# Conn2Flow

> PHP framework for websites and admin systems built from versioned resources synchronized into the database. Documentation checked against the source code.

- [Conn2Flow documentation](https://conn2flow.com/docs/): Conn2Flow guides, concepts and reference, checked against the source code.

## Guides

- [Installation](https://conn2flow.com/docs/guides/installation/): How to always download the latest web installer, prepare the server, install Conn2Flow and get it ready to use.
- [How to write and publish documentation](https://conn2flow.com/docs/guides/documentation/): The Conn2Flow docs contract: where docs live, the required frontmatter, the audit routine against the code and publishing to the website.
- [Site administration with Tailwind](https://conn2flow.com/docs/guides/site-administration/): Products, coupons, subscriptions, shipping, presentations and site panel operations.
- [Create a plugin](https://conn2flow.com/docs/guides/create-a-plugin/): Plugin manifest, resources, build and installation according to the installer.
- [Create an administrative module](https://conn2flow.com/docs/guides/create-a-module/): Module scaffold, generated code review and resource synchronization.
- [Set up the development environment](https://conn2flow.com/docs/guides/development-environment/): Local Docker, PHP 8.5 option and Cloudflare Tunnel according to repository files.
- [Understand CI releases](https://conn2flow.com/docs/guides/ci-cd/): Triggers, tests and artifacts in the Core and installer release workflows.
- [Update and deploy a project](https://conn2flow.com/docs/guides/deploy-a-project/): Local pipeline, deployment modes, cron and sitemap.
- [Use Conn2Flow Dev Tools in VS Code](https://conn2flow.com/docs/guides/dev-tools-vscode/): VS Code extension panel for SDD scope, projects, diagnostics and Core operations.

## Concepts

- [Conn2Flow architecture](https://conn2flow.com/docs/concepts/architecture/): How the router, modules, resources, and database assemble a page.
- [Request lifecycle](https://conn2flow.com/docs/concepts/request-lifecycle/): The path of a request in Conn2Flow: front controller, gestor.php, session and CSRF, page routing, permission, module execution, HTML assembly and response.
- [Global variables and configuration](https://conn2flow.com/docs/concepts/global-variables/): What lives in $_GESTOR, $_CONFIG, $_BANCO and $_INDEX, where each value comes from (.env, config.php, router, module) and how the .env is found for each domain.
- [Resource system](https://conn2flow.com/docs/concepts/resources/): How layouts, pages, components, templates, variables and other resources go from files in resources/ to *Data.json and into the database, and how deploys preserve what the user edited.
- [Hooks: actions and filters](https://conn2flow.com/docs/concepts/hooks/): How modules, plugins and projects react to core events without changing its code: JSON declaration, the hooks table, on-demand loading and the catalog of events the core fires.
- [Widgets](https://conn2flow.com/docs/concepts/widgets/): Module markers, callbacks, rendering, and widget limitations.
- [Multilingual system](https://conn2flow.com/docs/concepts/multilingual/): Language selection, paths, resources, and content isolation.
- [Plugins](https://conn2flow.com/docs/concepts/plugins/): Installable packages, module resources, and installer validation.
- [Projects and overlays](https://conn2flow.com/docs/concepts/projects/): How a project uses the core, synchronizes data, and preserves local authorship.
- [CSS and Tailwind](https://conn2flow.com/docs/concepts/css-and-tailwind/): Authored CSS, derived CSS, and runtime layer order.
- [Administrative interface](https://conn2flow.com/docs/concepts/admin-interface/): Menus, CRUD, Tailwind components, and iframe previews.
- [System updates](https://conn2flow.com/docs/concepts/system-updates/): Bootstrap, package integrity, application, and web stages.
- [AI and administrative security](https://conn2flow.com/docs/concepts/ai-security/): AI editor access boundaries and known risks from the core review.
- [Conn2Flow vision](https://conn2flow.com/docs/concepts/vision/): Content as resources, CLI automation, and product direction.

