=== Reframe Import ===
Contributors: k0renreframe
Requires at least: 6.0
Requires PHP: 7.4
Tested up to: 7.1
Stable tag: 2.8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Companion for the ReFrame service: receives Figma-to-Elementor and standalone pages from your ReFrame account and stores them safely.

== Description ==
Companion plugin for the Reframe service. Receives a layout blueprint over a REST
endpoint and builds a native Elementor page (flexbox containers, absolute
positioning via injected CSS in Free mode, uploaded PNG media), and receives
standalone pages published from your ReFrame account at https://app.re-frame.co.il.

== Installation ==
1. Upload the plugin zip via Plugins → Add New → Upload Plugin, then Activate.
   (Elementor must also be installed and active for Elementor imports.)
2. Go to Settings → Reframe Import.
3. Copy the "WordPress URL" and "API Key" into the Reframe Export Figma plugin,
   or connect this site from your ReFrame account at https://app.re-frame.co.il.
4. In Figma, select a frame and Transmit — or publish from the ReFrame editor.

== Editing with ReFrame ==
There is no page editor inside wp-admin. Editing happens in the hosted ReFrame
editor at https://app.re-frame.co.il. After you connect this site to your ReFrame
account, publishing in the ReFrame editor pushes the finished page to this site
server-to-server; the plugin sanitizes it and stores it as a normal WordPress
page. The wp-admin "Reframe" screen lists those pages and links you to the
hosted editor ("Edit with ReFrame").

Please note: connecting a WordPress site and publishing to it from the ReFrame
editor requires a PAID ReFrame plan. The plugin itself is free; the hosted
ReFrame editing and publishing service is a paid subscription.

== Security ==
The REST endpoints under /wp-json/reframe/v1/ are authenticated. A request must
either come from a logged-in user who can edit pages, or carry the site's API
key in the X-Reframe-Key header. Regenerate the key anytime from the settings
page; the Figma plugin must then be updated with the new key.
The connect handshake endpoint (/wp-json/reframe/v1/connect-info) is stricter:
it requires an administrator login (an Application Password created via the
standard WordPress authorization screen works), because its response includes
the site's Reframe API key.
Every page received from ReFrame is fully sanitized before it is stored: script
tags, inline event handlers, javascript: URLs and executable embeds are removed.
The plugin never loads executable code from a remote server.

== Privacy / data collection ==
All reporting described in this section is on by default and can be turned off
at any time under Settings → Reframe Import → "Diagnostics & privacy" — one
switch controls both the usage reports and the diagnostic error reports.

After a page is built, the plugin sends a small, non-blocking usage report to
Reframe's backend at https://api.re-frame.co.il. The report contains: your
Reframe invite code, this site's home URL, the built page's view URL and edit
URL, the page title, and counts (number of elements, images, and fonts). It does
NOT contain the page content, your API key, or any site-visitor data. The
destination is hardcoded to Reframe's backend — it can never be redirected
elsewhere by the request. Turning off "Share diagnostics & usage data" on the
settings page stops these reports.

AI Refine helper (optional, opt-in per use): when you open a Reframe-imported page
in the Elementor editor, a "Reframe AI" panel lets you describe a tweak in plain
language. ONLY when you click Send, the plugin sends that page's current Elementor
content and — if available — a screenshot of the editor canvas to Reframe's backend
at https://api.re-frame.co.il, which returns the change and the plugin applies it.
Nothing is sent unless you use the helper. The screenshot is captured in your
browser and only if a capture library (html2canvas) is already available on the
site — the plugin does not load any code from a CDN or other remote server; without
it the request proceeds as text only. The destination is hardcoded to Reframe's
backend and can never be redirected by the request.

Diagnostic error reporting (v2.4.0, on by default, can be turned off): if a page
fails to save or publish (a server error / white screen), the plugin catches the
error and sends a diagnostic report to https://api.re-frame.co.il so support can
help. The report contains: the error message, the affected post ID, this site's
home URL, and the plugin / WordPress / PHP / Elementor version numbers. It also
records which Reframe REST requests this site makes (route, status, timing). It
does NOT contain page content, images, or your API key. You can turn this off any
time under Settings → Reframe Import → "Diagnostics & privacy" (the same switch
that controls usage reports). The destination is hardcoded to Reframe's backend
and can never be redirected by the request.

Privacy policy: https://re-frame.co.il/tos/#privacy

== Notes ==
- Only valid PNG images under 8 MB are accepted as uploaded assets.
- "Free" mode injects positioning CSS so layouts render without Elementor Pro.
- "Pro" mode relies on Elementor Pro's native absolute positioning.

== Updates ==
Installed from WordPress.org, the plugin updates through WordPress.org like any
other plugin. Self-distributed builds obtained directly from Reframe instead
update from the Reframe servers: new versions appear on the Plugins page with a
one-click "Update now" button (and "Enable auto-updates" works as usual).

