nibula 1.1.2 → 1.2.0

package/src/frontend/.htaccess

@@ -1,51 +1,51 @@
-Options -Indexes
-ErrorDocument 404 /404.html
-ErrorDocument 403 /404.html
-
-<IfModule mod_rewrite.c>
-    RewriteEngine On
-    RewriteBase /
-
-    # Block sensitive files (web.config, dotfiles)
-    RewriteRule ^(web\.config|\..*)$ /404.html [L,NC]
-</IfModule>
-
-# === /api routing — covers BOTH backends ====================================
-#
-# Apache (unlike nginx) cannot health-check an upstream, so it cannot auto-fall
-# back from Node to PHP. The behaviour is:
-#
-#   - mod_proxy available  -> /api is proxied to the Node backend (127.0.0.1:3000)
-#   - mod_proxy NOT present -> /api is rewritten to the PHP front controller
-#
-# Typical shared hosting (Aruba, cPanel) has no mod_proxy, so it uses PHP
-# automatically. On a VPS running Node, mod_proxy sends /api to Node.
-#
-# If you are on a server that HAS mod_proxy but you want to use PHP, comment out
-# the mod_proxy block below.
-
-# --- Node backend (if mod_proxy is available) ---
-<IfModule mod_proxy.c>
-    ProxyPreserveHost On
-    ProxyPass        /api/ http://127.0.0.1:3000/api/ retry=0
-    ProxyPassReverse /api/ http://127.0.0.1:3000/api/
-
-    <IfModule mod_headers.c>
-        RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
-        RequestHeader set X-Forwarded-Proto "https"
-    </IfModule>
-</IfModule>
-
-# --- PHP backend (fallback when mod_proxy is absent) ---
-<IfModule mod_rewrite.c>
-    RewriteEngine On
-    RewriteBase /
-    RewriteRule ^api/(.*)$ backend/_core/index.php [QSA,L]
-</IfModule>
-
-# === Static files ===========================================================
-<IfModule mod_rewrite.c>
-    RewriteCond %{REQUEST_FILENAME} -f [OR]
-    RewriteCond %{REQUEST_FILENAME} -d
-    RewriteRule ^ - [L]
-</IfModule>
+Options -Indexes
+ErrorDocument 404 /404.html
+ErrorDocument 403 /404.html
+
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteBase /
+
+    # Block sensitive files (web.config, dotfiles)
+    RewriteRule ^(web\.config|\..*)$ /404.html [L,NC]
+</IfModule>
+
+# === /api routing — covers BOTH backends ====================================
+#
+# Apache (unlike nginx) cannot health-check an upstream, so it cannot auto-fall
+# back from Node to PHP. The behaviour is:
+#
+#   - mod_proxy available  -> /api is proxied to the Node backend (127.0.0.1:3000)
+#   - mod_proxy NOT present -> /api is rewritten to the PHP front controller
+#
+# Typical shared hosting (Aruba, cPanel) has no mod_proxy, so it uses PHP
+# automatically. On a VPS running Node, mod_proxy sends /api to Node.
+#
+# If you are on a server that HAS mod_proxy but you want to use PHP, comment out
+# the mod_proxy block below.
+
+# --- Node backend (if mod_proxy is available) ---
+<IfModule mod_proxy.c>
+    ProxyPreserveHost On
+    ProxyPass        /api/ http://127.0.0.1:3000/api/ retry=0
+    ProxyPassReverse /api/ http://127.0.0.1:3000/api/
+
+    <IfModule mod_headers.c>
+        RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
+        RequestHeader set X-Forwarded-Proto "https"
+    </IfModule>
+</IfModule>
+
+# --- PHP backend (fallback when mod_proxy is absent) ---
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteBase /
+    RewriteRule ^api/(.*)$ backend/_core/index.php [QSA,L]
+</IfModule>
+
+# === Static files ===========================================================
+<IfModule mod_rewrite.c>
+    RewriteCond %{REQUEST_FILENAME} -f [OR]
+    RewriteCond %{REQUEST_FILENAME} -d
+    RewriteRule ^ - [L]
+</IfModule>

