Публічная дарожная карта
Што мы будуем
Дарожная карта Community Edition у прамым эфіры з GitHub. Прадметы перамяшчаюцца як працоўныя караблі - тут няма нічога абяцання з датай.
зараз
У стадыі выдання Community Edition.
- Аперацыі#57
Developer debug mode and Admin diagnostics center
Developers and self-hosters need enough visibility to diagnose plugin, hook, API, job, cache, database, rendering, and update failures without enabling unsafe raw error output…
- Змест#101
Built-in site search for the public frontend and admin
A content platform needs search. Visitors expect a working site search box, and editors expect fast content search in admin. Today there is no first-party search surface for…
- Платформа#103
Automatic responsive images and modern formats
#29 shipped the media library (local + S3). It stores originals but does not generate responsive sizes or modern formats, so pages ship oversized images and themes hand-build…
- #135
Headless federated API
Justflows exposes two HTTP surfaces today: the session-cookie management API under /api/ that only the administration SPA drives, and a read-only public content API under…
Далей
Ставіцца ў чаргу, як толькі бягучы зрэз трапляе.
- Платформа#18
Redis cache adapter
Multi-instance deployments need a shared cache rather than process memory or a local filesystem.
- Аперацыі#19
Backup and restore from admin Tools
Self-hosters need a supported, portable snapshot of content, configuration, and media without operating directly on SQL.
- Платформа#64
Optional separate mobile and desktop cache variants
Responsive sites should normally serve the same HTML and use CSS for different viewport sizes. Some themes, plugins, menus, or integrations may intentionally render different…
- Змест#92
Customizable 404 and error pages
When a URL does not resolve, or a request fails with 403, 410, 500, or a maintenance error, visitors currently see a generic system page. Operators want these pages to match…
- Змест#95
Default privacy policy page generator and setting
Most sites need a privacy policy page. Today operators create one by hand with no starting point and no link between "the privacy policy" and the features that reference it…
- Змест#98
Scheduled publishing and future-dated content
Authors expect to set a future publish date and have content go live automatically, and to schedule unpublish/expiry for time-limited content. Without it, publishing depends on…
- Змест#109
Comment spam filtering and submission throttling
#50 shipped public comments and a moderation workflow, and #49 added CAPTCHA to Forms. Comments still need dedicated spam defense or moderation queues fill with junk and…
Пазней
На гарызонце, не запланавана.
- Платформа#23
First-class multi-site
The database already scopes records by site, but operators need a supported administration and routing model for multiple properties.
- Платформа#54
Federated admin login, MFA, and session revocation controls
Production administration needs modern identity options and visible session control beyond password-only login.
- Змест#59
Multiple language selector designs and customization
The existing core.language-switcher correctly resolves localized routes, but presentation is limited to inline language codes or names. Different headers, footers, mobile…
- Платформа#66
Configurable GDPR and PSD2/PSD3 readiness and compliance controls
Organizations need privacy and payment-security controls that match their role, jurisdiction, risk, enabled features, and professional advice. Justflows should provide strong…
- Платформа#94
Safe custom JavaScript and third-party snippet injection
#73 shipped custom CSS in the page builder. Authors also need to add JavaScript — analytics snippets, chat widgets, structured-data blocks, small interactions — per page or…
- Вопыт распрацоўніка#97
Plugin and theme quality checker for authors
#10 documents plugin/theme authoring and #21 covers install trust and signing, but authors have no tool that checks a package for quality, compatibility, and security issues…
- Змест#99
Shareable draft preview links
Editors need to show unpublished or scheduled content to reviewers and stakeholders who do not have admin accounts. Today previewing requires logging in, so review happens over…
- Платформа#105
WebAuthn passkey sign-in for administrators and users
#70 shipped TOTP and #54 covers federated login and session revocation. Passkeys (WebAuthn) are now the strongest widely-supported option: phishing-resistant, no shared secret,…
- Змест#106
Editorial workflow with draft, review, approval, and publish states
Teams larger than one person need review before publishing. Today content is either a draft or published, and any user who can edit can also publish. Newsrooms and marketing…
- Аперацыі#107
Maintenance mode and coming-soon page
Operators need a supported way to take the public site offline for maintenance, or to run a pre-launch "coming soon" page, without stopping the process or hand-editing a proxy.
