BLUDIT PRO 3.22.0 —DEVELOPER REFERENCE (RAW TEXT)
Patched codebase (incorporates all fixes from the 3.22.0 patch manifest)
Build 20260510, codename "BrownBear"

================================================================================
1. IDENTIFICATION
================================================================================

  BLUDIT_VERSION      : '3.22.0'
  BLUDIT_CODENAME     : 'BrownBear'
  BLUDIT_BUILD        : '20260510'
  BLUDIT_RELEASE_DATE : '2026-05-10'
  BLUDIT_PRO          : true (when pro file is loaded)
  BLUDIT_PRO_HASH     : substr(md5(BLUDIT_BUILD), 0, 8) -> e.g. '5d2fcbb4'

  Pro file loading (init.php):
    define('BLUDIT_PRO_HASH', substr(md5(BLUDIT_BUILD), 0, 8));
    $_bluditProFile = PATH_KERNEL . 'bludit.pro.' . BLUDIT_PRO_HASH . '.php';
    if (file_exists($_bluditProFile)) { include($_bluditProFile); }

  The pro file is named 'bludit.pro.5d2fcbb4.php' (hash varies per build).

================================================================================
2. COMPLETE BOOT SEQUENCE (SITE SIDE)
================================================================================

  index.php
    └─ init.php
         ├─ Constants: BLUDIT_VERSION, codename, build, debug flags
         ├─ PHP ini (display_errors=0, html_errors=0, log_errors=1)
         ├─ PATH constants (LANGUAGES, THEMES, PLUGINS, KERNEL, CONTENT, etc.)
         ├─ User environment variables (boot/variables.php)
         ├─ mb_internal_encoding / mb_http_output set to CHARSET
         ├─ Abstract classes (dbjson, dblist, plugin)
         ├─ Core classes (pages, users, tags, language, site, categories,
         │   syslog, pagex, category, tag, user, url, login, parsedown, security)
         ├─ functions.php loaded
         ├─ Helper classes (text, log, date, theme, session, redirect, sanitize,
         │   valid, email, filesystem, alert, paginator, image, tcp, dom, cookie)
         ├─ BLUDIT_PRO_HASH computed, pro file included if exists
         ├─ Objects created: $pages, $users, $tags, $categories, $site, $url,
         │   $security, $syslog
         ├─ HTML_PATH_ROOT and all DOMAIN_* / HTML_PATH_* constants defined
         ├─ $language = new Language($site->language())
         ├─ $url->checkFilters($site->uriFilters())
         ├─ TAG_URI_FILTER, CATEGORY_URI_FILTER, PAGE_URI_FILTER defined
         ├─ ORDER_BY, EXTREME_FRIENDLY_URL, AUTOSAVE_INTERVAL, IMAGE_RESTRICT,
         │   IMAGE_RELATIVE_TO_ABSOLUTE, MARKDOWN_PARSER defined
         ├─ THEME_DIR_* and DOMAIN_* constants finalized
         ├─ $ID_EXECUTION = uniqid()
         ├─ $WHERE_AM_I = $url->whereAmI()
         └─ $L = $language (shortcut)

    └─ site.php
         ├─ 60.plugins.php   → buildPlugins() populates $plugins, $pluginsInstalled
         ├─ Theme::plugins('beforeAll')
         ├─ 60.router.php    → trailing-slash redirects
         ├─ 69.pages.php     → builds $content, $page, $staticContent
         │    ├─ Scheduler auto-publishes scheduled pages and fires
         │    │   'afterPageCreate' hooks for each key (patched: passes correct key array)
         │    ├─ Preview tokens use site's random previewSalt (patched)
         │    ├─ buildStaticPages() → $staticContent
         │    ├─ If homepage set + whereAmI='home' → buildThePage() w/ homepage slug
         │    ├─ Else if whereAmI='page' → buildThePage()
         │    ├─ Else if whereAmI='tag' → buildPagesByTag()
         │    ├─ Else if whereAmI='category' → buildPagesByCategory()
         │    ├─ Else if whereAmI='home' or 'blog' → buildPagesForHome()
         │    ├─ $page = $content[0] (if set)
         │    └─ If $url->notFound() → $page = buildErrorPage()
         ├─ 99.header.php    → HTTP status header + X-Powered-By
         ├─ 99.paginator.php → Populates Paginator::$pager
         │    └─ Theme::plugins('paginator')
         ├─ 99.themes.php    → Loads theme language, $themePlugin = getPlugin($site->theme())
         ├─ Theme::plugins('beforeSiteLoad')
         ├─ Theme init.php (if exists)
         ├─ Theme index.php   ← THEME RENDERS HERE
         ├─ Theme::plugins('afterSiteLoad')
         └─ Theme::plugins('afterAll')