package/src/frontend/assets/brand/favicon.svg

@@ -1,54 +1,54 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="Nibula">
-  <defs>
-    <linearGradient id="nibulaShieldBorder" x1="0" y1="0" x2="1" y2="1">
-      <stop offset="0" stop-color="#8b6fc4"/>
-      <stop offset="0.5" stop-color="#c9a06a"/>
-      <stop offset="1" stop-color="#f2c17a"/>
-    </linearGradient>
-    <linearGradient id="nibulaN" x1="0" y1="1" x2="1" y2="0">
-      <stop offset="0" stop-color="#6d4fa8"/>
-      <stop offset="0.45" stop-color="#a978b0"/>
-      <stop offset="0.75" stop-color="#e7a55f"/>
-      <stop offset="1" stop-color="#f7d08a"/>
-    </linearGradient>
-    <linearGradient id="nibulaNib" x1="0" y1="0" x2="1" y2="1">
-      <stop offset="0" stop-color="#f7d89a"/>
-      <stop offset="0.55" stop-color="#e0a95f"/>
-      <stop offset="1" stop-color="#b07d3e"/>
-    </linearGradient>
-    <linearGradient id="nibulaField" x1="0" y1="0" x2="0.6" y2="1">
-      <stop offset="0" stop-color="#3a2c63"/>
-      <stop offset="1" stop-color="#2a2150"/>
-    </linearGradient>
-  </defs>
-
-  <path fill="none" stroke="url(#nibulaShieldBorder)" stroke-width="10" stroke-linejoin="round"
-        d="M256 40 L440 132 L440 320 L256 472 L72 320 L72 132 Z"/>
-  <path fill="url(#nibulaField)" stroke="url(#nibulaShieldBorder)" stroke-width="6" stroke-linejoin="round"
-        d="M256 66 L418 147 L418 310 L256 442 L94 310 L94 147 Z"/>
-
-  <!-- N as one closed outline: up left post, down inner-left, diagonal to inner-bottom-right,
-       up right post, cut corner, down outer-right, close along the bottom -->
-  <path fill="url(#nibulaN)" stroke="#1a1533" stroke-width="7" stroke-linejoin="round"
-        d="M148 362
-           L148 150
-           L206 150
-           L312 300
-           L312 150
-           L370 150
-           L370 205
-           L340 205
-           L340 362
-           L282 362
-           L206 255
-           L206 362
-           Z"/>
-
-  <g stroke="#1a1533" stroke-width="7" stroke-linejoin="round" stroke-linecap="round">
-    <path fill="url(#nibulaNib)" d="M326 300 L382 300 L392 326 L336 326 Z"/>
-    <path fill="none" stroke-width="5" d="M338 313 L386 313"/>
-    <path fill="url(#nibulaNib)" d="M336 326 L392 326 L428 414 L370 380 Z"/>
-    <path fill="none" stroke-width="5" d="M366 342 L402 384"/>
-    <circle cx="376" cy="360" r="6.5" fill="#1a1533" stroke="none"/>
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="Nibula">
+  <defs>
+    <linearGradient id="nibulaShieldBorder" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#8b6fc4"/>
+      <stop offset="0.5" stop-color="#c9a06a"/>
+      <stop offset="1" stop-color="#f2c17a"/>
+    </linearGradient>
+    <linearGradient id="nibulaN" x1="0" y1="1" x2="1" y2="0">
+      <stop offset="0" stop-color="#6d4fa8"/>
+      <stop offset="0.45" stop-color="#a978b0"/>
+      <stop offset="0.75" stop-color="#e7a55f"/>
+      <stop offset="1" stop-color="#f7d08a"/>
+    </linearGradient>
+    <linearGradient id="nibulaNib" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#f7d89a"/>
+      <stop offset="0.55" stop-color="#e0a95f"/>
+      <stop offset="1" stop-color="#b07d3e"/>
+    </linearGradient>
+    <linearGradient id="nibulaField" x1="0" y1="0" x2="0.6" y2="1">
+      <stop offset="0" stop-color="#3a2c63"/>
+      <stop offset="1" stop-color="#2a2150"/>
+    </linearGradient>
+  </defs>
+
+  <path fill="none" stroke="url(#nibulaShieldBorder)" stroke-width="10" stroke-linejoin="round"
+        d="M256 40 L440 132 L440 320 L256 472 L72 320 L72 132 Z"/>
+  <path fill="url(#nibulaField)" stroke="url(#nibulaShieldBorder)" stroke-width="6" stroke-linejoin="round"
+        d="M256 66 L418 147 L418 310 L256 442 L94 310 L94 147 Z"/>
+
+  <!-- N as one closed outline: up left post, down inner-left, diagonal to inner-bottom-right,
+       up right post, cut corner, down outer-right, close along the bottom -->
+  <path fill="url(#nibulaN)" stroke="#1a1533" stroke-width="7" stroke-linejoin="round"
+        d="M148 362
+           L148 150
+           L206 150
+           L312 300
+           L312 150
+           L370 150
+           L370 205
+           L340 205
+           L340 362
+           L282 362
+           L206 255
+           L206 362
+           Z"/>
+
+  <g stroke="#1a1533" stroke-width="7" stroke-linejoin="round" stroke-linecap="round">
+    <path fill="url(#nibulaNib)" d="M326 300 L382 300 L392 326 L336 326 Z"/>
+    <path fill="none" stroke-width="5" d="M338 313 L386 313"/>
+    <path fill="url(#nibulaNib)" d="M336 326 L392 326 L428 414 L370 380 Z"/>
+    <path fill="none" stroke-width="5" d="M366 342 L402 384"/>
+    <circle cx="376" cy="360" r="6.5" fill="#1a1533" stroke="none"/>
+  </g>
+</svg>