- Пашырэнні#111
First-party Related Content plugin
Keeping readers on the site after an article is a core publishing need. There is a first-party Forms, Analytics, and Gallery plugin (#14, #15, #75) but nothing for on-page…
- Пашырэнні#112
First-party Newsletter and subscriber management plugin
Publishers want an owned audience. Today there is no first-party way to collect subscribers, confirm opt-in, and send a broadcast or a post digest. This pairs with the Forms…
- Пашырэнні#114
First-party Announcements and site-wide banners plugin
Operators frequently need a temporary site-wide message: a sale, an incident notice, a policy update, an event countdown. Today this means editing the theme. A small…
- Пашырэнні#115
First-party Paid memberships and subscriptions plugin
Many independent publishers monetise through paid memberships and gated content. There is a hosted marketplace (#13) and a public user system (#56), but no first-party way to…
- Пашырэнні#116
First-party Documentation and knowledge-base theme
A large share of Justflows installs will be product docs, knowledge bases, and internal handbooks. There is a Theme Customizer (#72) and page builder (#73) but no first-party…
- Пашырэнні#117
First-party Portfolio and agency theme
Freelancers, studios, and agencies are a natural audience for a self-hosted site builder. A first-party portfolio/agency theme gives them a polished starting point that shows…
- Пашырэнні#118
First-party Magazine and news theme
News sites, blogs with volume, and multi-author publications need dense, hierarchy-rich layouts that the default theme does not target. A first-party magazine theme exercises…
- Аперацыі#119
OpenLiteSpeed / LiteSpeed hosting and LSCache integration
Justflows already ships a production Nginx config (docker/nginx.conf) and targets Node hosting on Plesk / cPanel, but LiteSpeed and OpenLiteSpeed are a large share of that…
- Платформа#120
Detect modified Justflows core and extension files
Justflows already verifies .jfpkg archive digests and Marketplace signatures before installing plugins, themes, and CSS providers (#21). That establishes authenticity at…
- Пашырэнні#121
First-party Content access control and gating plugin
Publishers frequently need to restrict who can see a page, post, custom-type entry, media file, or download — not only paying subscribers. The roadmap has recurring memberships…
- Пашырэнні#122
First-party Ticketing and event tickets plugin
Operators want to sell tickets — for events, tours, workshops, timed entry, donations-with-admission, or any priced pass — directly from their own site instead of a third-party…
- Пашырэнні#123
First-party Interactive maps plugin
Sites need embeddable, interactive maps — store and office locators, event venues, travel and real-estate listings, coverage areas, hiking routes, data overlays — without…
- #126
Create new patterns
Create new patterns available via the load directory in the pattern panel Create new patterns available via the load directory in the pattern panel
- #127
Add PWA
Add a full working PWA feature Add a full working PWA feature should be able to be fully configurable
Адпраўлены
Ужо ў Community Edition.
- Змест#7
Persist custom content types and fields
Admin → Content Types currently edits types in the browser only. They are not stored in the database or exposed on the API, so custom types cannot survive a reload or drive the…
- Платформа#8
Public content REST API and OpenAPI for headless use
The website promises a typed headless CMS. Plugin authors have @justflows/sdk; frontend consumers still need a stable, documented public content API.
- Змест#9
Built-in SEO: titles, canonicals, sitemap, and robots.txt
A complete website out of the box needs discoverability without a plugin.
- Вопыт распрацоўніка#10
Plugin and theme author documentation
The runtime and SDK exist; authors still need a single path from hello-world to a signed-off .jfpkg.
- Вопыт распрацоўніка#11
CI quality gate for core packages
Public CE needs a predictable merge bar: lint, typecheck, and tests on every PR into developers.
- Платформа#12
Admin accessibility pass
The admin is the product for authors. Keyboard paths, names, and contrast should meet a WCAG 2.2 AA bar on the primary flows.
- Пашырэнні#13
Hosted marketplace catalog for community packages
Site owners need a reviewed catalog of plugins and themes that installs directly from Admin → Marketplace.
