nibula 1.2.4 → 1.2.5

package/.eleventy.js

@@ -1,82 +1,82 @@
-const esbuild = require("esbuild");
-const glob = require("glob");
-const Image = require("@11ty/eleventy-img");
-const fs = require("fs");
-const path = require("path");
-
-const OUTPUT_DIR = "out";
-
-module.exports = function (eleventyConfig) {
-
-  function copyRecursiveSync(src, dest) {
-    if (!fs.existsSync(src)) return;
-    if (src.includes('.git')) return;
-    const stat = fs.statSync(src);
-    if (stat.isDirectory()) {
-      fs.mkdirSync(dest, { recursive: true });
-      for (const child of fs.readdirSync(src)) {
-        copyRecursiveSync(path.join(src, child), path.join(dest, child));
-      }
-    } else {
-      fs.mkdirSync(path.dirname(dest), { recursive: true });
-      fs.copyFileSync(src, dest);
-    }
-  }
-
-  eleventyConfig.on("eleventy.before", () => {
-    copyRecursiveSync("src/backend", `${OUTPUT_DIR}/backend`);
-  });
-
-  eleventyConfig.addPassthroughCopy("src/frontend/.htaccess");
-  eleventyConfig.addPassthroughCopy("src/frontend/web.config");
-  eleventyConfig.addPassthroughCopy("src/frontend/assets");
-  eleventyConfig.addPassthroughCopy("src/frontend/robots.txt");
-
-  eleventyConfig.addPassthroughCopy({
-    "node_modules/bootstrap/dist/js/bootstrap.bundle.min.js": "js/bootstrap.bundle.min.js",
-    "node_modules/bootstrap-icons/font/fonts": "css/fonts",
-
-    // Foundation
-    // "node_modules/foundation-sites/dist/js/foundation.min.js": "js/foundation.min.js",
-
-    // UIkit
-    // "node_modules/uikit/dist/js/uikit.min.js": "js/uikit.min.js",
-    // "node_modules/uikit/dist/js/uikit-icons.min.js": "js/uikit-icons.min.js",
-
-    // Bulma — CSS only, no JS passthrough needed
-  });
-
-  eleventyConfig.addShortcode("image", async function (src, alt) {
-    let metadata = await Image(src, {
-      widths: [320, 480, 720, 1280, 1920, 2048, 2560, 3840, 4096, 7680],
-      formats: ["webp", "jpeg"],
-      outputDir: `${OUTPUT_DIR}/assets/images/`,
-      urlPath: "/assets/images/",
-    });
-
-    return Image.generateHTML(metadata, {
-      alt,
-      sizes: "(max-width: 768px) 100vw, 50vw",
-      loading: "lazy",
-      decoding: "async",
-    });
-  });
-
-  eleventyConfig.addWatchTarget("./src/frontend/scss");
-  eleventyConfig.addWatchTarget("./src/frontend/routes");
-  eleventyConfig.addWatchTarget("./src/frontend/data");
-
-  eleventyConfig.setServerOptions({
-  watch: [`${OUTPUT_DIR}/js/**/*.js`]
-  });
-
-  return {
-    dir: {
-      input: "src/frontend",
-      output: OUTPUT_DIR,
-      includes: "components",
-      layouts: "layouts",
-      data: "data",
-    },
-  };
+const esbuild = require("esbuild");
+const glob = require("glob");
+const Image = require("@11ty/eleventy-img");
+const fs = require("fs");
+const path = require("path");
+
+const OUTPUT_DIR = "out";
+
+module.exports = function (eleventyConfig) {
+
+  function copyRecursiveSync(src, dest) {
+    if (!fs.existsSync(src)) return;
+    if (src.includes('.git')) return;
+    const stat = fs.statSync(src);
+    if (stat.isDirectory()) {
+      fs.mkdirSync(dest, { recursive: true });
+      for (const child of fs.readdirSync(src)) {
+        copyRecursiveSync(path.join(src, child), path.join(dest, child));
+      }
+    } else {
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      fs.copyFileSync(src, dest);
+    }
+  }
+
+  eleventyConfig.on("eleventy.before", () => {
+    copyRecursiveSync("src/backend", `${OUTPUT_DIR}/backend`);
+  });
+
+  eleventyConfig.addPassthroughCopy("src/frontend/.htaccess");
+  eleventyConfig.addPassthroughCopy("src/frontend/web.config");
+  eleventyConfig.addPassthroughCopy("src/frontend/assets");
+  eleventyConfig.addPassthroughCopy("src/frontend/robots.txt");
+
+  eleventyConfig.addPassthroughCopy({
+    "node_modules/bootstrap/dist/js/bootstrap.bundle.min.js": "js/bootstrap.bundle.min.js",