package/src/frontend/assets/brand/logo.svg

@@ -1,54 +1,54 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="Nibula">
-  <defs>
-    <linearGradient id="nibulaShieldBorder" x1="0" y1="0" x2="1" y2="1">
-      <stop offset="0" stop-color="#8b6fc4"/>
-      <stop offset="0.5" stop-color="#c9a06a"/>
-      <stop offset="1" stop-color="#f2c17a"/>
-    </linearGradient>
-    <linearGradient id="nibulaN" x1="0" y1="1" x2="1" y2="0">
-      <stop offset="0" stop-color="#6d4fa8"/>
-      <stop offset="0.45" stop-color="#a978b0"/>
-      <stop offset="0.75" stop-color="#e7a55f"/>
-      <stop offset="1" stop-color="#f7d08a"/>
-    </linearGradient>
-    <linearGradient id="nibulaNib" x1="0" y1="0" x2="1" y2="1">
-      <stop offset="0" stop-color="#f7d89a"/>
-      <stop offset="0.55" stop-color="#e0a95f"/>
-      <stop offset="1" stop-color="#b07d3e"/>
-    </linearGradient>
-    <linearGradient id="nibulaField" x1="0" y1="0" x2="0.6" y2="1">
-      <stop offset="0" stop-color="#3a2c63"/>
-      <stop offset="1" stop-color="#2a2150"/>
-    </linearGradient>
-  </defs>
-
-  <path fill="none" stroke="url(#nibulaShieldBorder)" stroke-width="10" stroke-linejoin="round"
-        d="M256 40 L440 132 L440 320 L256 472 L72 320 L72 132 Z"/>
-  <path fill="url(#nibulaField)" stroke="url(#nibulaShieldBorder)" stroke-width="6" stroke-linejoin="round"
-        d="M256 66 L418 147 L418 310 L256 442 L94 310 L94 147 Z"/>
-
-  <!-- N as one closed outline: up left post, down inner-left, diagonal to inner-bottom-right,
-       up right post, cut corner, down outer-right, close along the bottom -->
-  <path fill="url(#nibulaN)" stroke="#1a1533" stroke-width="7" stroke-linejoin="round"
-        d="M148 362
-           L148 150
-           L206 150
-           L312 300
-           L312 150
-           L370 150
-           L370 205
-           L340 205
-           L340 362
-           L282 362
-           L206 255
-           L206 362
-           Z"/>
-
-  <g stroke="#1a1533" stroke-width="7" stroke-linejoin="round" stroke-linecap="round">
-    <path fill="url(#nibulaNib)" d="M326 300 L382 300 L392 326 L336 326 Z"/>
-    <path fill="none" stroke-width="5" d="M338 313 L386 313"/>
-    <path fill="url(#nibulaNib)" d="M336 326 L392 326 L428 414 L370 380 Z"/>
-    <path fill="none" stroke-width="5" d="M366 342 L402 384"/>
-    <circle cx="376" cy="360" r="6.5" fill="#1a1533" stroke="none"/>