- Пашырэнні#14
First-party Forms plugin
Contact forms are core functionality for a complete website platform.
- Пашырэнні#15
First-party privacy-friendly Analytics plugin
First-party, on-site analytics provides useful traffic insight without requiring a paid or third-party service.
- Платформа#16
Content webhooks
Headless and integration users need push delivery, not only polling.
- Змест#17
Locale-aware content routing
Multilingual sites need content locales, translation relationships, localized routes, and language-aware discovery.
- Вопыт распрацоўніка#20
Stable SDK compatibility policy
A stable release requires plugin and theme authors to know which public contracts can change and how deprecation works.
- Пашырэнні#21
Plugin signing and install trust
Package installation is a supply-chain boundary and must verify provenance before activation.
- Платформа#22
Role and capability editor in admin
Administrators need more control than selecting one of the five built-in roles.
- Платформа#24
Static / edge export
Static output lets high-traffic public pages be served from object storage or an edge CDN without hitting the Node origin.
- Аперацыі#25
Browser install wizard
Shipped in v0.1.0. Finish setup in the browser after Docker or shared hosting. See README Option A/B.
- Платформа#26
Unified Express server (API + admin + public site)
Shipped in v0.1.0. PostgreSQL, MySQL, and MariaDB. One Node process.
- Змест#27
Visual block editor and page builder
Shipped in v0.1.0. Eleven core blocks and a drag-and-drop page builder.
- Пашырэнні#28
Plugin and theme runtime (.jfpkg + typed SDK)
Shipped in v0.1.0. Upload packages in admin. Authors use @justflows/sdk.
- Змест#29
Media library (local + S3-compatible)
Shipped in v0.1.0. Uploads, derivatives, local and S3 adapters.
- Платформа#30
Auth, CSRF, and security admin
Shipped in v0.1.0. Capabilities, signed sessions, PBKDF2, security header pages.
- Аперацыі#31
Caching, health checks, and in-admin updates
Shipped in v0.1.0. Memory/filesystem cache, Tools performance controls, health, updates.
- Змест#32
WordPress WXR importer (posts and pages)
Shipped in v0.1.0. Admin → Tools accepts a WordPress export .xml.
- Пашырэнні#49
Add configurable CAPTCHA protection to Forms
The shipped Forms implementation has per-IP rate limiting and a honeypot, but automated abuse still needs a challenge option for higher-risk public forms.
- Змест#50
Complete public user comments and moderation workflow
Comment storage, moderation routes, and an admin moderation page are partially present, but visitors cannot submit or view comments through the public site, so the feature is…
- Платформа#51
Allow administrators to change the admin URL safely
Operators may want the administration entry path to be non-default for policy, branding, or reduction of opportunistic login noise. This is defense-in-depth and must not be…
- Платформа#52
Add a Justflows marketing and discovery section to Admin Home
Admin Home should help operators discover useful Justflows resources, releases, marketplace packages, documentation, and community channels without overwhelming core…
- Платформа#53
Add advanced per-user scope and capability selection
Default roles are convenient but cannot express narrower access such as editing only selected content types, locales, sites, or owned content. This issue complements #22, which…
- Аперацыі#55
Fix migration bookkeeping and PostgreSQL pending-migration reruns
The migration runner calls every name in MIGRATIONORDER on each installed-server startup and never reads migrations. Only 0001initial writes a tracker row; migrations 0002…
- Платформа#56
Replace mock Users admin with real user management API
Administrators need to manage real accounts from Admin → Users. This is distinct from #22: this bug restores the expected fixed-role user-management behavior; #22 adds custom…
- Змест#58
Site favicon management in Admin and public frontend
Site owners need to select a recognizable browser/app icon without editing theme files or server assets manually.