## Reference

- [HTTP API](https://conn2flow.com/docs/reference/api/): Core HTTP routes, authentication, response envelopes and endpoint families.
- [Authentication API](https://conn2flow.com/docs/reference/api/auth/): Mobile login, logout, current user and available modules.
- [Distributed module API](https://conn2flow.com/docs/reference/api/distributed/): HMAC channel between central and distributed installations.
- [Gateway endpoints](https://conn2flow.com/docs/reference/api/gateways/): Payment webhooks and returns in the separate gateway controller.
- [Module API](https://conn2flow.com/docs/reference/api/modules/): Authenticated dispatch to module API hooks.
- [OAuth2 API](https://conn2flow.com/docs/reference/api/oauth/): HTTP access token renewal endpoint.
- [Project API](https://conn2flow.com/docs/reference/api/project/): Project update upload and resource export.
- [System update API](https://conn2flow.com/docs/reference/api/system/): Session based administrative update actions.
- [CLI c2f](https://conn2flow.com/docs/reference/cli/): Index of commands registered in the Core c2f console.
- [CLI: AI and SDD](https://conn2flow.com/docs/reference/cli/ai/): c2f ai commands, arguments and options declared in source code.
- [CLI: Assets](https://conn2flow.com/docs/reference/cli/assets/): c2f assets commands, arguments and options declared in source code.
- [CLI: Authentication](https://conn2flow.com/docs/reference/cli/auth/): c2f auth commands, arguments and options declared in source code.
- [CLI: CSS](https://conn2flow.com/docs/reference/cli/css/): c2f css commands, arguments and options declared in source code.
- [CLI: Database](https://conn2flow.com/docs/reference/cli/db/): c2f db commands, arguments and options declared in source code.
- [CLI: Docker](https://conn2flow.com/docs/reference/cli/docker/): c2f docker commands, arguments and options declared in source code.
- [CLI: Documentation](https://conn2flow.com/docs/reference/cli/docs/): c2f docs commands, arguments and options declared in source code.
- [CLI: Commands env](https://conn2flow.com/docs/reference/cli/env/): Reference for env commands registered in the c2f console.
- [CLI: Commands help](https://conn2flow.com/docs/reference/cli/help/): Reference for help commands registered in the c2f console.
- [CLI: Commands installer](https://conn2flow.com/docs/reference/cli/installer/): Reference for installer commands registered in the c2f console.
- [CLI: Commands manager](https://conn2flow.com/docs/reference/cli/manager/): Reference for manager commands registered in the c2f console.
- [CLI: Commands module](https://conn2flow.com/docs/reference/cli/module/): Reference for module commands registered in the c2f console.
- [CLI: Commands motion](https://conn2flow.com/docs/reference/cli/motion/): Reference for motion commands registered in the c2f console.
- [CLI: Commands page](https://conn2flow.com/docs/reference/cli/page/): Reference for page commands registered in the c2f console.
- [CLI: Commands plugin](https://conn2flow.com/docs/reference/cli/plugin/): Reference for plugin commands registered in the c2f console.
- [CLI: Commands project](https://conn2flow.com/docs/reference/cli/project/): Reference for project commands registered in the c2f console.
- [CLI: Commands resources](https://conn2flow.com/docs/reference/cli/resources/): Reference for resources commands registered in the c2f console.
- [CLI: Commands tailwind](https://conn2flow.com/docs/reference/cli/tailwind/): Reference for tailwind commands registered in the c2f console.
- [CLI: Updates](https://conn2flow.com/docs/reference/cli/update/): c2f commands of the update family: roll back a delivery and clashes (list, download, decide).
- [Gestor libraries](https://conn2flow.com/docs/reference/libraries/): How the libraries in gestor/bibliotecas/ are registered and loaded, which ones are always loaded and how a module requests its own.
- [admin-topbar.php library](https://conn2flow.com/docs/reference/libraries/admin-topbar/): Administrative admin-topbar behavior, persistence and permissions.
- [oauth2.php library](https://conn2flow.com/docs/reference/libraries/oauth2/): Token server of the Gestor API: access and refresh tokens signed with the RSA key, a per-user limit, Bearer validation and renewal.
- [ia.php library](https://conn2flow.com/docs/reference/libraries/ia/): The editors' AI prompt component (servers, models, prompts and modes per target) and sending the prompt to the Gemini API.
- [recursos.php library](https://conn2flow.com/docs/reference/libraries/recursos/): Static asset URLs: direct delivery from public_html/dist/ when the file was published, with a fallback to the arquivo-estatico controller.
- [atualizacoes-automatica.php library](https://conn2flow.com/docs/reference/libraries/atualizacoes-automatica/): Per-installation automatic update scheduling, decisions and refused versions.
