=== Stellar Manager Client ===
Contributors: gmscreativo
Tags: management, updates, remote, inventory, backup
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.22.29
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Securely connects one WordPress site to a Stellar Manager installation.

== Description ==

Stellar Manager Client exposes a small authenticated API used by a manager that you explicitly pair with this site. Requests use HMAC-SHA256 signatures and short timestamps. State-changing operations have one-time nonces; signed backup links allow browser retries and resume requests during their short validity period.

The Client can provide WordPress, plugin, and theme inventories; install verified plugin and theme updates; create protected component snapshots; build native local `.wpress` backups; and collect privacy-first aggregate traffic when those permissions are enabled.

The interface language defaults to English. English and Spanish can be selected from the Client settings, independently from the WordPress site language and from the manager site language.

== Installation ==

1. Install and activate the plugin on the client site.
2. Open Settings > Stellar Manager.
3. Copy the pairing code and treat it like a password.
4. Add the code to your Stellar Plugin Manager installation.
5. Regenerate the code immediately if it is exposed.

== Backups ==

Remote backup creation uses Stellar's native, resumable engine and does not require a third-party migration plugin. Database export, file indexing, and archive streaming run in bounded persistent steps and can continue through WP-Cron after the browser is closed.

Every `.wpress` file remains on the client site. The manager never stores the backup. Signed requests can list, download, cancel, delete, and—for active Pro entitlements—restore a specific Stellar-native backup.

== Privacy and external communication ==

The plugin communicates with the Stellar Manager URL that an administrator explicitly pairs with this site. This externally distributed Client checks https://stellar.gmscreativo.com/wp-json/gms-license/v1/client-update once per local calendar day for its own releases. The check is scheduled between 02:00 and 04:00 in the WordPress site timezone, with a stable per-site offset to spread server load. No pairing secret, license key, traffic report, or backup is sent to this public endpoint. The host receives normal HTTP connection information. Release metadata includes a temporary signed HTTPS package URL and a SHA-256 digest. Newer compatible releases are installed automatically through WordPress's native automatic updater after verifying that digest. Global WordPress automatic-update restrictions and filesystem requirements still apply. WP-Cron can run late on sites without visits; use a hosting cron for reliable overnight execution. Failed checks and skipped updates wait until the next daily check. Native update refreshes reuse cached metadata and never create extra service checks. During an administrator-requested inventory refresh, the Client can query the public WordPress.org plugin and theme information APIs to resolve a component whose local folder or slug was changed. If a plugin or theme explicitly declares an external HTTPS update or product URI, Stellar can read structured public version metadata from that address. These checks discover version numbers only and never download a third-party package unless the administrator starts an update.

The paired manager runs on the administrator's own domain. When that administrator explicitly starts an update from the paired manager, a signed request may include a private component ZIP, including a newer Client ZIP, that the administrator uploaded to the separate Pro manager. The Client verifies its SHA-256 digest, installed identity, and resulting version. The Client self-update service described above works independently of Essential, Pro, and pairing. Administrator-requested private Client updates remain available through the paired Manager.

When a signed Agency or Corporate capability enables traffic reports, measurements remain in dedicated tables on this site and only aggregate report totals are returned to the paired manager. IP addresses, full user agents, query strings, and individual browsing histories are never stored. The capability expires automatically when it is no longer refreshed by the paired manager, and measurements older than 93 days are deleted.

== Client self-updates ==

Install this release once on each remote website to enable the new updater. Upload this same ZIP as the current Client release in Stellar License Service. Future releases must use a higher plugin version and retain this updater. Existing pairing codes, site IDs, permissions, and settings are retained. Deactivation removes this updater's scheduled events. This build is distributed from the Stellar server and is not intended for submission to WordPress.org.

== Changelog ==

= 1.22.29 =
* Check the Stellar license server once per day in a local overnight window, independently of Essential and Pro.
* Install newer compatible Client releases using the native WordPress automatic updater and SHA-256 verification.
* Cache daily metadata for native update notices, preserve Manager-requested private updates, and remove scheduled self-checks on deactivation.

= 1.22.28 =
* Refresh plugin and theme inventory through WordPress's native checks without altering update transients.
* Send verified plugin and theme packages through WordPress's native upgrade hooks without adding offers to the global update lists.
* Validate and stage restored files before replacing their WordPress destinations; use the WordPress filesystem API for recovery plugin replacements.
* Read native upgrader failure results from the skin and document the purpose of direct aggregate statistics queries.

= 1.22.27 =
* Sanitize HTTP input before matching signed backup requests and improve recovery nonce generation.
* Document native backup streaming, atomic recovery files, and other justified static-analysis findings.

= 1.22.26 =
* Allow an administrator to install a newer Client ZIP from the paired Pro manager's private repository after verifying the package identity and SHA-256 digest.