+    "node_modules/bootstrap-icons/font/fonts": "css/fonts",
+
+    // Foundation
+    // "node_modules/foundation-sites/dist/js/foundation.min.js": "js/foundation.min.js",
+
+    // UIkit
+    // "node_modules/uikit/dist/js/uikit.min.js": "js/uikit.min.js",
+    // "node_modules/uikit/dist/js/uikit-icons.min.js": "js/uikit-icons.min.js",
+
+    // Bulma — CSS only, no JS passthrough needed
+  });
+
+  eleventyConfig.addShortcode("image", async function (src, alt) {
+    let metadata = await Image(src, {
+      widths: [320, 480, 720, 1280, 1920, 2048, 2560, 3840, 4096, 7680],
+      formats: ["webp", "jpeg"],
+      outputDir: `${OUTPUT_DIR}/assets/images/`,
+      urlPath: "/assets/images/",
+    });
+
+    return Image.generateHTML(metadata, {
+      alt,
+      sizes: "(max-width: 768px) 100vw, 50vw",
+      loading: "lazy",
+      decoding: "async",
+    });
+  });
+
+  eleventyConfig.addWatchTarget("./src/frontend/scss");
+  eleventyConfig.addWatchTarget("./src/frontend/routes");
+  eleventyConfig.addWatchTarget("./src/frontend/data");
+
+  eleventyConfig.setServerOptions({
+  watch: [`${OUTPUT_DIR}/js/**/*.js`]
+  });
+
+  return {
+    dir: {
+      input: "src/frontend",
+      output: OUTPUT_DIR,
+      includes: "components",
+      layouts: "layouts",
+      data: "data",
+    },
+  };
 };

package/.eleventyignore

@@ -1,4 +1,4 @@
-src/frontend/assets/**
-src/frontend/js/**
-src/frontend/scss/**
+src/frontend/assets/**
+src/frontend/js/**
+src/frontend/scss/**
 src/backend/**

package/.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Check that package.json matches the tag
+        if: github.event_name == 'release'
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG=$(node -p "require('./package.json').version")
+          if [ "$TAG" != "$PKG" ]; then
+            echo "Tag $TAG does not match package.json version $PKG"
+            exit 1
+          fi
+
+      - run: npm install -g npm@latest
+
+      - run: npm ci
+
+      - run: npm publish --provenance --access public

package/CHANGELOG.md

@@ -1,148 +1,166 @@
-# Changelog
-
-All notable changes to Nibula are documented here.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [1.2.4] - 2026-07-31
-
-### Changed
-- Refactor interno di `tools/`: la logica è divisa in `lib/`, `cli/` e
-  `config/`, con valori e messaggi estratti in `settings.json` e
-  `messages.json`. Nessun cambiamento di comportamento.
-- La CLI usa una palette uniforme: il colore resta solo sul riquadro del
-  titolo, i numeri delle voci sono attenuati.
-
-### Fixed
-- L'ultima riga del menu non chiudeva il codice colore `dim`, che restava
-  attivo sulla riga successiva.
-
-## [1.2.3] - 2026-07-29
-
-### Fixed
-- `updateOutputPath` no longer strips custom flags from `build:css` and `serve:css`: the output path is now replaced in place instead of regenerating the whole script
-- Missing `--load-path=node_modules` in the regenerated Sass scripts, which broke Bootstrap SCSS imports
-- Malformed `outDir` in `tsconfig.json` when the output path is absolute (`./c:/...`)
-
-## [1.2.2] - 2026-07-23
-
-### Added
-- **Full favicon set**: `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png`
-  (180×180, opaque) in `assets/brand/`. iOS home-screen icons no longer fall back
-  to a screenshot of the page.
-
-### Changed
-- **`data_bs_theme` renamed to `theme`** in `site.json`. It still drives
-  `data-bs-theme` on the `<html>` tag; the shorter name keeps the config readable
-  and independent from the framework naming.
-- **`theme_color` is now a single value** instead of a `light`/`dark` pair. The
-  theme is fixed per build, so two per-scheme colors could contradict the
-  rendered page.
-- **Favicon paths are hardcoded in `base.njk`.** The `favicon` key was removed
-  from `site.json`: it only ever covered one of the three tags, which was more
-  confusing than helpful. Replace the files in `assets/brand/` instead.