- [autenticacao.php library](https://conn2flow.com/docs/reference/libraries/autenticacao/): The login token signed with the site's RSA key, RSA encryption of secrets, per-IP attempt control (login, sign-up, password recovery) and credential validation for the distributed channel.
- [atualizacoes-execucao.php library](https://conn2flow.com/docs/reference/libraries/atualizacoes-execucao/): System update triggered through the API: allow-listed arguments, command-line PHP, trigger and state (req-201).
- [lang.php library](https://conn2flow.com/docs/reference/libraries/lang/): JSON dictionaries and __t() for the messages of command-line scripts (updater, compiler, plugins). It is not the site translation.
- [controles.php library](https://conn2flow.com/docs/reference/libraries/controles/): Shared administrative controls, native form elements and input masks.
- [interface.php library](https://conn2flow.com/docs/reference/libraries/interface/): The CRUD engine of the admin modules: the start/finish cycle per option, Tailwind or DataTables listing according to framework, forms, validation, history, field backups, alerts and the Tailwind component variants.
- [banco.php library](https://conn2flow.com/docs/reference/libraries/banco/): The Gestor database layer (MySQLi): connection, queries, structured SELECT, accumulated INSERT/UPDATE, unique identifiers and distributed mode.
- [db-data.php library](https://conn2flow.com/docs/reference/libraries/db-data/): Complete JSON seed tables, 80 MiB parts and integrity-checked manifests.
- [atualizacoes-choques.php library](https://conn2flow.com/docs/reference/libraries/atualizacoes-choques/): Clash records in the database: list, detail with both versions and resolution (req-199).
- [deploy-lock.php library](https://conn2flow.com/docs/reference/libraries/deploy-lock/): Atomic per-environment lock that prevents two deploys at the same time (req-197).
- [modulo-distribuido.php library](https://conn2flow.com/docs/reference/libraries/modulo-distribuido/): Central/distributed architecture: a module runs on the central Conn2Flow and writes its data to the client installation's database over an HMAC channel, with login and permission decided by the central.
- [comunicacao.php library](https://conn2flow.com/docs/reference/libraries/comunicacao/): Sending e-mail over SMTP (PHPMailer) with the site's e-mail layout, recipients, attachments and embedded images; and the print page.
- [assets-externos.php library](https://conn2flow.com/docs/reference/libraries/assets-externos/): Single registry of third-party libraries (jQuery, Fomantic, CodeMirror, Quill, in-browser Tailwind…) with pinned versions, served from disk with a CDN only as a fallback.
- [arquivo.php library](https://conn2flow.com/docs/reference/libraries/arquivo/): Pure functions for uploads and files: sanitizing names, blocking executable extensions, resolving paths without path traversal and deducing type and MIME.
- [formato.php library](https://conn2flow.com/docs/reference/libraries/formato/): Conversions between the database format and the Brazilian one: dates, numbers with decimal comma and thousands separator, and the formato_dado() dispatcher.
- [formulario.php library](https://conn2flow.com/docs/reference/libraries/formulario/): The public form processor (validation, anti-bot, CAPTCHA, per-IP limits, storage and e-mail), injecting forms into the page and validating admin panel forms.
- [ftp.php library](https://conn2flow.com/docs/reference/libraries/ftp/): An FTP/FTPS connection kept in $_GESTOR and uploading or downloading one file at a time. No callers in the core.
- [geral.php library](https://conn2flow.com/docs/reference/libraries/geral/): A single function, geral_nl2br(), with no callers in the core.
- [gestor.php library](https://conn2flow.com/docs/reference/libraries/gestor/): The Gestor's support core: components and layouts, per-module texts, page resources, SEO and OpenGraph, restricted access, redirection, database-backed sessions and sanitization of the served HTML.
- [hooks.php library](https://conn2flow.com/docs/reference/libraries/hooks/): Hooks API reference: hook_do_action, hook_apply_filters, hook_has_* and the registration functions used by the pipeline.
- [host.php library](https://conn2flow.com/docs/reference/libraries/host/): Legacy of the multi-host mode: host_url(), host_pub_id() and host_loja_nome() query tables that current installations do not have.
- [html.php library](https://conn2flow.com/docs/reference/libraries/html/): Editing an HTML snippet with DOMDocument: open it, change attributes, text and classes by CSS class name, and return the HTML.
- [html-editor.php library](https://conn2flow.com/docs/reference/libraries/html-editor/): The HTML and CSS editor of the page, layout, component, template, publication and widget CRUDs: code, visual, Tailwind preview, templates, variables, widgets and AI assistant.