================================================================================
3. ADMIN BOOT SEQUENCE
================================================================================

  admin.php
    ├─ Session::start()
    ├─ $login = new Login()
    ├─ $layout array built from URL slug
    ├─ 60.plugins.php → $pluginsInstalled populated
    ├─ Plugin admin controller detection (case-insensitive)
    ├─ If slug === 'ajax' → 99.security.php → load AJAX file
    └─ Else (admin area):
         ├─ 69.pages.php
         ├─ 99.header.php
         ├─ 99.paginator.php
         ├─ 99.themes.php
         ├─ 99.security.php
         ├─ If notFound or not logged → login
         ├─ Theme::plugins('beforeAdminLoad')
         ├─ Admin theme init.php (if exists)
         ├─ Controller loaded
         ├─ Admin theme index.php or login.php
         └─ Theme::plugins('afterAdminLoad')

================================================================================
4. COMPLETE HOOKS REGISTRY
================================================================================

Site Hooks:
  beforeAll          – site.php, before router (earliest hook)
  afterAll           – site.php, after theme (final hook)
  beforeSiteLoad     – site.php, before theme init (content built, paginator ready)
  afterSiteLoad      – site.php, after theme render
  siteHead           – Must be called by theme in <head>
  siteBodyBegin      – Theme <body> start
  siteBodyEnd        – Theme </body>
  siteSidebar        – Theme sidebar (sorted by plugin position)
  pageBegin          – Before page content
  pageEnd            – After page content
  paginator          – 99.paginator.php, after Paginator::$pager populated

Admin Hooks:
  beforeAdminLoad    – admin.php, before theme
  afterAdminLoad     – admin.php, after theme
  adminHead          – Admin <head>
  adminBodyBegin     – Admin <body> start
  adminBodyEnd       – Admin </body>
  adminSidebar       – Admin sidebar (plugin sidebar links)
  adminContentSidebar– Admin content sidebar
  dashboard          – Admin dashboard area
  editorToolbar      – Content editor toolbar

Content Lifecycle Hooks:
  afterPageCreate    – Page created (args: array($key)). Fires for manual and scheduler creation.
  afterPageModify    – Page edited (args: array($key))
  afterPageDelete    – Page deleted (args: array($key))

Login Hooks:
  loginHead          – Login page <head>
  loginBodyBegin     – Login page body start
  loginBodyEnd       – Login page body end

================================================================================
5. PLUGIN SYSTEM INTERNALS
================================================================================

5.1 Plugin Base Class (Plugin – /bl-kernel/abstract/plugin.class.php)

  Constructor Lifecycle:
    1. $this->dbFields = array()
    2. $this->customHooks = array()
    3. Directory name auto-detected via ReflectionClass
    4. Class name auto-detected
    5. $this->formButtons = true
    6. $this->init() – YOUR CODE: define dbFields, customHooks
    7. $this->db = $this->dbFields (default values)
    8. filenameDb and filenameMetadata set
    9. If plugin is installed:
         - Database loaded from file into $this->db
         - $this->prepare() called

5.2 Plugin Properties

  $this->dbFields         (array)  – Set in init()
  $this->db               (array)  – Set by constructor
  $this->formButtons      (bool)   – Set in init()
  $this->customHooks      (array)  – Set in init()
  $this->directoryName    (string) – Auto-detected
  $this->className        (string) – Auto-detected
  $this->metadata         (array)  – Auto-detected

5.3 Plugin Methods (complete)

  init()                     – Define $this->dbFields
  prepare()                  – Called after database loaded
  form()                     – Return settings HTML
  post()                     – Handle settings form POST
  save()                     – Persist database
  install($position)         – Create workspace + database
  uninstall()                – Delete workspace + database
  installed()                – Check if database file exists
  getValue($field, $html=true) – Returns sanitized value; returns null when field
                                 is not defined (patched: isset check before
                                 accessing dbFields fallback)
  setField($field, $value)   – Set + persist
  setPosition($position)     – Sidebar position
  getMetadata($key)          – Read metadata
  setMetadata($key, $value)  – Set metadata (runtime)
  includeCSS($filename)      – Output <link> tag
  includeJS($filename)       – Output <script> tag
  domainPath()               – DOMAIN_PLUGINS + directoryName + '/'
  htmlPath()                 – HTML_PATH_PLUGINS + directoryName + '/'
  phpPath()                  – Filesystem path to plugin directory
  phpPathDB()                – PATH_PLUGINS_DATABASES + directoryName + DS
                               (for multi‑file plugin databases) [NEW 3.22.0]
  workspace()                – PATH_WORKSPACES + directoryName + DS
  webhook($URI, $afterUri, $fixed) – Match URL against webhook
  isCompatible()             – Major.minor version match
  name()                     – From metadata
  description()              – From metadata
  label()                    – From metadata
  author()                   – From metadata
  email()                    – From metadata
  website()                  – From metadata
  position()                 – From metadata
  version()                  – From metadata
  releaseDate()              – From metadata
  className()                – From metadata
  formButtons()              – From metadata
  directoryName()            – From metadata
  type()                     – From metadata