= 1.22.25 =
* Use WordPress.org as the Client release source and retain pairing settings across upgrades.
* Confirm official packages before managed updates, including older Client folder identities.

= 1.22.24 =
* Return protected-update progress without rebuilding the full inventory on every poll and record stage durations for troubleshooting.

= 1.22.23 =
* Allow the paired Manager origin to read signed backup segments for a one-file browser download.

= 1.22.22 =
* Serve signed 128 MiB backup parts with independent byte ranges so large archives can cross limited hosting connections.
* Forbid intermediate transformations of backup downloads and retain their exact advertised byte lengths.

= 1.22.21 =
* Keep signed backup links valid for browser retries and support HTTP range resume.
* Check incomplete archives before transfer and stream exact byte counts without output buffers.
* Offer a signed administrative download route when hosting blocks the REST endpoint.

= 1.22.19 =
* Invalidates cached plugin and theme headers before a forced inventory so synchronization reports the version actually restored by rollback.
* Preserves provider update evidence while refreshing the installed component metadata from disk.

= 1.22.18 =
* Captures endpoint health before a protected plugin or theme update and treats only a new post-update failure as a regression.
* Restricts fatal-screen detection to real PHP and WordPress fatal signatures instead of matching ordinary content that merely mentions a critical error.
* Reuses the same health baseline after automatic or cancellation rollback so a pre-existing endpoint restriction cannot falsely report that restoration failed.

= 1.22.17 =
* Runs native backup slices in each client site's non-blocking WP-Cron worker so the Manager can start and monitor different sites concurrently.
* Excludes generated cache data and volatile runtime logs from complete backups, and safely accepts append-only file growth after the manifest is captured.
* Restores the protected pre-update snapshot at the first safe boundary when a Pro Safe Update is canceled after its snapshot exists.

= 1.22.16 =
* Sends verified private plugin packages through WordPress' native Plugin_Upgrader without rejecting conditional or edition-specific PHP includes through a Stellar code heuristic.
* Keeps package identity, declared version, SHA-256, archive safety, installed-copy, activation, and post-update version checks around the native WordPress operation.
* Lets WordPress decide whether the vendor ZIP is installable while Stellar starts the action, monitors it, and preserves protected rollback behavior.

= 1.22.15 =
* Adds the signed administrative fallback channel to backup listing, creation, progress, cancellation, deletion, and restoration operations.
* Lets Stellar create and monitor backups when a hosting firewall blocks the equivalent WordPress REST request, without disabling security software.
* Returns the exact native backup stage error and its technical code to the Manager.

= 1.22.14 =
* Accepts the initial signed pairing handshake through the administrative bridge when a firewall blocks the WordPress REST route.
* Uses the same pairing validation and stored connection state for REST and admin-ajax, without weakening HMAC authentication.

= 1.22.13 =
* Detects a backup job that has stopped reporting progress for 30 minutes and closes it as failed instead of leaving the site permanently busy.
* Removes partial archive and working files when a backup fails, expires, or is abandoned so the next retry starts cleanly.
* Keeps the detailed failure in the Client log while allowing a new backup to begin immediately.

= 1.22.12 =
* Detects active security software from the plugin metadata already provided by WordPress instead of embedding a catalog of security-product identifiers in executable PHP.
* Avoids false positives from server-side malware scanners that quarantined the Client archive during upload or rejected the inventory file while WordPress copied an update.
* Keeps the exact active security-plugin name in compatibility diagnostics without disabling or bypassing any protection.
* Reports insufficient server storage explicitly for plugin updates, theme updates, backups, and restorations, including available and estimated required space when the host exposes those values.

= 1.22.11 =
* Inspects verified plugin and theme ZIP files through a safe local extractor so FTP/SSH filesystem transports cannot mistake a writable PHP temporary directory for an invalid archive.
* Rejects unsafe paths, symbolic links, oversized archives, and excessive file counts before native extraction.
* Reports temporary copy failures separately from malformed ZIP files and removes inspection files through the same local filesystem that created them.

= 1.22.10 =
* Installs every verified private plugin and theme package through WordPress' normal upgrade path instead of the install-with-overwrite path.
* Prevents a successful package copy from leaving the previous active plugin file in place on filesystem configurations that handle install and upgrade differently.
* Returns the expected version, detected version, component path, and affected file through the signed administrative bridge when a post-update check fails.

= 1.22.9 =
* Builds a SHA-256 manifest for every private plugin and theme package before installation and verifies every installed file before reactivation.
* Rejects an incomplete private ZIP before changing the site when its own PHP code requires a local file that is missing from the archive.
* Restores the protected snapshot immediately when a post-installation manifest, identity, version, or activation check fails.
* Runs protected file changes through the signed WordPress administrative bridge on sites with a detected security plugin, while keeping that plugin active.