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-label="Nibula">
+  <defs>
+    <linearGradient id="nibulaShieldBorder" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#8b6fc4"/>
+      <stop offset="0.5" stop-color="#c9a06a"/>
+      <stop offset="1" stop-color="#f2c17a"/>
+    </linearGradient>
+    <linearGradient id="nibulaN" x1="0" y1="1" x2="1" y2="0">
+      <stop offset="0" stop-color="#6d4fa8"/>
+      <stop offset="0.45" stop-color="#a978b0"/>
+      <stop offset="0.75" stop-color="#e7a55f"/>
+      <stop offset="1" stop-color="#f7d08a"/>
+    </linearGradient>
+    <linearGradient id="nibulaNib" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#f7d89a"/>
+      <stop offset="0.55" stop-color="#e0a95f"/>
+      <stop offset="1" stop-color="#b07d3e"/>
+    </linearGradient>
+    <linearGradient id="nibulaField" x1="0" y1="0" x2="0.6" y2="1">
+      <stop offset="0" stop-color="#3a2c63"/>
+      <stop offset="1" stop-color="#2a2150"/>
+    </linearGradient>
+  </defs>
+
+  <path fill="none" stroke="url(#nibulaShieldBorder)" stroke-width="10" stroke-linejoin="round"
+        d="M256 40 L440 132 L440 320 L256 472 L72 320 L72 132 Z"/>
+  <path fill="url(#nibulaField)" stroke="url(#nibulaShieldBorder)" stroke-width="6" stroke-linejoin="round"
+        d="M256 66 L418 147 L418 310 L256 442 L94 310 L94 147 Z"/>
+
+  <!-- N as one closed outline: up left post, down inner-left, diagonal to inner-bottom-right,
+       up right post, cut corner, down outer-right, close along the bottom -->
+  <path fill="url(#nibulaN)" stroke="#1a1533" stroke-width="7" stroke-linejoin="round"
+        d="M148 362
+           L148 150
+           L206 150
+           L312 300
+           L312 150
+           L370 150
+           L370 205
+           L340 205
+           L340 362
+           L282 362
+           L206 255
+           L206 362
+           Z"/>
+
+  <g stroke="#1a1533" stroke-width="7" stroke-linejoin="round" stroke-linecap="round">
+    <path fill="url(#nibulaNib)" d="M326 300 L382 300 L392 326 L336 326 Z"/>
+    <path fill="none" stroke-width="5" d="M338 313 L386 313"/>
+    <path fill="url(#nibulaNib)" d="M336 326 L392 326 L428 414 L370 380 Z"/>
+    <path fill="none" stroke-width="5" d="M366 342 L402 384"/>
+    <circle cx="376" cy="360" r="6.5" fill="#1a1533" stroke="none"/>
+  </g>
+</svg>