- [modelo.php library](https://conn2flow.com/docs/reference/libraries/modelo/): Variable replacement and delimited-block handling in HTML templates — the foundation of every screen the Gestor renders.
- [instalacao-manifesto.php library](https://conn2flow.com/docs/reference/libraries/instalacao-manifesto/): Per-layer manifest, project > plugin > core precedence, clashes, snapshot and rollback (req-198).
- [interface-listar-tailwind.php library](https://conn2flow.com/docs/reference/libraries/interface-listar-tailwind/): Administrative interface-listar-tailwind behavior, persistence and permissions.
- [jwt.php library](https://conn2flow.com/docs/reference/libraries/jwt/): HS256 JWT tokens with versioned symmetric keys in the database, rotation and a grace period. It is not the Gestor login token.
- [log.php library](https://conn2flow.com/docs/reference/libraries/log/): log_disco() for daily files in gestor/logs/, log_backtrace() for diagnostics and the legacy functions that write to the historico table.
- [pagina.php library](https://conn2flow.com/docs/reference/libraries/pagina/): Shortcuts over $_GESTOR['pagina']: cutting cells, replacing global variables and masking markers for the database.
- [paypal.php library](https://conn2flow.com/docs/reference/libraries/paypal/): PayPal REST API client: credentials from the .env or from the gateway, cached OAuth token, orders, refunds, catalog, plans, subscriptions, invoices, payouts, disputes and webhook.
- [pdf.php library](https://conn2flow.com/docs/reference/libraries/pdf/): Loads tFPDF and offers pdf_voucher(), a fixed-layout voucher generator inherited from an old system and with no callers in the core.
- [plugins-consts.php library](https://conn2flow.com/docs/reference/libraries/plugins-consts/): Exit codes and execution states of the plugin installer, and plg_exit_code_label().
- [plugins-installer.php library](https://conn2flow.com/docs/reference/libraries/plugins-installer/): Installs and updates a plugin: fetches the package (upload, public or private GitHub, local folder), checks SHA-256 and the manifest, moves it to plugins/<slug>/, runs migrations and syncs the data.
- [plugins.php library](https://conn2flow.com/docs/reference/libraries/plugins/): A template file with no use: it contains only the sample function template_opcao().
- [cron.php library](https://conn2flow.com/docs/reference/libraries/cron/): Scheduled routines: declaring a task in the module, scheduling the ticks on the server and what the gestor/cron.php engine actually runs.
- [seguranca.php library](https://conn2flow.com/docs/reference/libraries/seguranca/): Admin panel CSRF, CAPTCHA verification (reCAPTCHA and Turnstile), session User-Agent and IP checks, random tokens and normalization of the post-login return path.
- [sitemap.php library](https://conn2flow.com/docs/reference/libraries/sitemap/): Generation and incremental updates of sitemap.xml and robots.txt: which pages go in, where the files live and when they are updated.
- [oauth.php library](https://conn2flow.com/docs/reference/libraries/oauth/): Social login with Google and Meta (Facebook): authorization URL with state, code exchange and profile reading.
- [stripe.php library](https://conn2flow.com/docs/reference/libraries/stripe/): REST client for the Stripe API: gateway credentials, customers, payments, subscriptions, product and price catalog, refunds and webhook validation.
- [editor-texto.php library](https://conn2flow.com/docs/reference/libraries/editor-texto/): The rich text editor (Quill) in the admin panel and the CSS that makes published content look the way the author saw it while writing.
- [2fa.php library](https://conn2flow.com/docs/reference/libraries/2fa/): Second authentication factor: TOTP compatible with authenticator apps and a 6-digit code by e-mail.
- [usuario.php library](https://conn2flow.com/docs/reference/libraries/usuario/): The login cookie, the user's active sessions, provisional authorization for sensitive actions, personal API tokens (c2f_pat_) and 2FA recovery codes.
- [configuracao.php library](https://conn2flow.com/docs/reference/libraries/configuracao/): The text-variable editor of a module (screen and saving) used by the variables and modulos modules, and the per-host variables legacy.
- [variaveis.php library](https://conn2flow.com/docs/reference/libraries/variaveis/): Reading and writing system variables (module _sistema) in the variaveis table — a library unused by the core, distinct from the gestor_variaveis() text system.
- [ip.php library](https://conn2flow.com/docs/reference/libraries/ip/): Finding the visitor's IP (ip_get) and validating an address (ip_check), including the behavior behind a reverse proxy and a CDN.
- [widgets.php library](https://conn2flow.com/docs/reference/libraries/widgets/): widgets_get(): how a widgets# marker on a page becomes the HTML returned by a module function, and how the same widget answers over AJAX.
