Justflows 0.3.7

[0.3.7]

Added

• Customer account plugins. Signed-in customers stay on the core /account page. Shop already adds customer details, orders, and subscriptions there. justflows.quotes is a Shop plugin. It adds a Shop quotes section and stores quotes for one customer on this site, with staff sending and the customer accepting or declining. Accepting opens a Shop order on this site and stores that order id. Opening a quote uses Shop's invoice design (logo, colour, font, and paper). The note and footer on a quote are edited separately from invoices and packing slips. justflows.shared-files adds a Files section and shares a private folder with one user on this site, or asks that user to upload. Payment links stay in Shop. Shared files can be used on its own. Shop quotes can be installed only when Shop is already installed, and turned on only when Shop is active. Each plugin allows multisite and keeps its rows on the site that created them. No matching Public Roadmap issue currently exists.

• Plugin calls accept a hyphen in the plugin id. ctx.plugins.call can reach justflows.shared-files. The caller still needs platform:tenancy to name another site, and the called plugin still checks the session. No matching Public Roadmap issue currently exists.

• Incoming mail routing. A reply is added to the existing ticket on the one site whose ticket carries the reply token in the subject, [SUP-9-replytoken]. The ticket number alone is not enough, because another site can use the same number. (#184)

• Incoming mail. Settings → General can read an IMAP mailbox. The main site, and a website whose plan allows its own mail settings, each use their own mailbox. A website without that permission is read from the main site's mailbox, and while that mailbox is on, its replies are sent there. A message is filed on the site that claims it, otherwise on the one site whose address it was sent to. The same message is not filed twice. POST /api/mail/inbound still accepts a pushed message. (#184)

• SDK: network-wide plugin hooks. A plugin with the new platform:network permission can register a hook with { network: true }. That handler then runs on every site while the plugin is active on the main site, also on sites that never activated it; the plugin's other hooks, routes, and jobs stay per site. ctx.network.mainSiteSettings.get() reads the plugin's main-site settings from any site, and ctx.network.sites() lists every site from the main site. Files those hooks load from /ext/<plugin id>/ are served on every site. A route can return revalidate: "network" to drop every site's page cache. SDK 0.1.7. No matching Public Roadmap issue currently exists.

• SDK: page.viewed action and req.trustedOrigin. page.viewed fires after a visitor receives a public page (not a preview, an error page, or the static exporter's crawl) with the path, user agent, referrer, and host. Plugin routes get req.trustedOrigin, which says whether the Origin header is the site or an origin the host's CORS allow-list vouches for. No matching Public Roadmap issue currently exists.

• Helpdesk sensitive replies. On a ticket, staff can mark a reply or a file as sensitive. The text is encrypted, the customer email does not include it, and Reveal opens it for staff who are allowed. Each reveal is recorded. (#184)

• Helpdesk database. When Helpdesk is installed, the main site chooses the current Justflows database or a separate PostgreSQL, MySQL, or MariaDB database. Database can later move the records: Helpdesk backs them up, creates its tables in the new database, restores and checks every table, and switches only when that matches. The old copy stays, and a destination that already has different records is left unchanged. (#184)

• Helpdesk shows Shop orders from the other sites in the workspace. On a ticket, staff see that customer's orders from every active site in the same workspace, including a shop that lives on another hostname. The order stays on the site that took it, and the support site lists its number, status, total, and items. Opening the order in Shop still happens on the site that owns it. (#184)

• Helpdesk operations. The Helpdesk plugin now counts SLAs in business hours, pauses them while a ticket is pending, assigns by round-robin, load, or language, reminds quiet customers, raises untouched new tickets, and destroys expired sensitive data. The support popup can search public answers and send a request. A site can escalate a ticket to the platform desk, and the main site can write an internal note back. Shop order events are stored for guest order lookup, and a failed payment can open a ticket. Guests who later sign in with the same verified email keep their tickets. Public tickets accept a +1, staff can mask text before publishing, and reports include first-response time and satisfaction. (#184)