== Changelog ==
= 2.8.1 =
* WordPress Menu element. Sites connected to WordPress get a new "WordPress Menu" element in the ReFrame editor: pick one of your WordPress nav menus and it publishes as a live menu — the page renders it with wp_nav_menu() at load time, so it stays in sync when you edit the menu in WordPress. Adds a read-only endpoint (/wp-json/reframe/v1/menus, same API-key gate as the other endpoints) that lists your menus for the editor's picker.
* No behavior change to existing pages: the live menu resolves only for the new element and falls back to the last-saved snapshot if the menu is missing.

= 2.8.0 =
* Editing moves fully to the hosted ReFrame editor at https://app.re-frame.co.il. The wp-admin editor (Reframe Builder) is removed; the plugin is now a thin receiver — it authenticates, sanitizes, stores and renders pages that your ReFrame account pushes to this site, and the wp-admin "Reframe" screen (plus an "Edit with ReFrame" row action on the Pages list) deep-links to the hosted editor. Publishing to WordPress from the ReFrame editor requires a paid ReFrame plan.
* New connect handshake endpoint (/wp-json/reframe/v1/connect-info, administrator-only via WordPress Application Passwords) so your ReFrame account can connect this site without copying the API key by hand.
* Pushed pages now record which ReFrame site they belong to, so "Edit with ReFrame" opens the right project.
* No remotely-loaded code: the remote editor bundle is gone, and the AI Refine panel no longer fetches its screenshot library from a CDN (it uses html2canvas only if the site already provides it; otherwise requests are text-only). Every script and style the plugin runs ships inside the plugin zip.
* All existing hardening kept: full HTML sanitization on every received page, GD re-encode of imported media, magic-byte font validation, size/count/depth DoS caps, widget-type allow-list, CSS/SVG sanitization, hash_equals API-key comparison.

= 2.6.1 =
* The Reframe Builder editor is all new. A faster, Figma-like visual editor (select, drag, resize and edit text directly on the canvas, with hover states and per-device tablet/mobile styling) replaces the previous editor under wp-admin → Reframe Builder. Your pages, saving and publishing work exactly as before — the editor bundle is also about a third of its previous size, so it loads noticeably faster.

= 2.6.0 =
* New: Reframe Builder is built in. The Figma plugin's Reframe Site flow now has a "Publish to WordPress" option that creates a native, standalone WordPress page on your site (no Elementor needed), and you can fine-tune it visually in the new Reframe editor under wp-admin → Reframe Builder. You can also import any HTML file into the Builder and edit it there. Every page is sanitized on save and served 1:1; publishing from Figma uses the same site URL + API key you already set up.

= 2.5.2 =
* Section-bank previews now appear on sites that use ImageMagick instead of GD. Previously, on hosts without the PHP GD image library, a section's thumbnail (uploaded as a WebP) was silently dropped and the "Add ReFrame" picker showed "no preview" — even though the section itself imported and worked. Image handling now falls back to ImageMagick when GD is unavailable, so previews (and any large WebP photos) are stored correctly. The re-encode still strips appended data on every image, GD or ImageMagick.

= 2.5.1 =
* Custom fonts whose name contains a version or number (for example "Some Font 2.0") now load correctly on the published page. The dot in the name was being dropped when the font file was hosted, so the @font-face and the text didn't match and the page fell back to a default typeface.

= 2.5.0 =
* Forms export as native, editable Elementor form widgets. A form in your design (its fields, labels, placeholders and submit button) now comes through as a real form instead of a flat image. On sites without Elementor Pro it renders as a styled visual placeholder you can point at any form plugin. For security, submit actions, emails, webhooks and redirects are never imported — you wire those up yourself in the editor.
* Image sliders export as native image carousels. A row of same-size card images (with arrows or dots) becomes a real Elementor carousel you can add slides to, instead of loose gallery images. Slide URLs are validated on import and non-secure ones are dropped.
* More precise right-to-left handling: the layout fixes are now scoped to the imported page only, so an RTL site's own theme header, footer and menu are no longer nudged left-to-right.
* Per-element styling is carried in Elementor's own Custom CSS panel so it stays visible and editable next to each element; on sites without Elementor Pro the plugin compiles that styling for you at page load.

= 2.4.0 =
* Clearer errors when a page won't publish. If saving/publishing a page fails with a server error, the plugin now catches it, shows you a plain-language notice with a reference code to quote to support, and reports the technical details to Reframe so we can diagnose it quickly (for example, a page that grew too large for the server's memory). No page content is sent. You can turn diagnostic reporting off under Settings → Reframe Import → "Diagnostics & privacy". See Privacy / data collection.

= 2.3.0 =
* Chunked section upload: a large section (big images or a heavy preview) is now uploaded in small batches instead of one big POST, so it fits under any host's request-size limit (a ~1MB cap is a common server default and used to fail the upload with "Failed to fetch"). Uses the same hardened ingest as page imports; older Figma plugin builds keep working unchanged.