- [Admin categories module](https://conn2flow.com/docs/reference/modules/admin-categorias/): Hierarchical categories associated with modules and files.
- [Admin components module](https://conn2flow.com/docs/reference/modules/admin-componentes/): Editing reusable HTML/CSS components.
- [admin-cron module](https://conn2flow.com/docs/reference/modules/admin-cron/): Scheduled-task panel and manual triggers.
- [admin-environment module](https://conn2flow.com/docs/reference/modules/admin-environment/): Panel for domain environment settings.
- [Admin files module](https://conn2flow.com/docs/reference/modules/admin-arquivos/): Browsing, uploading, and organizing physical site files.
- [admin-ia module](https://conn2flow.com/docs/reference/modules/admin-ia/): AI provider registration and connection tests.
- [Admin layouts module](https://conn2flow.com/docs/reference/modules/admin-layouts/): Editing complete page layouts.
- [admin-paginas module](https://conn2flow.com/docs/reference/modules/admin-paginas/): Authoring site pages and system screens, routes, permissions, SEO, scheduling and history.
- [admin-plugins module](https://conn2flow.com/docs/reference/modules/admin-plugins/): Plugin registration, installation, and updates.
- [admin-prompts-ia module](https://conn2flow.com/docs/reference/modules/admin-prompts-ia/): AI prompt library by target and language.
- [admin-templates module](https://conn2flow.com/docs/reference/modules/admin-templates/): Creation and maintenance of HTML templates for Gestor resources.
- [admin-atualizacoes module](https://conn2flow.com/docs/reference/modules/admin-atualizacoes/): System update orchestration and history.
- [admin-modos-ia module](https://conn2flow.com/docs/reference/modules/admin-modos-ia/): AI instruction modes by target and language.
- [contatos module](https://conn2flow.com/docs/reference/modules/contatos/): Public contact page backed by the forms system.
- [Cookie-consent module](https://conn2flow.com/docs/reference/modules/cookie-consent/): Cookie notice, preferences card by category and release of scripts according to the decision.
- [dashboard module](https://conn2flow.com/docs/reference/modules/dashboard/): Home page, cards, and the site's visual editing toolbar.
- [Forms module](https://conn2flow.com/docs/reference/modules/forms/): Creating, rendering, and submitting public forms.
- [Forms submissions module](https://conn2flow.com/docs/reference/modules/forms-submissions/): Reviewing, tracking, and replying to form submissions.
- [Galleries module](https://conn2flow.com/docs/reference/modules/galleries/): Curating and rendering image galleries.
- [interface module](https://conn2flow.com/docs/reference/modules/interface/): Shared text catalog for the administrative interface.
- [Menus module](https://conn2flow.com/docs/reference/modules/menus/): Navigation menus curated in the admin panel and rendered by a widget in layouts and pages, with a tree of typed items and per-visitor variations.
- [Modules catalog](https://conn2flow.com/docs/reference/modules/modulos/): Administrative module records and configuration variables.
- [Module groups](https://conn2flow.com/docs/reference/modules/modulos-grupos/): Module catalog groups and menu presentation.
- [Module operations](https://conn2flow.com/docs/reference/modules/modulos-operacoes/): Registering granular operations associated with modules.
- [pages-index module](https://conn2flow.com/docs/reference/modules/pages-index/): Search and paginated listing of public pages, with summaries, term highlighting and keyboard navigation.
- [publisher module](https://conn2flow.com/docs/reference/modules/publisher/): Publication definitions: templates, path prefixes and the field schema used by publication pages.
- [publisher-highlights module](https://conn2flow.com/docs/reference/modules/publisher-highlights/): Publication highlight blocks with automatic or manual curation, templates and field mapping.
- [publisher-index module](https://conn2flow.com/docs/reference/modules/publisher-index/): Publication indexes with search, sorting, manual curation and AJAX pagination.
- [publisher-pages module](https://conn2flow.com/docs/reference/modules/publisher-pages/): Publications with structured fields, materialized HTML, inherited CSS and movement between publishers.
- [Forms search module](https://conn2flow.com/docs/reference/modules/forms-search/): GET search forms, page suggestions, and query logging.
- [User profile module](https://conn2flow.com/docs/reference/modules/perfil-usuario/): Authentication, signup, profile, 2FA, sessions, and personal API keys.
- [Users module](https://conn2flow.com/docs/reference/modules/usuarios/): Administrative account creation and maintenance.
- [User profiles module](https://conn2flow.com/docs/reference/modules/usuarios-perfis/): Profiles granting access to modules and operations.
- [variables module](https://conn2flow.com/docs/reference/modules/variables/): Editing module configuration variables by language.

