=== Metahuman Localhost Sync ===
Contributors: metahumannetwork
Tags: local development, sync, localhost, staging, development
Requires at least: 6.0
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure sync endpoint for the Metahuman Localhost Mac app. Push and pull your WordPress site between local and remote environments.

== Description ==

Metahuman Localhost Sync is the companion plugin for the Metahuman Localhost Mac app. It provides secure REST API endpoints that allow you to:

* **Pull** your remote WordPress site to your local environment (database + files)
* **Push** local changes back to your remote site
* **Selectively sync** themes, plugins, uploads, or database
* **Sync single items** — push or pull an individual page, post, or custom post type entry
* **Automatic backups** before any push operation

= Security =

* API key authentication with HMAC request signing
* Replay protection via timestamp and nonce verification
* Rate limiting (60 requests/minute per key)
* Path traversal protection on all file operations
* API keys are hashed before storage (never stored in plain text)

= Requirements =

* WordPress 6.0 or higher
* PHP 7.4 or higher
* The Metahuman Localhost Mac app

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/metahuman-localhost-sync/`
2. Activate the plugin through the 'Plugins' screen in WordPress
3. Go to Tools > Localhost Sync to generate an API key
4. Enter the API key in the Metahuman Localhost Mac app

== Frequently Asked Questions ==

= Is this plugin free? =

Yes, completely free and open source.

= Is my data secure? =

All sync operations require API key authentication with HMAC-signed requests. API keys are stored as SHA-256 hashes. We recommend using HTTPS.

== Changelog ==

= 1.2.0 =
* Single-item content sync: new REST routes GET /content/types (post types with counts), GET /content (browse items of a type), GET /content/item (export one page/post with its custom fields and terms), and POST /content/item (import one item).
* Importing an item backs up the previous version to wp-content/mhls-backups as JSON and reports the backup ID.
* Taxonomy terms travel with each item and are matched by slug (created if missing).
* The /verify response now advertises the content capability.

= 1.1.0 =
* Batched archive transfer: changed files are packed into compressed bundles and sent in a few requests instead of one request per file/chunk — dramatically faster for sites with many scaled images.
* Already-compressed media (images/video/fonts) are bundled without re-compressing; text assets (CSS/JS/etc.) are gzipped.
* New REST routes: POST /files/archive (receive & apply a bundle) and POST /files/archive/pull (stream a bundle of requested files). The /verify response now advertises archive capability, bundle version, and max batch size.
* Fixed HMAC signing for binary request bodies (adds X-MHLS-Body-Sha256), which also repairs authenticated database push.
* Older Mac app versions and the per-file chunk transfer remain fully supported (capability-negotiated fallback).

= 1.0.0 =
* Initial release
* Database export/import with serialized-data-aware URL rewriting
* File sync with chunked transfer and integrity verification
* API key management with HMAC authentication
* Automatic backup before push operations