-- `_routes/` renamed to `routes/` — it holds entry points, not internals.
-
-### Removed
-- **`mdFile` shortcode** and the `markdown-it` dependency.
-- **`github-markdown-css`** and its two passthrough copies.
-
-### Migration
-- In `site.json`: rename `data_bs_theme` to `theme`, flatten `theme_color` to a
-  single string, drop `favicon`.
-- Place `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png` in
-  `src/frontend/assets/brand/`.
-- If you used `{% mdFile %}`, render the Markdown ahead of time or add
-  `markdown-it` back to your own project.
-
-## [1.1.3] - 2026-07-22
-
-### Changed
-- **The update check no longer runs on every command.** Previously every
-  invocation of `nib` (and the `nbl` / `nibula` aliases) contacted the npm
-  registry before doing anything, adding up to 2.5s of latency to `nib run`,
-  `nib build`, `nib cli` and `nib clean`. The check now runs only for `nib new`
-  and `nib update`; all other commands work entirely offline.
-- **`nib new` now completes the update automatically.** When a newer version is
-  available and you accept the prompt, Nibula installs it and immediately
-  re-runs the scaffolding with the new version, instead of asking you to type
-  `nib new <project-name>` a second time.
-- **New projects are scaffolded at version `0.0.0`** instead of `1.0.0`, so a
-  freshly created site no longer claims a stable public release. Bump it
-  yourself as the project grows, and reach `1.0.0` when you go to production.
-- **Framework SCSS imports are now short and readable.** The framework modules
-  in `src/frontend/scss/modules/frameworks/` used a five-level relative path
-  back to `node_modules`; they now import directly by package name, e.g.
-  `@import "bootstrap/scss/card";`. This matches what the styling docs already
-  showed, and makes commenting modules out far less error-prone.
-- `nib help` no longer appends an "a newer version is available" line, since it
-  no longer performs the check.
-
-### Added
-- Internal `--skip-update-check` flag on `nib new`, set automatically when the
-  command is re-run after a self-update. It prevents a loop if the registry is
-  slow to propagate the new version.
-- `--load-path=node_modules` on the repository's own `build:css` and `serve:css`
-  scripts, so the short framework imports resolve. Generated projects already
-  carried this flag.
-
-### Fixed
-- Repaired the ASCII header boxes and the commented-out example import inside
-  `_bootstrap.scss`, `_bulma.scss` and `_foundation.scss`, where an earlier
-  find-and-replace had injected the `node_modules` path into comment text and
-  broken the alignment.
-- `src/frontend/data` is no longer copied to the output folder. It holds the
-  Eleventy global data file, which is consumed at build time to render meta
-  tags and page config — publishing it produced a dead file in `out/` and
-  exposed the full page map, including `noindex` entries. It remains a watch
-  target, so edits still trigger a rebuild.
-
-### Notes
-- If the updated installation can't be located after `npm install -g` (an
-  unusual `npm root -g` setup, for example), Nibula reports the problem and
-  asks you to re-run the command, rather than scaffolding silently with the
-  old templates.
-- Existing projects are unaffected by the version change: it applies only to
-  newly created ones.
-- Short SCSS imports rely on Sass's `--load-path`, which is passed by the npm
-  scripts. Compiling the stylesheets with a different tool (a VS Code Sass
-  extension, for instance) will need the same load path configured.
-
-## [1.1.0] - 2026-07-21
-
-### Added
-- **Node.js backend** as an alternative to PHP, living side by side in
-  `src/backend/`: `_core/index.js` front controller (which is also the HTTP
-  server), `Response` and `RateLimiter` modules, a `mysql2` pool singleton
-  `Database.js`, `example.config.js`, and a `package.json` for the backend's
-  own dependencies. Same REST API as PHP: routing, `X-Api-Key` auth, CORS and
-  file-based rate limiting are identical.
-- **Backend choice at scaffold time**: `nib new` now asks whether to use Node.js
-  or PHP, in addition to language and CSS framework.
-- `backend/backend-node.service.example` — a ready-to-adapt **systemd** unit for
-  keeping the Node backend running on a server.
-- `config.js` is generated from `example.config.js` at scaffold time (mirroring
-  the existing `config.php` generation).
-- Deployment docs now cover running the Node backend with **`screen`** (quick /
-  small setups) and **systemd** (production), plus environment variables.
-
-### Changed
-- **Composer is now required only when the PHP backend is chosen.** If you pick
-  Node, `composer install` is skipped entirely and the backend's npm
-  dependencies (`mysql2`) are installed instead.