= 2.2.0 =
* Section inserts no longer fail silently. If Elementor's Flexbox Container feature is off (the #1 cause of "I picked a section and nothing appeared"), the section picker now says so up front — and admins get a one-click "Enable it now" button. Insert errors, missing styling, and empty sections all show clear messages with the exact fix.
* Sections whose content would be rejected by an outdated plugin version are refused at save time (with an update prompt) instead of being stored as empty husks that list fine but insert nothing.
* The connection check now reports container support, so the Figma plugin and support can diagnose insert problems without editor access.

= 2.1.0 =
* Live section preview: the Figma plugin can render a saved section exactly as your site outputs it (real Elementor markup, CSS, fonts) through a read-only, token-gated route, and manage the section library remotely.
* Imported containers no longer inherit Elementor's default 10px container padding.

= 2.0.0 =
* Reframe 2.0 — companion release to the 2.0 Figma plugin's credit-based, container-nesting exports.
* Containers grouped into a parent in Figma now import as real nested Elementor flexbox containers instead of a flattened block, with each child kept editable.
* All existing hardening kept: GD re-encode of imported media, magic-byte font validation, size/count/depth DoS caps, widget-type allow-list, and CSS/SVG sanitization on the direct _elementor_data write.
* One-click update from WordPress (Plugins → Update).

= 1.21.0 =
* Responsive engine overhaul (Dynamic mode): pages now export as fluid, height-free sections with %-based rhythm — text scales with the viewport (vw) and gets proper per-role mobile sizes, columns stack natively on phones, and media drops below text when rows stack. No more frozen desktop widths or unreadable mobile text.
* Buttons: marked buttons export as real, clickable Elementor buttons with the designer's link (new link field in the Figma plugin), correct pill artwork at every screen size, and accessible labels. Fixed buttons disappearing or rendering as an empty grey box.
* Containers: photo groups marked as containers export as a proper container-with-image cell that keeps its aspect ratio at every width.
* Import pipeline: Elementor's page CSS and element cache are regenerated on every import, so native settings (responsive typography, alignment, strokes) always render — including in the editor.
* New native widgets accepted (with strict sanitization): video, nested accordion, nested carousel, menu anchor — groundwork for upcoming semantic exports.
* Security hardening: container background image URLs are now validated like all other media URLs.

= 1.20.8 =
* Fixes RTL (Hebrew/Arabic) Elementor sites: imported pages no longer render mirrored or with
  padding on the wrong side. Elementor's RTL stylesheet swaps each container's inline
  padding/margin to the opposite physical side; Reframe now pins them physically (and resets
  the swapped inline-* custom properties) so the layout matches the design. Applied live in
  wp_head, so already-imported pages are corrected with no re-import.

= 1.20.7 =
* AI Refine ships as a "coming soon" preview: the "Reframe AI" panel is visible in the editor
  so you can see what's coming, but it is not yet usable. (Site operators can enable it early
  with the reframe_refine_coming_soon filter.)

= 1.20.6 =
* AI Refine is much faster: the editor screenshot now captures only your selected region
  (not the whole page), and the backend only sends the selected elements in detail. Reliable
  Apply (staged in post meta; clears the Elementor autosave so the change always shows). The
  assistant now respects multi-select intent — an element referenced as an example ("like the
  second one") is used as a reference and left unchanged.

= 1.20.0 =
* Adds the in-editor "Reframe AI" refine helper: on a Reframe-imported page, describe a
  fix in plain language and the change is applied for you. All AI logic runs on Reframe's
  backend; the plugin only forwards your request (opt-in per use) and re-sanitizes the
  result before writing it. Includes one-click Undo. See Privacy / data collection.

= 1.18.0 =
* Renders the new Reframe Decoration widget — a frozen, pixel-perfect graphic (inline SVG /
  raster) that reads as "Reframe Decoration" in the Elementor navigator instead of a bare
  container. For hard, non-responsive art the layout engine can't reconstruct.

= 1.17.0 =
* Robust import: an unsafe layout-CSS rule is now dropped (and reported via dropped_css_rules)
  instead of rejecting the whole page, so one bad element no longer blocks the entire import.
  Genuinely hostile/oversized payloads are still rejected.

= 1.16.0 =
* Renders graphic Reframe Buttons of any form (circular badges, curved text-on-path,
  blur/translucent, layered art) as image-backed buttons with an accessible aria label.

= 1.14.0 =
* Adds a connection-check endpoint (/wp-json/reframe/v1/import/ping) used by the
  Figma plugin's new "Connect" button to verify the site URL + API key.
* One-click / automatic updates from the Reframe servers via the WordPress updater.

= 1.13.0 =
* Accepts WebP images (GD re-encoded, JPEG fallback) alongside Google Fonts CDN loading.