5.4 Plugin Build Process (60.plugins.php)

  buildPlugins():
    1. Scan PATH_PLUGINS for directories
    2. Include plugin.php from each
    3. Instantiate each plugin class
    4. Load language file, set name/description
    5. Merge additional translation keys into $L
    6. Populate $plugins['all'][$pluginClass]
    7. If installed ($Plugin->installed()):
         - Register custom hooks
         - Push into $pluginsInstalled[$pluginClass]
         - Bind to all matching $pluginsEvents
    8. Sort $plugins['siteSidebar'] by position

================================================================================
6. THEME SYSTEM INTERNALS
================================================================================

6.1 Theme File Structure

  bl-themes/your-theme/
    index.php       – Required
    metadata.json   – Required
    languages/
      en.json       – Required (theme-data.name, theme-data.description)
    init.php        – Optional, runs before index.php
    install.php     – Optional, runs on theme activation
    css/
    js/
    img/

6.2 Theme Loading (99.themes.php)

  Sets $themePlugin = getPlugin($site->theme()) – the theme's companion plugin
  (if any). This allows theme authors to ship configuration settings. The
  Alternative theme demonstrates this with its "alternative" plugin.

6.3 Theme Class – Complete Static Helper Methods

  Theme::title()                  – string   – $site->title()
  Theme::description()            – string   – $site->description()
  Theme::slogan()                 – string   – $site->slogan()
  Theme::footer()                 – string   – $site->footer()
  Theme::lang()                   – string   – Short language code
  Theme::siteUrl()                – string   – DOMAIN_BASE
  Theme::adminUrl()               – string   – DOMAIN_ADMIN
  Theme::rssUrl()                 – string/false – RSS feed URL
  Theme::sitemapUrl()             – string/false – Sitemap URL
  Theme::metaTags('title')        – string   – <title> tag
  Theme::metaTags('description')  – string   – <meta description>
  Theme::metaTagTitle()           – string   – Same as metaTags('title'); falls
                                               back to homepage title format if the
                                               current tag/category is not found
                                               (patched)
  Theme::metaTagDescription()     – string   – Same as metaTags('description')
  Theme::charset($c)              – string   – <meta charset>
  Theme::viewport($c)             – string   – <meta viewport>
  Theme::keywords($k)             – string   – <meta keywords>
  Theme::favicon($f, $t)          – string   – Favicon link
  Theme::css($files, $base)       – string   – CSS <link> tags
  Theme::js($files, $base, $attrs)– string   – JS <script> tags
  Theme::javascript(...)          – string   – Alias for js()
  Theme::src($file, $base)        – string   – Asset URL helper
  Theme::jquery()                 – string   – jQuery <script>
  Theme::jsBootstrap($attrs)      – string   – Bootstrap JS bundle
  Theme::cssBootstrap()           – string   – Bootstrap CSS
  Theme::cssBootstrapIcons()      – string   – Bootstrap Icons CSS
  Theme::cssLineAwesome()         – string   – Line Awesome icon font
  Theme::jsSortable($attrs)       – string   – jQuery sortable
  Theme::socialNetworks()         – array    – Configured social networks
  Theme::plugins($hook, $args)    – void     – Dispatches hook (echoes output)
  Theme::headTitle()              – string   – DEPRECATED → metaTagTitle()
  Theme::headDescription()        – string   – DEPRECATED → metaTagDescription()

================================================================================
7. ROUTING AND REQUEST LIFECYCLE
================================================================================

7.1 URI Filters (site.class.php::uriFilters())

  $filters['admin']    = '/' . ADMIN_URI_FILTER . '/';         // '/admin/'
  $filters['page']     = $this->getField('uriPage');           // '/'
  $filters['tag']      = $this->getField('uriTag');            // '/tag/'
  $filters['category'] = $this->getField('uriCategory');       // '/category/'
  if ($this->getField('uriBlog')) {
      $filters['blog'] = $this->getField('uriBlog');           // '/blog/' (only if homepage set)
  }

7.2 URL Matching (Url::checkFilters())

  1. Admin filter first
  2. Remaining filters sorted by URI length (longest first)
  3. For each filter, URI compared against HTML_PATH_ROOT + filter
  4. Slug extracted, whereAmI set
  5. Special cases: empty slug + '/' → 'home', admin → slug trimmed
  6. No match → setNotFound()

7.3 Router Rules (60.router.php)

  - /admin      → redirect to /admin/
  - /blog       → redirect to /blog/  (only if homepage set)
  - /my-page/   → redirect to /my-page (pages only)

