=== APlug PWA/App-Zentrale ===
Contributors: aplug
Tags: pwa, progressive web app, service worker, offline, manifest, app, push notifications, analytics
Requires at least: 6.4
Tested up to: 6.8
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Verwaltet eine Website-App oder mehrere getrennte PWA-Bereiche mit Manifest, Service Worker, Offline-Seite, Diagnose und optionaler Statistik.

== Description ==

APlug PWA/App-Zentrale erzeugt installierbare Progressive-Web-App-Konfigurationen für WordPress, ohne dass Administratoren Manifest- oder Service-Worker-Dateien manuell bearbeiten müssen.

Funktionen des Prototyps:

* eine zentrale Website-App oder mehrere getrennte App-Bereiche,
* App-Name, Kurzname, Beschreibung, Startseite, Scope, Farben, Symbole, Anzeige und Ausrichtung,
* dynamische Web-App-Manifeste,
* getrennte Service Worker mit versionsabhängigen Caches,
* Offline-Seiten und drei Cache-Strategien,
* Schutz von Login, Administration, REST, Warenkorb, Kasse, Konten und Kundenbereichen,
* Installationshinweise und Shortcodes,
* server- und browserseitige Diagnose,
* optionale datensparsame Start-, Wiederkehr- und Installationsschätzungen,
* optionale verschlüsselte Push-Abonnements,
* Schnittstellen zu APlug Benachrichtigungscenter und BesucherAnalyse.

The plugin does not send Web Push messages by itself. It stores subscriptions securely and exposes a documented adapter interface. Delivery requires a compatible notification or Web Push adapter.

== Installation ==

1. Upload the plugin ZIP in Plugins > Add New > Upload Plugin.
2. Activate APlug PWA/App-Zentrale.
3. Open APlug PWA/App > Apps.
4. Configure app name, start URL, scope, colors and 192/512 pixel icons.
5. Run APlug PWA/App > Diagnose.
6. Activate the app only after all critical checks pass.
7. Enable statistics or push only after updating the privacy information for the website.

Pretty permalinks and HTTPS are required for normal production operation.

== External services ==

The plugin does not contact an external service by default.

If push is enabled by the administrator and a visitor explicitly grants permission, the visitor's browser creates a subscription with the push service selected by the browser or operating system. A compatible delivery adapter later sends encrypted messages to that subscription endpoint. Depending on the device this may involve a service operated by the browser or platform vendor. The PWA/App-Zentrale itself does not contain a delivery client, private VAPID key, telemetry service, CDN or remote code loader.

Administrators must document the actual browser push services and the chosen delivery adapter in their privacy information before enabling push.

== Privacy ==

Statistics and push are disabled by default. Optional statistics use an installation-specific HMAC instead of the raw local browser identifier and do not store IP addresses or full user agents. Push endpoints and browser keys are encrypted at rest. See `PRIVACY.md` for data categories, retention and deletion behavior.

== Frequently Asked Questions ==

= Can several apps be managed on one WordPress site? =

Yes. Each app receives its own manifest and service worker. Scopes must be unique. For nested scopes, the most specific active scope is selected for the page.

= Are logged-in or checkout pages cached? =

No. The plugin excludes critical paths and only stores navigation responses that WordPress explicitly marks as public. Logged-in and sensitive responses receive private/no-store headers.

= Does the plugin know exactly how many users installed the app? =

No. Browsers do not provide a universal installation inventory. The plugin records the browser-dependent appinstalled event and standalone launches as estimates, and labels them accordingly.

= Does the plugin send push notifications? =

The prototype manages browser permission, encrypted subscription storage and the service-worker notification handler. A compatible delivery adapter is required to encrypt and send Web Push messages through the browser vendor push service.

= Are external services contacted? =

Not by default. When push is enabled by the administrator and accepted by the visitor, the browser creates a subscription with its platform push service. A later delivery adapter may contact that endpoint. The plugin contains no tracking, telemetry or CDN integration.

= What happens on uninstall? =

Capabilities and scheduled cleanup are removed. App configurations and collected data remain unless the administrator explicitly enables complete data deletion before uninstalling.

== Screenshots ==

1. App overview with separate scopes and status.
2. App editor for manifest, icons, offline behavior and caching.
3. Server and browser diagnostics.
4. Aggregated, privacy-oriented app statistics.
5. Global statistics, push and uninstall settings.

== Changelog ==

= 1.0.0 =
* Initial prototype.
* Added multiple PWA app areas, manifests, service workers and offline pages.
* Added public-only caching and sensitive-area exclusions.
* Added install UI, diagnostics and privacy-oriented aggregate statistics.
* Added encrypted push subscription management and APlug integration services.
* Added complete security, privacy, developer and WordPress.org preparation documentation.

== Upgrade Notice ==

= 1.0.0 =
Initial prototype. Test on a staging site before production use.