• Helpdesk plugin. Adds the first-party justflows.helpdesk plugin: ticket intake, a staff inbox in the admin sidebar, a customer portal, private-by-default visibility, direct handover, private file uploads, guest links, encrypted sensitive replies, per-site quota meters, REST/MCP for the core actions, and diagnostics checks whose failures show under Admin → System → Diagnostics. Activating Helpdesk publishes themed pages at /support, /my-tickets, /public-tickets, and /request-sent, with editable blocks and matching patterns, and keeps those pages out of shared caches. Sending a ticket opens /request-sent instead of an API address. A ticket address such as /support/tickets/… is the themed Ticket page, which the owner can edit, and a reply returns to that page so refreshing does not send it again. The support form fills in the name and email of a signed-in visitor, and the visitor chooses the priority, type, category, and any custom fields. My tickets is an account page: a visitor who is not signed in is sent to sign in, and a signed-in visitor sees their own requests. Deleting Helpdesk with “Remove all data” also removes the Support pages it created. The Settings button on Helpdesk configures guests and signed-in customers, files, retention, the public-site support popup, the support button in other sites' admin, and whether deleting the plugin removes its tickets and files. The popup greeting is one line per language the site has turned on, and the button uses the language of the page. The staff inbox follows the admin language. Opening a ticket leaves the inbox for /admin/plugins/justflows.helpdesk/tickets/<id>, so the address is that ticket. On a ticket, staff can close and reopen it and change its status, priority, type, visibility, category, subject, and assignee. The Desk tab adds categories, teams, canned replies, saved views, custom fields, SLA targets, automations, and a CSV export. Each of those records can be edited and removed. Guests can confirm an email, ask for a fresh link from Find a request, and close, reopen, or rate their own request. The main site's own admin does not show that button, and other sites do not have the switch. The main site can optionally send that button, and its own public popup, to another site in the installation. Left unset, support stays on this site. Support lives on the themed pages, so there is no separate support address. CAPTCHA places are chosen there too; the provider itself stays under Settings → Discussion → Spam protection, and a configured provider is checked on the support form. On a ticket, the order number opens that order in Shop. The Network tab lists tickets on the other sites of the installation. Suggest reply drafts a reply with the site's assistant. Inbound mail to the host can open a ticket or add a reply when the subject names one. A package can be checked against an Ed25519 signature when the installer is given a trusted public key. (#184)

• Functional core blocks. Adds nested lists/checklists, editable tables, Details and Accordions, image/video Covers and Media & Text, Buttons, Cards, Icons, dismissible notices, and keyboard-accessible Tabs. Adds live Site Logo/Title/Tagline, Navigation, Breadcrumbs, Social Links, Table of Contents, and published Content Query blocks with filters, sorting, pagination, and display controls. Includes structured editor controls, safe rendering, responsive styling, and public interactions. (#27)

• Media blocks. Adds Video, Audio, and File/download blocks with URL and caption settings, playback controls, video poster and sizing, safe public rendering, and builder previews. Same-page anchor URLs are now preserved for theme navigation. (#27)

• Space Voyage theme. Adds the complete editable Planet Jumping homepage: exact reference video assets, preloader and docking logo, canvas portal and pointer tilt, Mars → Earth → Venus video transitions with frozen backgrounds, planet facts, custom cursor, and responsive layouts. Adds bounded active-theme client scripts served through /theme.js; existing saved homepages can insert the updated landing pattern. No matching Public Roadmap issue currently exists.

Changed

• Quotes. Quotes is part of the shop: it is listed with Shop, and accepting a quote opens a Shop order. It cannot be installed until Shop is installed on this site, and it cannot be turned on until Shop is active. A customer can add a note when they decline, including on a quote they already declined. Staff see that note and can start a follow-up, which opens a new quote they can edit and send. The new-quote form stays closed until Create quote. A quote can include custom text from the admin. The customer sees it on the quote and on the quote document. Creating a shop order from a quote gives a pay link on this site, including the port used locally. Opening that link starts the Mollie payment, and the same link starts a new payment if an earlier attempt was not completed. After leaving checkout, the customer pays again from their account: the order shows Pay while it is waiting for payment or the last attempt failed. The customer still pays from the quote. In the admin, Quotes copies that payment link instead of opening checkout, so staff do not pay the customer's order. A quote can include several lines. Staff add a published product from this site's shop, or a custom line with its own title and price. They choose the customer by name or email. The email to the customer links to that quote on this site. No matching Public Roadmap issue currently exists.