7.4 $WHERE_AM_I Values

  'home'       – Root URL, no slug
  'page'       – Single page
  'tag'        – Tag listing
  'category'   – Category listing
  'blog'       – Blog listing (when homepage is set)
  'admin'      – Admin panel
  'search'     – Search results page

================================================================================
8. CONTENT OBJECT MODEL
================================================================================

8.1 Page Object (class Page in pagex.class.php) – 50 Methods

  title()                    – string        – Page title
  description()              – string        – Meta description
  content($sanitize=false)   – string        – Markdown-parsed, cached
  contentRaw($sanitize=false)– string        – Raw file content
  contentBreak($sanitize=false)– string      – Content before <!-- pagebreak -->
  readMore()                 – bool          – Has pagebreak?
  readingTime()              – string        – Estimated reading time (patched:
                                              uses plain-text content for accurate
                                              word count)
  permalink($absolute=true)  – string        – Full URL
  key()                      – string        – Database key
  slug()                     – string        – Last segment of key
  date($format=false)        – string        – Formatted date
  dateRaw()                  – string        – 'Y-m-d H:i:s'
  dateModified($format=false)– string        – Modification date
  relativeTime($complete=false)– string      – "5 minutes ago"
  username()                 – string        – Author username
  user($method=false)        – mixed         – e.g. $page->user('nickname')
  type()                     – string        – published, static, draft, sticky,
                                              scheduled, autosave
  published()                – bool
  sticky()                   – bool
  isStatic()                 – bool
  draft()                    – bool
  scheduled()                – bool
  autosave()                 – bool
  tags($array=false)         – string/array  – Comma-separated or [tagKey => name]
  category()                 – string        – Category name
  categoryKey()              – string        – Category key
  categoryDescription()      – string        – Category description
  categoryTemplate()         – string        – Category template filename
  categoryPermalink()        – string        – Category URL
  categoryMap($field)        – mixed         – name, template, description, key,
                                              list
  template()                 – string        – Custom template filename
  coverImage($absolute=true) – string/false  – Cover image URL
  thumbCoverImage()          – string/false  – Thumbnail URL
  uuid()                     – string        – Universal identifier
  allowComments()            – bool
  position()                 – int
  noindex()                  – bool
  nofollow()                 – bool
  noarchive()                – bool
  isParent()                 – bool
  isChild()                  – bool
  parent()                   – string/false  – Parent key
  parentKey()                – string/false
  parentMethod($method)      – mixed         – Call method on parent
  hasChildren()              – bool
  childrenKeys()             – array         – Child keys
  children()                 – Page[]        – Child page objects
  previousKey()              – string/false
  nextKey()                  – string/false
  related()                  – array         – Keys of related pages
  custom($field, $options=false)– mixed      – Custom field value
  json($array=false)         – string/array  – JSON representation
  getValue($field)           – mixed         – Raw field access
  getDB()                    – array         – All internal vars

8.2 Category Object

  key()                      – string
  name()                     – string
  permalink()                – string
  template()                 – string
  description()              – string
  pages()                    – array (Page keys)
  json($returnsArray=false)  – string/array

8.3 Tag Object

  key()                      – string
  name()                     – string
  permalink()                – string
  pages()                    – array (Page keys)
  json($returnsArray=false)  – string/array

================================================================================
9. SITE OBJECT – COMPLETE REFERENCE
================================================================================

All methods available; those marked [NEW 3.22.0] or [PATCHED] are noted.