= 1.22.8 =
* Adds a read-only update compatibility preflight for signed REST access, temporary writes, filesystem method, and known security plugins without disabling any firewall.

= 1.22.7 =
* Uses WordPress' exact native transient entry when installing plugins or themes that the site itself can update.
* Fixes the theme update payload type expected by Theme_Upgrader, preventing remote failures for themes that update correctly from wp-admin.
* Avoids custom source realignment for normal exact WordPress or provider offers while retaining it for verified renamed paths.
* Treats similar-name or similar-slug provider matches as version evidence only; they can no longer authorize an automatic package installation.
* Keeps strict base, Lite, Free, Pro, and Premium validation for private repository ZIP files and renamed component paths.

= 1.22.6 =
* Uses the exact WordPress update-check result for each installed plugin before consulting any external provider.
* Completes missing official package links through the fixed WordPress.org information API and verifies any reconstructed downloads.wordpress.org URL before use.
* Stops re-inserting stale plugin and theme offers after a successful refresh, keeping inventories deterministic across page loads.
* Tries a verified private repository ZIP silently when the original provider cannot deliver its package.
* Preserves the precise technical error code through Safe Update rollback so the manager can explain the cause and solution.

= 1.22.5 =
* Installs an independent must-use recovery layer before allowing protected updates.
* Restores a verified component snapshot atomically when updated plugin or theme code causes a fatal error before the normal Client API can load.
* Verifies the staged recovery copy a second time before replacing any live plugin or theme files.
* Adds a signed emergency rollback endpoint that remains available when a damaged regular plugin prevents WordPress REST routes from loading.
* Treats Pro, Premium, Lite, Free, and base editions as separate identities across folder, main file, text domain, name, and declared URLs.
* Removes name-and-author-only authorization and verifies component identity again after installation.
* Retries an exact official WordPress.org package when a stale or external provider offer has no usable download.
* Extends health checks to WordPress administration and detects critical-error text even when a server returns a misleading successful HTTP status.

= 1.22.4 =
* Preserves higher premium update versions that WordPress already confirmed when a provider does not rebuild its offer during a remote synchronization.
* Separates confirmed version evidence from package availability so missing downloads never hide an outdated component or authorize an unverifiable installation.
* Resolves official plugin and theme versions through fixed WordPress.org endpoints before checking provider offers and declared public metadata.
* Recognizes safely renamed plugin and theme identities across folder, main file, text domain, author, declared URLs, and equivalent premium-edition names.
* Revalidates recent cached provider packages before installation and keeps older evidence as version-only until a verified repository ZIP is available.

= 1.22.3 =
* Resolves WordPress.org plugins through verified folder, main-file, text-domain, URL, and name candidates when a local slug has been altered.
* Reads version-only structured metadata from a plugin's declared HTTPS Update URI or Plugin URI after WordPress.org and its normal provider updater return no usable version.
* Validates private ZIP identity from several independent signals and safely aligns a verified renamed package with the installed plugin path.
* Reports richer plugin identity metadata to the paired manager so repository matching is consistent across sites.

= 1.22.2 =
* Finishes recoverable protected-update stages before reporting the site as busy again.
* Removes orphaned and terminal component locks automatically while preserving genuinely active file operations.
* Clears delayed workers as soon as a protected update completes or fails so a closed process cannot block a later update.

= 1.22.1 =
* Recovers interrupted protected-update stages before reporting a site as busy.
* Releases completed or orphaned component locks without clearing a genuinely active file operation.
* Prevents canceled and failed jobs from leaving a site blocked for the previous 24-hour lock window.

= 1.22.0 =
* Adds authenticated cooperative cancellation for queued Safe Updates.
* Cancels safely before installation when possible and, once replacement has started, preserves the required health-check and automatic rollback stages.
* Persists stop requests across asynchronous job stages so a delayed worker cannot restart canceled work.
* Prevents separate requests or browser tabs from starting a second component operation on the same site while protected work remains active.

= 1.21.6 =
* Excludes WordPress 404 responses and static asset requests from traffic statistics before any page view, visit, visitor, or dimension is counted.
* Removes legacy static-file and recognizable not-found entries from Top pages and recalculates the affected historical page-view totals.

= 1.21.5 =
* Removes country geolocation from traffic collection and reports so the Client performs no GeoIP lookup or country-header processing.
* Permanently deletes country aggregates collected by earlier releases while preserving all other traffic statistics.

= 1.21.4 =
* Preserves confirmed newer plugin versions even when the provider does not supply an installable ZIP.
* Distinguishes license-required and version-only provider responses from fully unconfirmed plugins.
* Adds visit-summary data and privacy-safe country references from trusted server headers, GeoIP when installed, or regional browser language.