-- `.htaccess`, `web.config` and `nginx.conf` now cover **both** backends. On
-  nginx, `/api` goes to Node and automatically falls back to the PHP front
-  controller when Node is unreachable. On Apache/IIS the active backend is
-  selected by configuration (documented), since per-directory configs can't
-  health-check an upstream.
-- `.gitignore` now also ignores `src/backend/config.js`,
-  `src/backend/node_modules/` and `src/backend/cache/`.
-- Documentation (`README.md`, `docs/Backend.md`, `docs/Deploy.md`) updated:
-  backend examples now use JavaScript/Node as the reference, with the equivalent
-  PHP shown alongside and a note that PHP behaves identically.
-
-### Notes
-- Both backends are always scaffolded, so you can switch later without
-  re-creating the project. The PHP front controller only serves `.php` endpoint
-  files and the Node one only `.js`, so they coexist without conflict.
+# Changelog
+
+All notable changes to Nibula are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.2.5] - 2026-08-01
+
+### Added
+- `nib new` now refuses to run from inside an existing Nibula project. Creating
+  a project inside another one produced a broken setup, since the outer build
+  would pick up the inner project's files. The error message reports the path of
+  the project that was detected, so it's clear which one triggered the check.
+- A GitHub Actions workflow that publishes the package to npm whenever a release
+  is created, using npm's trusted publishing. The workflow verifies that the git
+  tag matches the version in `package.json` before publishing, and attaches a
+  provenance attestation to the published package.
+
+### Changed
+- Rewrote the README: added a section on when Nibula is *not* the right tool,
+  clarified that Composer is only needed with the PHP backend, and moved the
+  editor extensions from the required to the recommended prerequisites.
+
+## [1.2.4] - 2026-07-31
+
+### Changed
+- Internal refactor of `tools/`: the logic is now split across `lib/`, `cli/`
+  and `config/`, with values and messages extracted into `settings.json` and
+  `messages.json`. No behaviour changes — pages, `site.json` and
+  `page-components.njk` are written exactly as before.
+- The CLI now uses a uniform palette: colour is limited to the title box, and
+  the menu numbers are dimmed instead of each carrying its own colour.
+
+### Fixed
+- The last line of the menu never closed the `dim` colour code, which stayed
+  active on the following line.
+
+## [1.2.3] - 2026-07-29
+
+### Fixed
+- `updateOutputPath` no longer strips custom flags from `build:css` and `serve:css`: the output path is now replaced in place instead of regenerating the whole script
+- Missing `--load-path=node_modules` in the regenerated Sass scripts, which broke Bootstrap SCSS imports
+- Malformed `outDir` in `tsconfig.json` when the output path is absolute (`./c:/...`)
+
+## [1.2.2] - 2026-07-23
+
+### Added
+- **Full favicon set**: `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png`
+  (180×180, opaque) in `assets/brand/`. iOS home-screen icons no longer fall back
+  to a screenshot of the page.
+
+### Changed
+- **`data_bs_theme` renamed to `theme`** in `site.json`. It still drives
+  `data-bs-theme` on the `<html>` tag; the shorter name keeps the config readable
+  and independent from the framework naming.
+- **`theme_color` is now a single value** instead of a `light`/`dark` pair. The
+  theme is fixed per build, so two per-scheme colors could contradict the
+  rendered page.
+- **Favicon paths are hardcoded in `base.njk`.** The `favicon` key was removed
+  from `site.json`: it only ever covered one of the three tags, which was more
+  confusing than helpful. Replace the files in `assets/brand/` instead.
+- `_routes/` renamed to `routes/` — it holds entry points, not internals.
+
+### Removed
+- **`mdFile` shortcode** and the `markdown-it` dependency.
+- **`github-markdown-css`** and its two passthrough copies.
+
+### Migration
+- In `site.json`: rename `data_bs_theme` to `theme`, flatten `theme_color` to a
+  single string, drop `favicon`.
+- Place `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png` in
+  `src/frontend/assets/brand/`.
+- If you used `{% mdFile %}`, render the Markdown ahead of time or add
+  `markdown-it` back to your own project.
+
+## [1.1.3] - 2026-07-22
+
+### Changed
+- **The update check no longer runs on every command.** Previously every
+  invocation of `nib` (and the `nbl` / `nibula` aliases) contacted the npm
+  registry before doing anything, adding up to 2.5s of latency to `nib run`,
+  `nib build`, `nib cli` and `nib clean`. The check now runs only for `nib new`
+  and `nib update`; all other commands work entirely offline.