  title()                    – string   – Site title
  slogan()                   – string   – Site slogan
  description()              – string   – Site description
  footer()                   – string   – Footer text
  theme()                    – string   – Active theme directory name
  adminTheme()               – string   – Admin theme directory name
  homepage()                 – string/false – Homepage slug (or false if not set)
  pageNotFound()             – string   – Slug of 404 page
  language()                 – string   – Full locale (e.g., "en_US")
  languageShortVersion()     – string   – Short language code (e.g., "en")
  locale()                   – string   – Locale for setlocale()
  timezone()                 – string   – e.g., "America/New_York"
  dateFormat()               – string   – e.g., "Y-m-d"
  timeFormat()               – string   – e.g., "H:i:s"
  itemsPerPage()             – int      – Number of posts per page
  orderBy()                  – string   – Sort order for posts
  url()                      – string   – Site URL (without protocol)
  domain()                   – string   – Domain name
  urlPath()                  – string   – URL path (e.g., "/blog")
  isHTTPS()                  – bool     – Is HTTPS enabled?
  logo($absolute=true)       – string/false – Logo URL
  emailFrom()                – string   – Sender email for system messages
  extremeFriendly()          – bool     – Extreme friendly URLs on?
  autosaveInterval()         – int      – Autosave interval (seconds)
  markdownParser()           – bool     – Use built‑in Markdown parser?
  imageRestrict()            – bool     – Restrict image uploads?
  imageRelativeToAbsolute()  – bool     – Convert relative image URLs?
  thumbnailEnable()          – bool     – Enable thumbnail generation?
  thumbnailWidth()           – int      – Thumbnail width
  thumbnailHeight()          – int      – Thumbnail height
  thumbnailQuality()         – int      – Thumbnail JPEG quality
  titleFormatPages()         – string   – Title format for pages
  titleFormatHomepage()      – string   – Title format for homepage
  titleFormatCategory()      – string   – Title format for categories
  titleFormatTag()           – string   – Title format for tags
  uriFilters($filter='')     – array/string – URI filter definitions
  customFields()             – array    – Custom field definitions
  defaultContentStatus()     – string   – Default status for new pages
  get()                      – array    – All site settings as array
  twitter()                  – string   – Twitter username
  facebook()                 – string   – Facebook URL
  instagram()                – string   – Instagram URL
  linkedin()                 – string   – LinkedIn URL
  github()                   – string   – GitHub URL
  youtube()                  – string   – YouTube URL
  discord()                  – string   – Discord invite
  mastodon()                 – string   – Mastodon URL
  bluesky()                  – string   – Bluesky URL
  xing()                     – string   – Xing URL [NEW 3.22.0]
  previewSalt()              – string   – Per‑installation random secret for
                                         preview token HMAC; auto‑generated if
                                         missing [PATCHED]
  rss()                      – string   – DEPRECATED
  sitemap()                  – string   – DEPRECATED

================================================================================
10. API ENDPOINTS
================================================================================

10.1 API Plugin Webhooks (unchanged structure)

  Method   Endpoint                  Auth Required   Returns
  ------   --------                  -------------   -------
  GET      /api/pages                No (token only) List of pages
  GET      /api/pages/{key}          No              Single page
  POST     /api/pages                Yes (auth token)Created page
  PUT      /api/pages/{key}          Yes             Updated page
  DELETE   /api/pages/{key}          Yes             Success message
  GET      /api/settings             Yes             Site settings
  PUT      /api/settings             Yes             Success message
  POST     /api/images               Yes             Uploaded image URL [PATCHED:
                                                     MIME type verified via
                                                     Filesystem::mimeType()]
  GET      /api/tags                 No              List of tags
  GET      /api/tags/{key}           No              Tag with pages
  GET      /api/categories           No              List of categories
  GET      /api/categories/{key}     No              Category with pages
  GET      /api/users                No              List of users
  GET      /api/users/{username}     No              User profile
  GET      /api/files/{pageKey}      No              List of files
  POST     /api/files/{pageKey}      Yes             Uploaded file

10.2 AJAX Endpoints (all in /bl-kernel/ajax/)

  All require admin login + CSRF token validation.

  change-type.php          – Change page type via AJAX
  clippy.php               – Quick search; role‑based filtering: author users see
                             only their own pages [PATCHED]
  content-get-list.php     – Search content by title
  delete-image.php         – Delete image + thumbnail (with legacy recovery)
  generate-slug.php        – Generate URL slug
  get-published.php        – Search published pages (select2)
  list-images.php          – Media Manager pagination (scans originals, pairs
                             thumbnails)
  logo-remove.php          – Remove site logo
  logo-upload.php          – Upload site logo
  profile-picture-upload.php – Upload profile picture
  save-as-draft.php        – Autosave/preview (async fetch)
  upload-images.php        – Upload images (Media Manager); filename sanitization

================================================================================
11. EVENT/HOOK SYSTEM
================================================================================

  Hook registration is in 60.plugins.php (buildPlugins()).
  Dispatch is via Theme::plugins($type, $args) which echoes output directly.

================================================================================
12. CONFIGURATION SYSTEM
================================================================================

12.1 Site Configuration Database (site.class.php)

  $dbFields added in 3.22.0:
    'xing'        => ''   – Xing social network
    'previewSalt' => ''   – Preview token secret; auto‑generated if empty
                            [PATCHED]
  All other fields unchanged.

12.2 User Database (users.class.php)

  $dbFields added in 3.22.0:
    'xing'        => ''   – Xing social network

================================================================================
13. AUTHENTICATION AND SESSION HANDLING
================================================================================

13.1 Session Class (session.class.php) – rewritten for 3.22.0

  - Uses array‑based session_set_cookie_params with:
      lifetime, path, domain, secure, httponly:true, samesite:'Lax'
  - Prepends '__Secure-' to session name when HTTPS is active
  - Session name stored in Session::$sessionName = 'BLUDIT-KEY'

13.2 Cookie Class (cookie.class.php) – NEW in 3.22.0

  Cookie::get($key)           – Read cookie value
  Cookie::set($key, $value, $days, $options) – Set cookie (SameSite=Lax, HttpOnly)
  Cookie::remove($key)        – Delete cookie
  Cookie::isEmpty($key)       – Check if empty

13.3 Login Class (login.class.php) – updated

  - setLogin() calls session_regenerate_id(true) to prevent session fixation
  - Session validation checks if user exists and is not disabled (password '!')