## What's new

- [What's new](https://conn2flow.com/docs/whats-new/): Notable changes in recent Conn2Flow releases.
- [2.10 series](https://conn2flow.com/docs/whats-new/2.10/): Notable changes recorded from 2.10.0 through 2.10.13.
- [What's new in 2.10.13](https://conn2flow.com/docs/whats-new/2.10.13/): Silent CSRF renewal and request recovery.
- [What's new in 2.10.12](https://conn2flow.com/docs/whats-new/2.10.12/): Turnstile, authentication, redirects, and hook synchronization.
- [What's new in 2.10.11](https://conn2flow.com/docs/whats-new/2.10.11/): Request protection, restricted access, and project transport.
- [What's new in 2.10.0](https://conn2flow.com/docs/whats-new/2.10.0/): Tailwind dependencies, local assets, and responsive tables.
- [2.9 series](https://conn2flow.com/docs/whats-new/2.9/): Live editing and media changes recorded in the 2.9 series.
- [What's new in 2.9.51](https://conn2flow.com/docs/whats-new/2.9.51/): File selection, galleries, and media validation.
- [What's new in 2.9.39](https://conn2flow.com/docs/whats-new/2.9.39/): Live Editor toolbar and contextual editing panels.

## SDD

- [Core SDD](https://conn2flow.com/docs/sdd/): Public specifications, decisions, processes and batches.