- Змест#60
Multiple light and dark mode selector designs
The existing core.color-scheme widget supports light, dark, and optional system behavior, but only basic button and icon presentation. Themes need several polished selector…
- Змест#61
Dedicated menu designer with horizontal, dropdown, and mega-menu layouts
Admin → Menus can create menus from pages, posts, custom links, and nested child items, but authors cannot visually design navigation behavior or build responsive dropdown and…
- Платформа#63
Customizable system email designs and template editor
Justflows can send system notifications through sendmail or SMTP, but subjects and text bodies are currently assembled in individual routes/services. Site owners need…
- Змест#65
Working revisions for every content type without overwriting the live version
Authors must be able to edit and save a draft of already-published content without changing what visitors currently see. The draft should become live only through an explicit…
- Платформа#69
Admin server-side rendering for every admin route
Administrators should get a fully rendered admin document on first load. Site owners must never need a frontend build toolchain, and admin screens must not be indexed.
- Платформа#70
TOTP two-factor authentication and password rotation
A compromised password could not be rotated from inside the product, and there was no second factor on admin sign-in.
- Платформа#71
Administrative audit log and subject-access/erasure APIs
Security and privacy operations need a reconstructable record of administrative actions, plus a way to export or erase personal data held about an account.
- Змест#72
Theme Customizer: homepage, blog index, footer, design tokens, and dark mode
A site owner should choose the home and blog pages, edit the footer, and control typography, spacing, and light/dark palettes without editing theme files.
- Змест#73
Page builder: saved headers, grid, reusable blocks, animations, and custom CSS
Authors need layout, header, and styling controls in the visual builder without dropping into theme source.
- Змест#74
Post List and Link List blocks
A complete site needs a blog index and reusable link columns without a plugin.
- Пашырэнні#75
First-party Gallery plugin with extra layouts
Image galleries are core website functionality and should install as a first-party package alongside Forms and Analytics.
- Змест#78
Keep selected language in public nav and fall back when a translation is missing
On a multilingual public site, choosing NL (or any non-default locale) must stick for the rest of the visit. Menu links currently drop back to the default language, and…
- Аперацыі#87
Automatic core updates and release discovery in Admin → Updates
Self-hosters currently have to watch for releases and upload justflows.zip by hand from Admin -> Updates. The screen should discover new releases on its own and, when an…
- Платформа#93
Self-service password reset for administrators and users
Administrators and registered users who forget a password currently have no supported self-service recovery. #70 delivered scheduled password rotation, not a reset flow.…
- Змест#96
WordPress-style permalink structure settings
Operators migrating from WordPress and other CMSs expect to control URL structure: date-based, /%postname%/, category-prefixed, custom base paths per content type, and a…
- Змест#100
Redirect manager with 404 logging, import, and export
Site migrations, restructures, and permalink changes create broken inbound links. Operators need to manage redirects in admin instead of editing proxy configuration, and to see…
- Змест#102
RSS, Atom, and JSON feeds for content
#9 shipped titles, canonicals, sitemap, and robots.txt, but there are no syndication feeds. Readers, aggregators, podcast clients, and newsletter tools expect RSS 2.0, Atom,…
- Аперацыі#104
SMTP transport configuration and email delivery log
#63 covers email template design, but there is no admin surface for the transport that actually sends mail, and no visibility into whether messages were delivered. Operators…
- Змест#108
Trash and recycle bin with retention for all content types
Deletion today is effectively permanent, which makes accidental loss unrecoverable without a backup restore (#19). Users expect a trash with a grace period, like every mature CMS.
- Змест#110
Block pattern library and pattern directory
#73 shipped reusable blocks and saved headers. Authors still build common section layouts (hero, feature grid, pricing, testimonial, CTA, FAQ) from scratch each time. A pattern…
- Пашырэнні#113
First-party Cookie consent and script-gating plugin
Sites that use analytics, embeds, or marketing snippets in the EU and similar jurisdictions need a consent banner and a way to gate scripts until consent is given. This…
- #132
BUG Webhook DB entry incorrect
On admin/webhooks when creating a new webhook. We get this errot Incorrect datetime value: '2026-09-05T08:42:02.512Z' for column justflows.webhookendpoints.createdat at row 1…
Гэтая старонка чытае публічны праект Justflows GitHub. Слупкі могуць змяняцца без даты выпуску.
Гатовы плыць?
Далучайцеся да суполкі з адкрытым зыходным кодам, якая будуе будучыню кантэнт-платформаў.