13.4 Security Class (security.class.php) – updated

  - New method: getUserIp() – Returns only REMOTE_ADDR (no proxy headers);
    recommends rewriting REMOTE_ADDR at web server level when behind a proxy.

================================================================================
14. GLOBAL VARIABLES
================================================================================

  $content       – Page[]          – List of pages for current view
  $page          – Page/false     – Single page object (if applicable)
  $staticContent – Page[]          – All static pages
  $pages         – Pages          – Pages manager object
  $site          – Site           – Site settings object
  $url           – Url            – URL/router object
  $tags          – Tags           – Tags manager object
  $categories    – Categories     – Categories manager object
  $L             – Language       – Language translations object
  $WHERE_AM_I    – string         – Current location (home, page, etc.)
  $plugins       – array          – All plugin instances and hook bindings
  $syslog        – Syslog         – System logger
  $login         – Login          – Authentication handler
  $security      – Security       – CSRF and IP helper
  $themePlugin   – Plugin/false   – Active theme’s companion plugin (if any)

================================================================================
15. GLOBAL FUNCTIONS (functions.php)
================================================================================

15.1 Existing Functions (unchanged)

  reindexCategories()
  reindexTags()
  buildErrorPage()
  buildThePage()              – Now uses $site->previewSalt() for preview HMAC
                                [PATCHED]
  buildPagesForHome()
  buildPagesByCategory()
  buildPagesByTag()
  buildPagesFor()
  buildStaticPages()
  buildPage()
  buildParentPages()
  createPage()
  editPage()
  deletePage()
  editUser()
  disableUser()
  deleteUser()
  createUser()
  editSettings()
  getCategories()
  getCategory()
  getTags()
  getTag()
  ajaxResponse()

15.2 New Functions in 3.22.0

  activatePlugin($className)            – Install and activate a plugin
  deactivatePlugin($className)          – Uninstall a plugin
  deactivateAllPlugin()                 – Uninstall all plugins
  changePluginsPosition($classList)     – Reorder plugins
  createCategory($args)                 – Create a category
  editCategory($args)                   – Edit a category
  deleteCategory($args)                 – Delete a category
  changeUserPassword($args)             – Change a user's password
  checkRole($allowRoles, $redirect)     – Check current user's role
  activateTheme($themeDir)              – Activate a theme (deactivates old,
                                          runs install.php, activates companion)
  transformImage($file, $imageDir, $thumbnailDir) – Process image + thumbnail
  mediaManagerListImages($imagePath, $thumbnailPath, $chunk) – Media Manager list
  downloadRestrictedFile($file)         – Send file with headers for download

================================================================================
16. PAGES CLASS – NEW METHOD
================================================================================

  $pages->countByType($published, $static, $sticky, $draft, $scheduled) : int
    Counts pages matching the given type flags. Added for accurate API pagination.

================================================================================
17. IMAGE CLASS – WEBP SUPPORT
================================================================================

  The Image class (/bl-kernel/helpers/image.class.php) now:
    - openImage() checks for IMG_WEBP support and calls imagecreatefromwebp()
    - saveImage() handles 'webp' extension via imagewebp()
    - All decoders check imagetypes() and function_exists() to avoid fatal
      errors on stripped GD builds.

================================================================================
18. FILESYSTEM CLASS – IMPROVEMENTS
================================================================================

  mv($old, $new)        – Tries rename() first; falls back to copy()+unlink()
                          for cross‑partition moves.
  mimeType($file)       – Uses finfo_file as fallback when mime_content_type
                          is unavailable.
  symlink($from, $to)   – NEW: creates symlink or copies if symlink fails.
  zip()                 – Create ZIP archives.
  unzip()               – Extract ZIP archives.

================================================================================
19. USER CLASS – NEW FIELD AND METHOD
================================================================================

  New field: $user->xing() – returns the Xing social network profile.
  profilePicture()         – Sanitizes the username before locating the image:
                            removes special chars, quotes, and spaces.