+- **`nib new` now completes the update automatically.** When a newer version is
+  available and you accept the prompt, Nibula installs it and immediately
+  re-runs the scaffolding with the new version, instead of asking you to type
+  `nib new <project-name>` a second time.
+- **New projects are scaffolded at version `0.0.0`** instead of `1.0.0`, so a
+  freshly created site no longer claims a stable public release. Bump it
+  yourself as the project grows, and reach `1.0.0` when you go to production.
+- **Framework SCSS imports are now short and readable.** The framework modules
+  in `src/frontend/scss/modules/frameworks/` used a five-level relative path
+  back to `node_modules`; they now import directly by package name, e.g.
+  `@import "bootstrap/scss/card";`. This matches what the styling docs already
+  showed, and makes commenting modules out far less error-prone.
+- `nib help` no longer appends an "a newer version is available" line, since it
+  no longer performs the check.
+
+### Added
+- Internal `--skip-update-check` flag on `nib new`, set automatically when the
+  command is re-run after a self-update. It prevents a loop if the registry is
+  slow to propagate the new version.
+- `--load-path=node_modules` on the repository's own `build:css` and `serve:css`
+  scripts, so the short framework imports resolve. Generated projects already
+  carried this flag.
+
+### Fixed
+- Repaired the ASCII header boxes and the commented-out example import inside
+  `_bootstrap.scss`, `_bulma.scss` and `_foundation.scss`, where an earlier
+  find-and-replace had injected the `node_modules` path into comment text and
+  broken the alignment.
+- `src/frontend/data` is no longer copied to the output folder. It holds the
+  Eleventy global data file, which is consumed at build time to render meta
+  tags and page config — publishing it produced a dead file in `out/` and
+  exposed the full page map, including `noindex` entries. It remains a watch
+  target, so edits still trigger a rebuild.
+
+### Notes
+- If the updated installation can't be located after `npm install -g` (an
+  unusual `npm root -g` setup, for example), Nibula reports the problem and
+  asks you to re-run the command, rather than scaffolding silently with the
+  old templates.
+- Existing projects are unaffected by the version change: it applies only to
+  newly created ones.
+- Short SCSS imports rely on Sass's `--load-path`, which is passed by the npm
+  scripts. Compiling the stylesheets with a different tool (a VS Code Sass
+  extension, for instance) will need the same load path configured.
+
+## [1.1.0] - 2026-07-21
+
+### Added
+- **Node.js backend** as an alternative to PHP, living side by side in
+  `src/backend/`: `_core/index.js` front controller (which is also the HTTP
+  server), `Response` and `RateLimiter` modules, a `mysql2` pool singleton
+  `Database.js`, `example.config.js`, and a `package.json` for the backend's
+  own dependencies. Same REST API as PHP: routing, `X-Api-Key` auth, CORS and
+  file-based rate limiting are identical.
+- **Backend choice at scaffold time**: `nib new` now asks whether to use Node.js
+  or PHP, in addition to language and CSS framework.
+- `backend/backend-node.service.example` — a ready-to-adapt **systemd** unit for
+  keeping the Node backend running on a server.
+- `config.js` is generated from `example.config.js` at scaffold time (mirroring
+  the existing `config.php` generation).
+- Deployment docs now cover running the Node backend with **`screen`** (quick /
+  small setups) and **systemd** (production), plus environment variables.
+
+### Changed
+- **Composer is now required only when the PHP backend is chosen.** If you pick
+  Node, `composer install` is skipped entirely and the backend's npm
+  dependencies (`mysql2`) are installed instead.
+- `.htaccess`, `web.config` and `nginx.conf` now cover **both** backends. On
+  nginx, `/api` goes to Node and automatically falls back to the PHP front
+  controller when Node is unreachable. On Apache/IIS the active backend is
+  selected by configuration (documented), since per-directory configs can't
+  health-check an upstream.
+- `.gitignore` now also ignores `src/backend/config.js`,
+  `src/backend/node_modules/` and `src/backend/cache/`.
+- Documentation (`README.md`, `docs/Backend.md`, `docs/Deploy.md`) updated:
+  backend examples now use JavaScript/Node as the reference, with the equivalent
+  PHP shown alongside and a note that PHP behaves identically.
+
+### Notes
+- Both backends are always scaffolded, so you can switch later without
+  re-creating the project. The PHP front controller only serves `.php` endpoint
+  files and the Node one only `.js`, so they coexist without conflict.