevent abuse, and audit uploads. This may include a device display name, model, platform, operating-system and app versions, photo credit, timestamps, a pending request's internet address, a keyed hash derived from an internet address, and plugin activity records.

Plain internet addresses are cleared when a request is approved, rejected, cancelled, or expires. Closed connection requests, delivery records, rate-limit counters, and activity entries are removed according to the retention periods configured by the administrator. Uploaded images remain normal WordPress Media Library attachments until an administrator deletes them.

The plugin does not send telemetry or stored WordPress data to CaptureRelay. Optional title and alt-text suggestions are generated on supported mobile devices; the plugin receives only the final image and editable text the app user chooses to submit and does not call a cloud AI service. Optional approval and upload messages are sent using the website's normal WordPress email configuration. CaptureRelay adds suggested text to WordPress's Privacy Policy Guide. Its device records are not associated with a WordPress user email address and therefore are not included automatically in WordPress personal-data email exports or erasures.

CaptureRelay's public privacy policy is available at `https://www.capturerelay.app/privacy.html`, its terms at `https://www.capturerelay.app/terms.html`, and its contact form at `https://www.capturerelay.app/#contact`. Requests concerning images or operational records stored by a destination website must be directed to that website's administrator.

== Changelog ==

= 1.5.6 =

* Refined the JPEG/WebP Media Library format control into the same branded button set used by other CaptureRelay settings.
* Updated the default image quality for new and legacy-unsaved settings to 75.

= 1.5.5 =

* Organized the Settings tab into Images, Connections, Email, and Logging sections for faster administration.

= 1.5.4 =

* Added a website-controlled Media Library output format: JPEG (default) or WebP when the server image engine supports it.
* CaptureRelay still accepts the app’s signed JPEG upload, then safely rewrites and saves the selected final format, preserving compatibility with every released app version.

= 1.5.3 =

* The first-activation setup reminder now clears itself after 14 days. Existing installations receive the same full 14-day courtesy period beginning when this version first sees the reminder.

= 1.5.2 =

* Added a secure Dismiss action to the first-activation setup reminder. Administrators can hide the reminder without changing CaptureRelay settings or interrupting approved-device uploads.

= 1.5.1 =

* Maintenance release for testing the self-hosted update workflow.
* Keeps the normal WordPress update details, checksum verification, and auto-update behavior enabled.

= 1.5.0 =

* Added zero-configuration self-hosted update checks through the CaptureRelay update manifest.
* Added normal WordPress update details/changelog integration and compatibility metadata.
* Added SHA-256 verification before a CaptureRelay package can be installed.
* Added separate WordPress image title and alt-text delivery for compatible CaptureRelay app versions.
* Preserved title-as-alt behavior for older app versions so existing approved devices continue working normally.
* Published a capability flag that lets updated apps safely discover separate alt-text support.

= 1.4.4 =

* Added the uploaded image directly to successful-upload notification emails as a responsive preview.
* Linked both the image preview and Review Image button to the attachment's WordPress Media Library details.
* Replaced the context-dependent attachment edit link so the email action remains valid when an upload arrives through the REST API.

= 1.4.3 =

* Expanded the in-plugin guide for website-controlled image requirements, compact app website accordions, confirmed request cancellation, and independent destination controls.
* Documented the default-on option to save one original in-app camera capture to Apple Photos or the Android gallery without duplicating imported images.
* Clarified add-only photo-library permissions, local-save warnings, generic connection errors, paused new requests, and responsive branded emails.

= 1.4.2 =

* Added branded, responsive HTML notifications for successful image uploads.
* Clarified and documented the 24-hour repeated-device email safeguard.
* Added an audit event whenever a repeated approval email is intentionally suppressed.

= 1.4.1 =

* Separated approved-device uploads from new connection requests so administrators can pause either independently.
* Added a backwards-compatible migration for the former combined availability switch.
* Rebuilt new-device approval notifications as branded, responsive HTML emails with a direct review action.

= 1.4.0 =

* Added website-controlled required image dimensions. Updated apps retrieve these settings automatically while older apps remain compatible.

= 1.3.3 =
* Removed the redundant first-time setup card from the Documentation tab.
* Hid the tab strip's internal scrollbar while preserving horizontal navigation on narrow screens.

= 1.3.2 =
* Refined the approved-device table with clearer platform details and permanently inline revoke actions.
* Added distinct orange Revoke and red Revoke & Block button treatments.
* Corrected dark-mode contrast across the complete CaptureRelay administration page.

= 1.3.1 =
* Added the exact WordPress Settings location to the plugin description.
* Expanded the first-activation notice with direct links to Settings and Documentation.

= 1.3.0 =
* Consolidated Connections, Settings, Upload Activity, and Diagnostics into one Tools page with horizontal tabs.
* Added comprehensive in-plugin documentation covering setup, app use, device administration, settings, security, privacy, and troubleshooting.
* Added a persistent initial-setup notice that clears after an administrator saves Settings.

= 1.2.2 =
* Identified Skyrocket Radio as CaptureRelay's developer and publisher in plugin metadata and privacy guidance.

= 1.2.1 =
* Linked the live CaptureRelay privacy policy, terms, and contact form from WordPress privacy guidance and direct-distribution documentation.
* Clarified responsibility for privacy requests concerning data stored by independently operated destination websites.

= 1.2.0 =
* Hardened approved-device REST permissions, invalid-authentication throttling, database identifiers, recursive secret redaction, timestamp validation, and administrator notice visibility.
* Added an immutable image-pixel ceiling, PHP memory-budget checks, and WordPress-native JPEG rewriting.
* Added WordPress Privacy Policy Guide content and documented direct-distribution security expectations.
* Added a private Update URI to prevent an unrelated WordPress.org plugin from replacing CaptureRelay.

= 1.1.0 =
* Added permanent device blocking, atomic abuse limits, stricter image validation, metadata removal, and corrected security-data retention.

= 1.0.0 =
* Initial release.