================================================================================
20. URL CLASS – COMPLETE REFERENCE
================================================================================

  Property access: all properties are protected. Use setter methods or public
  getters.

  uri()                    – string   – Raw request URI (no query string)
  slug()                   – string   – Slug after filter match
  whereAmI()               – string   – home, page, tag, category, blog, admin, search
  notFound()               – bool     – True if no matching route
  pageNumber()             – int      – From $_GET['page'], default 1
  activeFilter()           – string   – Current matched filter
  filters($type, $trim=true)– string  – Filter URI prefix
  parameter($field)        – mixed    – GET parameter value
  explodeSlug($delimiter)  – array    – Explode slug by delimiter
  httpCode()               – int      – HTTP status code
  httpMessage()            – string   – HTTP status message
  setWhereAmI($where)      – void     – Sets $GLOBALS['WHERE_AM_I']
  setSlug($slug)           – void
  setHttpCode($code)       – void
  setHttpMessage($msg)     – void
  setNotFound()            – void     – Sets page, notFound, and 404
  checkFilters($filters)   – bool     – Internal (init.php)

================================================================================
21. PAGINATOR CLASS – COMPLETE STATIC REFERENCE
================================================================================

  Paginator::numberOfPages()      – int
  Paginator::currentPage()        – int (1‑based)
  Paginator::firstPage()          – int (always 1)
  Paginator::nextPage()           – int
  Paginator::prevPage()           – int
  Paginator::showNext()           – bool
  Paginator::showPrev()           – bool
  Paginator::firstPageUrl()       – string
  Paginator::lastPageUrl()        – string
  Paginator::nextPageUrl()        – string
  Paginator::previousPageUrl()    – string
  Paginator::numberUrl($n)        – string (uses ?page=N)
  Paginator::html($prev, $next, $showNum) – string
  Paginator::bootstrap_html($prev, $next, $showNum) – string
  Paginator::get($key)            – mixed
  Paginator::set($key, $value)    – void

================================================================================
22. KEY CONSTANTS
================================================================================

  BLUDIT_PRO_HASH                    – 8‑char hex hash for pro file naming
  PROFILE_IMG_WIDTH                  = 400
  PROFILE_IMG_HEIGHT                 = 400
  PROFILE_IMG_QUALITY                = 100
  MEDIA_MANAGER_NUMBER_OF_FILES      = 5
  MEDIA_MANAGER_SORT_BY_DATE         = true
  NOTIFICATIONS_AMOUNT               = 10
  ALLOWED_IMG_EXTENSION              = ['gif','png','jpg','jpeg','svg','webp']
  ALLOWED_IMG_MIMETYPES              = ['image/gif','image/png','image/jpeg',
                                        'image/svg+xml','image/webp']
  ALLOWED_FILE_EXTENSIONS            = ['gif','png','jpg','jpeg','webp','pdf',
                                        'txt','doc','docx','xls','xlsx','ppt',
                                        'pptx','zip','tar','gz','mp3','mp4',
                                        'wav','ogg','json','md']

================================================================================
23. BUILT‑IN PLUGINS SHIPPED WITH 3.22.0
================================================================================

  Plugin                 Class                  Version   Type        Purpose
  ---------------------  ---------------------  --------  ----------  ---------
  API                    pluginAPI              3.22.0    plugin      REST API (image MIME check patched)
  Alternative            alternative            3.22.0    theme       Alternative theme companion
  Backup Manager         pluginBackupManager    3.22.0    plugin (Pro)Encrypted backups; restore aborts if emergency backup fails (patched)
  Canonical              pluginCanonical        3.22.0    plugin      Canonical URL tags
  Categories             pluginCategories       3.22.0    plugin      Sidebar category list
  Comments               pluginComments         1.0.0     plugin      Full commenting system
  Custom Fields Parser   pluginCustomFieldsParser3.22.0   plugin      Parse custom field placeholders
  Domain Migrator        (Pro)                  3.22.0    plugin (Pro)Migrate domains
  EasyMDE                plugineasyMDE          2.18.0    plugin      Markdown editor
  Gallery                pluginGallery          3.22.0    plugin (Pro)Image galleries
  Hit Counter            pluginHitCounter       3.22.0    plugin      Visit counter sidebar
  HTML Code              pluginHTMLCode         3.22.0    plugin      Custom HTML injection
  Links                  pluginLinks            3.22.0    plugin      Sidebar links
  Maintenance Mode       pluginMaintenanceMode  3.22.0    plugin      Maintenance page
  Navigation             pluginNavigation       3.22.0    plugin      Sidebar navigation
  Popeye                 popeye                 3.22.0    theme       Popeye theme companion
  Remote Content         pluginRemoteContent    3.22.0    plugin      Remote ZIP content import
  Robots                 pluginRobots           3.22.0    plugin      robots.txt + meta robots
  RSS                    pluginRSS              3.22.0    plugin      RSS feed
  Search                 pluginSearch           3.22.0    plugin      Full‑text search
  Sitemap                pluginSitemap          3.22.0    plugin      XML sitemap
  Static Pages           pluginStaticPages      3.22.0    plugin      Sidebar static pages
  Tags                   pluginTags             3.22.0    plugin      Sidebar tag list
  TimeMachine X          pluginTimeMachineX     3.22.0    plugin (Pro)Content versioning
  TinyMCE                pluginTinymce          8.3.2     plugin      WYSIWYG editor
  Version                pluginVersion          3.22.0    plugin      Version info sidebar
  Visits Stats           pluginVisitsStats      3.22.0    plugin      Visitor analytics