package/src/frontend/components/global/header.njk

@@ -1,7 +1,7 @@
 <header>
   <nav>
       <a class="logo" href="/">
-        <img src="{{ site.logo }}" alt="{{ site.title }}" height="40">
+        <img src="../../assets/brand/logo.svg" alt="{{ site.title }}" height="40">
       </a>
   </nav>
 </header>

package/src/frontend/components/welcome.njk

@@ -31,7 +31,6 @@
         </a>
       </div>
     </div>
-
 <style>
   .layout-container {
     width: 100%;

package/src/frontend/data/site.json

@@ -1,54 +1,48 @@
-{
-  "site_name": "Site name",
-  "title": "Site title",
-  "description": "Site description",
-  "keywords": "keyword1, keyword2, keyword3",
-  "domain": "yoursite.com",
-  "url": "https://yoursite.com",
-  "lang": "en",
-  "author": "Name and surname",
-  "data_bs_theme": "dark",
-  "theme_color": {
-    "light": "#ffffff",
-    "dark": "#0d1117"
-  },
-  "favicon": "/assets/brand/favicon.svg",
-  "logo": "/assets/brand/logo.svg",
-  "legal": {
-    "privacy": "",
-    "cookie": "",
-    "cookieControls": "",
-    "terms": "",
-    "copyright": {
-      "year": "2026",
-      "text": "All rights reserved."
-    }
-  },
-  "pages": {
-    "404": {
-      "seo": {
-        "title": "404 - Not found",
-        "keywords": "",
-        "noindex": true,
-        "canonical": ""
-      },
-      "cdn": {
-        "css": [],
-        "js": []
-      }
-    },
-    "homepage": {
-      "seo": {
-        "title": "Homepage",
-        "description": "Description",
-        "keywords": "",
-        "noindex": false,
-        "canonical": ""
-      },
-      "cdn": {
-        "css": [],
-        "js": []
-      }
-    }
-  }
-}
+{
+  "site_name": "Site name",
+  "title": "Site title",
+  "description": "Site description",
+  "keywords": "keyword1, keyword2, keyword3",
+  "domain": "yoursite.com",
+  "url": "https://yoursite.com",
+  "lang": "en",
+  "author": "Name and surname",
+  "theme": "dark",
+  "legal": {
+    "privacy": "",
+    "cookie": "",
+    "cookieControls": "",
+    "terms": "",
+    "copyright": {
+      "year": "2026",
+      "text": "All rights reserved."
+    }
+  },
+  "pages": {
+    "404": {
+      "seo": {
+        "title": "404 - Not found",
+        "keywords": "",
+        "noindex": true,
+        "canonical": ""
+      },
+      "cdn": {
+        "css": [],
+        "js": []
+      }
+    },
+    "homepage": {
+      "seo": {
+        "title": "Homepage",
+        "description": "Description",
+        "keywords": "",
+        "noindex": false,
+        "canonical": ""
+      },
+      "cdn": {
+        "css": [],
+        "js": []
+      }
+    }
+  }
+}

package/src/frontend/layouts/base.njk

@@ -1,11 +1,12 @@
 <!-- This is the base of every page that you will create -->
 
 <!DOCTYPE html>
-<html lang="{{ site.lang or 'en' }}" data-bs-theme="{{ site.data_bs_theme or 'light' }}">
+<html lang="{{ site.lang or 'en' }}" data-bs-theme="{{ site.theme or 'light' }}">
 
     <head>
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <meta name="color-scheme" content="{{ site.theme or 'light' }}">
 
         {# Preconnect hints — establish early connections to external origins #}
         <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>
@@ -26,8 +27,7 @@
         <meta name="description" content="{{ pageData.seo.description or site.description }}">
         <meta name="keywords" content="{{ pageData.seo.keywords or site.keywords }}">
         <meta name="author" content="{{ site.author }}">
-        <meta name="theme-color" content="{{ site.theme_color.light }}" media="(prefers-color-scheme: light)">
-        <meta name="theme-color" content="{{ site.theme_color.dark }}" media="(prefers-color-scheme: dark)">
+        <meta name="theme-color" content="{{ site.theme_color }}">
 
         {% if pageData.seo.noindex %}
         <meta name="robots" content="noindex, follow">
@@ -77,23 +77,14 @@
         ║     FAVICON      ║
         ╚══════════════════╝#}
 
-        <link rel="icon" type="image/svg+xml" href="{{ site.favicon }}">
-        {#
-        <link rel="icon" type="image/png" href="/assets/favicon.png">
-        <link rel="apple-touch-icon" href="/assets/favicon.png">
-        #}
+        <link rel="icon" type="image/svg+xml" href="/assets/brand/favicon.svg">
+        <link rel="icon" type="image/png" sizes="32x32" href="/assets/brand/favicon-32.png">
+        <link rel="apple-touch-icon" sizes="180x180" href="/assets/brand/apple-touch-icon.png">
 
       {#╔══════════════════╗
         ║       CSS        ║
         ╚══════════════════╝#}
 
-        {# Markdown — theme-aware #}
-        {% if site.data_bs_theme == "dark" %}
-        <link rel="stylesheet" href="/css/github-markdown-dark.css">
-        {% else %}
-        <link rel="stylesheet" href="/css/github-markdown-light.css">
-        {% endif %}
-
         {# Page CSS #}
         <link rel="stylesheet" href="/css/pages/{{ title }}.css"/>
 