• Shared files sidebar. Shared files is its own item on the left sidebar. Uploads use this site's storage from Settings → Storage, so an S3 connection on that site stores the file there. Folders stay on the site that created them. No matching Public Roadmap issue currently exists.

• Analytics lives entirely in its plugin. Core no longer records page views, serves /justflows-analytics/collect or /api/analytics, renders the Analytics admin page or the Google tag, or ships the analytics_summary tool and the analytics:read capability. The Analytics plugin (0.2.0) now does all of that itself through the SDK, and adds a main-site network tag for every site's public pages and admin. Installs with Analytics need plugin 0.2.0 after this update. SDK: analytics.head is now seeded with ""; a tag plugin appends at a priority below 100 and a consent plugin gates it at the default priority. analytics:read is no longer a core capability and analytics is no longer a reserved API namespace. No matching Public Roadmap issue currently exists.

• Operator keys. A plugin asks the host, through the operatorKey.ensure hook, to create a 32-byte key in the installation .env when that key is missing. The name has to belong to the calling plugin. An existing valid key is left unchanged, the value is not returned, and it is not stored in the database. Helpdesk uses this for JUSTFLOWS_HELPDESK_KEK, so sensitive replies work without anyone editing .env. (#184)

• React Router version stays off admin pages. Technology scanners read window.__reactRouterVersion from the administration bundle and reported the exact React Router release. That value is no longer set, and the version token is removed from React Router's license banner. The copyright notice stays. No matching Public Roadmap issue currently exists.

• Dependency maintenance. Update pnpm to 12.15.0, Turborepo to 2.11.10, and workspace dependencies to current stable releases, including Vitest 5, EJS 7, React 19.3, and Vite 8.3. Refresh transitive dependencies and the ip-address security override.

• Helpdesk reports. Opening Helpdesk shows Reports. That screen is the statistics: ticket counts, open tickets, first-response time, and satisfaction. Inbox is the next tab. Reports also show the last two weeks, unassigned tickets, tickets past their target, and shop contact rate. The inbox applies saved views and can change several tickets at once. The Network tab can open a platform ticket, the main site can share its popup, and public answers can be searched. Account pages and blocks can start a ticket for an order or a product. (#184)

• Helpdesk desk tools. Reply mail includes a token that files an inbound reply on that ticket. Staff can bulk-set priority, assignee, tag, or close, and a canned reply can set those fields too. Customers are a tab, agents choose which notices they get, and reminder mail can be stopped. The popup can be limited to pages. A message can be split, tickets can be linked, a public thread can be saved as an article, and files can be dropped on a reply. The order list shows item names and tracking when Shop sends them. (#184)

• Helpdesk Shop orders. On a ticket, the Shop list no longer shows Refund and Return. The order number opens that order in Shop. (#184)

• Content type configuration. Adds a table overview and a dedicated two-column editor for labels, descriptions, cache policy, system fields, and custom fields, with expandable field settings, ordering controls, and unsaved-change protection. Per-type settings now control plural labels, dashboard shortcuts, editor selection, historical revision capture, previews, public search, SEO metadata/sitemap inclusion, and comments; existing types inherit their previous behavior. No matching Public Roadmap issue currently exists.

• Block settings show only what applies. All 51 core blocks have explicit sidebar rules. Duplicate and ineffective generic controls are hidden; theme styling shows curated controls and existing overrides instead of the complete theme variable catalog. Block-specific fields follow their controlling choice: video-only Cover controls, numbered-list settings, checklist state, pagination, query layout, navigation, account links and colour-scheme variants. Captioned images retain text alignment and colour controls. Blocks with a schema-owned style variant hide generic styling controls that would overwrite it. Existing generic values stay accessible for clearing, and hiding controls never deletes saved content. Plugin blocks can declare their own inspector switches. (#73)

Fixed

• Quotes menu. The Quotes tab in Shop shows the label once. The icon is no longer the word “quote” next to Quotes. No matching Public Roadmap issue currently exists.