================================================================================
24. REMAINING KNOWN BUGS AND PITFALLS
================================================================================

  The following issues exist in the 3.22.0 codebase but are not covered by the
  patch manifest:

  1. Sticky pages only on page 1 – Sticky posts are merged into the main content
     list only when $url->pageNumber() == 1.
  2. $staticContent built even on 404 – Static pages are always constructed in
     69.pages.php, even for 404 requests.
  3. Silent reindex loop – If category/tag data is stale, the index is rebuilt
     on every request without notification.
  4. Hook output via echo – Theme::plugins() echoes directly; plugins cannot
     return values for further processing.

  Previously fixed (patched) issues:
  - Database read race condition (flock LOCK_SH added)
  - Predictable preview token (uses site-specific random salt)
  - Admin quick‑search title leak (role‑based filtering)
  - readingTime() counting HTML entities (uses plain text)
  - metaTagTitle() undefined variable (fallback to homepage format)
  - Scheduler missing afterPageCreate arguments (returns keys array)
  - Plugin::getValue() undefined index (isset check)
  - Backup Manager emergency backup failure (aborts restore)
  - API image upload lacking MIME check (validates MIME type)

================================================================================
25. COMPLETE FILE PATH REFERENCE (3.22.0, PATCHED)
================================================================================

  bludit/
  ├─ index.php
  ├─ bl-kernel/
  │  ├─ boot/
  │  │  ├─ init.php                ← BLUDIT_VERSION='3.22.0', build constants
  │  │  ├─ admin.php               ← admin boot
  │  │  ├─ site.php                ← site boot
  │  │  ├─ variables.php           ← user configuration constants
  │  │  └─ rules/
  │  │     ├─ 60.plugins.php       ← plugin loading
  │  │     ├─ 60.router.php        ← URL redirects
  │  │     ├─ 69.pages.php         ← content building (scheduler + preview
  │  │     │                         token patched)
  │  │     ├─ 99.header.php        ← HTTP headers
  │  │     ├─ 99.paginator.php     ← pagination setup
  │  │     ├─ 99.security.php      ← CSRF validation
  │  │     └─ 99.themes.php        ← theme loading
  │  ├─ abstract/
  │  │  ├─ dbjson.class.php        ← JSON database (flock LOCK_SH – patched)
  │  │  ├─ dblist.class.php        ← List database
  │  │  └─ plugin.class.php        ← Plugin base class (getValue() patched)
  │  ├─ helpers/
  │  │  ├─ alert.class.php
  │  │  ├─ cookie.class.php
  │  │  ├─ date.class.php
  │  │  ├─ dom.class.php
  │  │  ├─ email.class.php
  │  │  ├─ filesystem.class.php    ← Improved mv(), symlink(), mimeType()
  │  │  ├─ image.class.php         ← WebP support
  │  │  ├─ log.class.php
  │  │  ├─ paginator.class.php
  │  │  ├─ redirect.class.php
  │  │  ├─ sanitize.class.php
  │  │  ├─ session.class.php       ← Array cookie params, __Secure-
  │  │  ├─ tcp.class.php
  │  │  ├─ text.class.php
  │  │  ├─ theme.class.php         ← metaTagTitle() fallback patched
  │  │  └─ valid.class.php
  │  ├─ ajax/
  │  │  ├─ clippy.php              ← Role‑based filtering (patched)
  │  │  └─ ...                     ← (other AJAX endpoints)
  │  ├─ admin/
  │  ├─ css/
  │  ├─ js/
  │  ├─ functions.php              ← buildThePage() uses previewSalt (patched)
  │  ├─ pages.class.php            ← countByType(); scheduler return (patched)
  │  ├─ users.class.php            ← +xing
  │  ├─ site.class.php             ← +xing, previewSalt (patched)
  │  ├─ security.class.php         ← getUserIp()
  │  ├─ login.class.php
  │  ├─ pagex.class.php            ← readingTime() patched
  │  ├─ url.class.php
  │  ├─ user.class.php             ← +xing, improved profilePicture()
  │  └─ bludit.pro.*.php          ← Dynamic hash‑based filename
  ├─ bl-plugins/
  │  ├─ api/plugin.php             ← Image upload MIME check patched
  │  ├─ backup-manager/plugin.php  ← Emergency backup failure fix patched
  │  └─ ...                        ← (other plugins)
  ├─ bl-themes/alternative/        ← Updated theme
  └─ bl-content/                   ← Runtime data

================================================================================
END OF DEVELOPER REFERENCE
================================================================================