= 1.21.3 =
* Resolves plugin versions from the unfiltered WordPress.org response before considering a commercial provider or the private repository.
* Revalidates ambiguous official offers against the fixed WordPress.org endpoint and never exposes a stale or package-less offer as an actionable update.
* Treats delisted official plugins as current when no newer registered WordPress.org release is offered.

= 1.21.2 =
* Confirms each plugin independently from the completed WordPress update cycle so one incomplete provider cannot mark the entire inventory as unverified.
* Attributes provider HTTP failures only to plugins that declare the affected provider host.

= 1.21.1 =
* Adds exact calendar-month traffic reports for the current month and two previous months while preserving rolling-day compatibility with older managers.

= 1.21.0 =
* Adds privacy-first aggregate traffic measurement for page views, approximate daily visitors, visits, pages, sources, referrers, devices, browsers, operating systems, and countries.
* Adds a signed 7, 30, or 90-day traffic report endpoint gated by the Agency/Corporate capability.
* Stores no IP addresses, full user agents, query strings, or individual histories and automatically removes measurements older than 93 days.

= 1.20.0 =
* Reports incomplete provider coverage explicitly so the manager cannot show a false all-up-to-date state.
* Sets successful restorations to the WordPress “Post name” permalink structure and regenerates rewrite rules before reporting completion.

= 1.19.0 =
* Captures both the WordPress root and an external wp-content root, including uploads, images, CSS, minified assets, and cache files.
* Restores every declared file root as an exact mirror and verifies staged, applied, and activated file sizes.
* Adds the Pro restoration choice to create a protected safety point or continue without it for a faster start.
* Blocks backups, updates, Safe Updates, rollbacks, and restorations from overlapping on the same site.

= 1.18.0 =
* Replaces the database-backed directory list with a disk-backed queue that scales to large WordPress installations.
* Makes archive writing crash-safe by truncating to the last persisted byte checkpoint before every continuation.
* Refuses to publish incomplete backups and verifies metadata, database, file inventory, structure, final size, and SHA-256.
* Restores only archives whose declared file and database integrity checks match the extracted data.
* Captures WordPress core, configuration, content, cache, and temporary files while excluding only operational backup archives and Stellar working data.

= 1.17.0 =
* Keeps a persistent cancellation tombstone so concurrent or delayed workers cannot resume a canceled backup.
* Prevents canceled jobs from leaving a phantom active export that blocks a new manual backup.
* Accepts signed, SHA-256-verified manager packages for component updates.

= 1.16.0 =
* Captures the complete WordPress root and database in the resumable native backup format.
* Restores files as an exact mirror, stages database tables in isolation, and uses idempotent row imports to prevent duplicate-primary-key failures.
* Creates and verifies a hidden pre-restore recovery point, restores it automatically after a failed mutation, and validates the recovered site before reporting the result.
* Moves verified Client updates to the canonical Stellar License Service endpoint.

= 1.15.0 =
* Limits protected Rollback history to the five newest snapshots on each client site.
* Processes multiple database, file-index, and archive batches per request to reduce idle time between resumable steps.
* Restricts database export to the current WordPress table prefix and improves large-directory traversal.
* Adds verified automatic Client updates from the release uploaded to Stellar License Service.

= 1.14.0 =
* Replaced 250-row offset exports with adaptive 1,000–5,000-row batches, primary-key cursors, multi-row SQL statements, and bounded multi-batch execution.
* Added resumable validation, extraction, file application, database import, and completion for Stellar-native backup restoration.
* Preserves the current Client plugin and secure manager pairing throughout restoration so progress remains observable.
* Continued reporting every installed theme and its exact update state.

= 1.13.0 =
* Added a resumable native `.wpress` backup engine with database and file export, per-site cancellation, SHA-256 verification, and protected local storage.
* Added theme inventory and native/private theme updates.
* Added protected plugin and theme snapshots, health checks, Safe Update, automatic rollback, and manual rollback endpoints for active Pro entitlements.
* Improved favicon retrieval with same-site icon embedding and MIME signature detection.

= 1.12.0 =
* Added an English-first interface with an independent English/Spanish setting.
* Continued every persisted All-in-One WP Migration export stage, including the final priority-300 stage, so jobs do not stop before the archive is finalized.
* Restored an administrator context for every backup continuation, cancellation, and deletion request.
* Preserved the exact All-in-One WP Migration phase in the secondary progress line and removed duplicate generic states.
* Allowed a completed `.wpress` file to be deleted while an unrelated backup job is active.
* Expanded favicon discovery to the WordPress Site Icon, HTML icon declarations, and common icon paths.

= 1.11.0 =
* Added persistent, step-based All-in-One WP Migration exports and per-job cancellation.

= 1.10.0 =
* Added authenticated deletion of individual known `.wpress` files.

= 1.9.0 =
* Added direct verification of WordPress.org updates and installed-version backup compatibility.

= 1.0.0 =
* Initial release.