• Account page save. Saving an account page, such as Quotes, no longer fails when the page already stores the locked private cache policy. A public cache policy is still refused. No matching Public Roadmap issue currently exists.

• Failed core update recovery. Installs dependencies and builds in staging before replacing live files. Backs up core files and dependencies, restores them when activation or migrations fail, and skips restart on failure. Keeps the previous release under .updates/previous-release for recovery. Applied database migrations are preserved. No matching Public Roadmap issue currently exists.

• Theme preview stays next to the admin. With a custom domain set as the primary address, opening the theme builder sent its preview to that domain. The frame then left the address the admin was opened on, and the browser showed the preview as unreachable. A ?preview=1 request now stays on the address it was opened on, so the editor's session and the live preview stay together. No matching Public Roadmap issue currently exists.

• A plugin can add the hosts its pages load to the Content Security Policy. The Stripe Buy Button adds https://js.stripe.com and Stripe's checkout frames and API, so the button script is no longer blocked on a site that uses the default policy. The host only accepts https:// origins. No matching Public Roadmap issue currently exists.

• Security headers include a connected custom domain. The admin stays on the platform address while the public site is served from the custom primary domain. Those are different sites to the browser, so script-src 'self', connect-src 'self', and frame-ancestors 'self' blocked the admin from loading that domain's scripts, calling its extension endpoints, and framing the public site. Connected addresses are now added to those policies. The public page then omits X-Frame-Options: SAMEORIGIN, which cannot name the platform address and was still refusing the theme preview. Cross-Origin-Resource-Policy is cross-origin when the site's addresses are not the same site, so the browser does not drop the response after the policy allows it. A domain that is still waiting for DNS is not added. No matching Public Roadmap issue currently exists.

• Static export no longer publishes a homepage that refreshes to itself. After a custom domain is made primary, the platform address redirects visitors there. The exporter only kept the path of that redirect, so / was saved as a page that immediately refreshed to /. The crawl now stays on the host it fetched, and a redirect that does not change the path is left on the live app. No matching Public Roadmap issue currently exists.

• Own-DNS domains get a certificate without a perfect address match. A domain connected with records at the customer's DNS provider is added to the pull zone once its TXT record is present, and Bunny's free HTTP certificate is requested then. The domain becomes connected when that certificate is issued. A single lookup of the CDN hostname no longer has to match the flattened ALIAS address first. No matching Public Roadmap issue currently exists.

• Custom domain check follows the nameservers. A bare domain whose ALIAS already pointed at the platform stayed on "does not point at the target" while a public resolver still cached the previous address, or while one lookup of the CDN hostname returned a different address from the same pool. The check now asks the domain's own nameservers and keeps the CDN addresses from several answers. No matching Public Roadmap issue currently exists.

• Platform quota saves. Saving website limits or defaults now accepts all displayed core, plugin, and content-type meters when the form contains more than 50 fields, including fields left unlimited. Each meter, scope, and value is still validated. (#23)

• Helpdesk menu. Helpdesk is its own item in the left admin sidebar. It no longer sits in the Extensions top bar. (#184)

• Page builder in light and dark. The builder's side panels, block library, inspector controls and pattern previews no longer show white boxes in dark mode. The canvas now previews the site in a chosen scheme, with a Light/Dark switch in the canvas toolbar. Previously it mixed the theme's light colours with parts of its dark palette, and preview placeholders used admin colours instead of the site's. Selection highlights and hints on the canvas follow the previewed scheme so text stays readable. No matching Public Roadmap issue currently exists.

• Admin bundles and theme test ownership. Splits block/validation code out of the builder chunk and separates self-contained SSR modules. Space Voyage behavior tests now live with the theme in the theme registry, so CE CI does not require external theme files. (#27)