package/src/frontend/scss/modules/_global.scss

@@ -41,4 +41,8 @@ body {
 
 main {
     flex: 1;
+}
+
+a {
+    text-decoration: none !important;
 }

package/src/frontend/web.config

@@ -1,55 +1,55 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  IIS config for a Nibula site — covers BOTH backends.
-
-  IIS (like Apache, unlike nginx) cannot health-check an upstream, so it cannot
-  auto-fall back from Node to PHP. URL Rewrite processes rules top-down and the
-  first match with stopProcessing="true" wins:
-
-    - "ApiToNode" wins if present -> /api is reverse-proxied to the Node backend
-      (requires the Application Request Routing + URL Rewrite modules, with proxy
-      enabled: ARR > Server Proxy Settings > Enable proxy).
-    - To use the PHP backend instead, remove or comment the "ApiToNode" rule;
-      "ApiToPhp" then rewrites /api to the PHP front controller.
-
-  On Windows shared hosting without ARR, keep only "ApiToPhp".
--->
-<configuration>
-    <system.webServer>
-        <rewrite>
-            <rules>
-
-                <!-- Block sensitive files -->
-                <rule name="BlockSensitive" stopProcessing="true">
-                    <match url="^(web\.config|\..*)$" ignoreCase="true" />
-                    <action type="CustomResponse" statusCode="404" />
-                </rule>
-
-                <!-- Node backend (requires ARR). Remove this rule to use PHP. -->
-                <rule name="ApiToNode" stopProcessing="true">
-                    <match url="^api/(.*)" ignoreCase="true" />
-                    <action type="Rewrite" url="http://127.0.0.1:3000/api/{R:1}" appendQueryString="true" />
-                    <serverVariables>
-                        <set name="HTTP_X_FORWARDED_PROTO" value="https" />
-                    </serverVariables>
-                </rule>
-
-                <!-- PHP backend fallback: rewrite /api to the PHP front controller. -->
-                <rule name="ApiToPhp" stopProcessing="true">
-                    <match url="^api/(.*)" ignoreCase="true" />
-                    <action type="Rewrite" url="backend/_core/index.php" appendQueryString="true" />
-                </rule>
-
-            </rules>
-        </rewrite>
-
-        <directoryBrowse enabled="false" />
-
-        <httpErrors errorMode="Custom" existingResponse="Replace">
-            <remove statusCode="404" />
-            <remove statusCode="403" />
-            <error statusCode="404" path="/404.html" responseMode="ExecuteURL" />
-            <error statusCode="403" path="/404.html" responseMode="ExecuteURL" />
-        </httpErrors>
-    </system.webServer>
-</configuration>
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  IIS config for a Nibula site — covers BOTH backends.
+
+  IIS (like Apache, unlike nginx) cannot health-check an upstream, so it cannot
+  auto-fall back from Node to PHP. URL Rewrite processes rules top-down and the
+  first match with stopProcessing="true" wins:
+
+    - "ApiToNode" wins if present -> /api is reverse-proxied to the Node backend
+      (requires the Application Request Routing + URL Rewrite modules, with proxy
+      enabled: ARR > Server Proxy Settings > Enable proxy).
+    - To use the PHP backend instead, remove or comment the "ApiToNode" rule;
+      "ApiToPhp" then rewrites /api to the PHP front controller.
+
+  On Windows shared hosting without ARR, keep only "ApiToPhp".
+-->
+<configuration>
+    <system.webServer>
+        <rewrite>
+            <rules>
+
+                <!-- Block sensitive files -->
+                <rule name="BlockSensitive" stopProcessing="true">
+                    <match url="^(web\.config|\..*)$" ignoreCase="true" />
+                    <action type="CustomResponse" statusCode="404" />
+                </rule>
+
+                <!-- Node backend (requires ARR). Remove this rule to use PHP. -->
+                <rule name="ApiToNode" stopProcessing="true">
+                    <match url="^api/(.*)" ignoreCase="true" />
+                    <action type="Rewrite" url="http://127.0.0.1:3000/api/{R:1}" appendQueryString="true" />
+                    <serverVariables>
+                        <set name="HTTP_X_FORWARDED_PROTO" value="https" />
+                    </serverVariables>
+                </rule>
+
+                <!-- PHP backend fallback: rewrite /api to the PHP front controller. -->
+                <rule name="ApiToPhp" stopProcessing="true">
+                    <match url="^api/(.*)" ignoreCase="true" />
+                    <action type="Rewrite" url="backend/_core/index.php" appendQueryString="true" />
+                </rule>
+
+            </rules>
+        </rewrite>
+
+        <directoryBrowse enabled="false" />
+
+        <httpErrors errorMode="Custom" existingResponse="Replace">
+            <remove statusCode="404" />
+            <remove statusCode="403" />
+            <error statusCode="404" path="/404.html" responseMode="ExecuteURL" />
+            <error statusCode="403" path="/404.html" responseMode="ExecuteURL" />
+        </httpErrors>
+    </system.webServer>
+</configuration>