nibula 1.5.1 → 1.5.3

package/CHANGELOG.md

@@ -5,6 +5,51 @@ All notable changes to Nibula are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.3] - 2026-08-05
+
+### Fixed
+- `web.config` no longer breaks on Windows shared hosting. `ApiToNode` was the
+  first rule, so every `/api` request returned a 500: rewriting to an absolute
+  URL needs the ARR module, and the `<serverVariables>` block needs an entry in
+  `applicationHost.config` — neither is available on a shared plan. `ApiToPhp`
+  is now the default and `ApiToNode` ships commented out, with the requirements
+  spelled out above it. `<serverVariables>` is gone; on a server with ARR the
+  forwarded-protocol header is set server-side.
+- The PHP front controller looked for `404.html` only under
+  `$_SERVER['DOCUMENT_ROOT']`, which doesn't resolve to the site root on shared
+  hosting, so an unknown `/api` route returned an empty page. It now falls back
+  to the path relative to `_core`, matching how `index.js` already resolved it.
+- `Content-Type: text/html` was only sent when `404.html` existed; the plain
+  fallback went out undeclared.
+- Requesting a protected endpoint in a browser opened a credentials prompt
+  instead of showing the error. IIS attaches `WWW-Authenticate: Basic` to 401
+  responses, which the browser answers with a login dialog. It is now removed in
+  `web.config`, so the JSON envelope reaches the client as intended.
+- `httpErrors` under `backend/` is set to `PassThrough`. The site root keeps
+  `Replace` so unknown pages get `404.html`, but under `backend/` every response
+  is the API's own JSON envelope and IIS must not substitute its HTML for it.
+- `nib rename` overwrote the page's SEO title in `site.json` with one derived
+  from the new name, discarding whatever you had written. It now moves the
+  record under the new key and changes nothing else. This also fixes the rename
+  failing outright when the record's `seo` field was malformed, since the field
+  is no longer read.
+- `nib rename` rewrote `title` in the route's front matter for the same reason.
+  Only `permalink` is updated now.
+
+### Changed
+- `docs/Deploy.md` documents the new IIS default, and warns that a Node project
+  published to Windows shared hosting should leave the `backend` folder out —
+  the requests would be rewritten onto a PHP front controller the project
+  doesn't contain.
+
+## [1.5.2] - 2026-08-05
+
+### Fixed
+- `nib new` no longer creates an empty `src/frontend/routes` folder. 1.5.1
+  removed it from `CREATE_DIRS` but left it in `MANDATORY_COPY`, so it still
+  arrived from the template. It is now created on demand when the first page is
+  added, and removed again when the last one is deleted.
+
 ## [1.5.1] - 2026-08-05
 
 ### Fixed

package/bin/create.js

@@ -74,9 +74,7 @@ const FRONTEND_EXCLUDE = {
     [LANGUAGE.TYPESCRIPT]: ['js'],
 };
 
-const CREATE_DIRS = [
-    'src/frontend/routes',
-];
+const CREATE_DIRS = [];
 
 // Backend files that belong to exactly one backend, matched by basename.
 // Everything else (migrations, .htaccess, web.config, README, ...) is shared.

package/docs/Deploy.md

@@ -58,9 +58,16 @@ comment the `mod_proxy` block in `.htaccess`.
 Same idea: upload the contents of `out`, `web.config` is already there and read
 automatically.
 
-**Backend routing:** the `ApiToNode` rule (requires the ARR + URL Rewrite
-modules) proxies `/api` to Node and wins if present. Remove it to fall through
-to `ApiToPhp`, which rewrites `/api` to the PHP front controller.
+**Backend routing:** `/api` is rewritten to the PHP front controller. To use the
+Node backend instead, uncomment the `ApiToNode` rule in `web.config` and delete
+`ApiToPhp` — this needs the ARR and URL Rewrite modules with proxying enabled,
+so a server you control, not shared hosting.
+
+> ⚠️ **If you chose the Node backend and your host has no ARR** (Aruba and other
+> Windows shared hosting), don't upload the `backend` folder at all. The static
+> site works, and `/api/*` answers with your `404.html`. Upload it and every
+> `/api` request returns an empty 404 instead: IIS rewrites it onto the PHP
+> front controller, which a Node project doesn't contain.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nibula",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "A beginner-friendly static site generator built on Eleventy that stays close to vanilla HTML, CSS and JS — with a page-management CLI, an optional PHP backend, and SEO files generated for you.",
   "keywords": [
     "static-site-generator",

package/src/backend/_core/index.js

@@ -203,7 +203,7 @@ async function handleRequest(req, res) {
             const apiKey = req.headers['x-api-key'] || '';
 
             if (validKey === '' || !hashEquals(validKey, apiKey)) {
-                Response.error('Unauthorized. X_API_KEY is incorrect or missing', 401);
+                Response.error('Unauthorized. X_API_KEY is incorrect or missing', 403);
             }
         }
 

package/src/backend/_core/index.php

@@ -73,12 +73,24 @@ while (count($checkParts) > 0) {
  */
 if (!$endpointFile) {
     http_response_code(404);
+    header_remove('WWW-Authenticate');
+
+    /**
+     * In a Nibula build the backend lives at out/backend/, so the site root
+     * (out/) is two levels up from _core. DOCUMENT_ROOT is preferred when it
+     * resolves, but on shared hosting it often points elsewhere, so the
+     * relative path is used as a fallback. Same resolution as index.js.
+     */
+    $documentRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
+    $errorPage    = $documentRoot . '/404.html';
+
+    if (!file_exists($errorPage)) {
+        $errorPage = __DIR__ . '/../../404.html';
+    }
 
-    // Look for the 404.html file generated by Eleventy in the server document root
-    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    header('Content-Type: text/html; charset=UTF-8');
 
     if (file_exists($errorPage)) {
-        header('Content-Type: text/html; charset=UTF-8');
         echo file_get_contents($errorPage);
     } else {
         echo "<h1>404 Not Found</h1>";
@@ -97,6 +109,7 @@ $endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPat
 // =====================================================
 
 header('Content-Type: application/json; charset=UTF-8');
+header_remove('WWW-Authenticate');
 header('X-Content-Type-Options: nosniff');
 header('X-Frame-Options: DENY');
 header('Referrer-Policy: strict-origin-when-cross-origin');
@@ -133,7 +146,7 @@ if ($isProtected) {
     $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
 
     if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
-        Response::error('Unauthorized. X_API_KEY is incorrect or missing', 401);
+        Response::error('Unauthorized. X_API_KEY is incorrect or missing', 403);
     }
 }
 

package/src/backend/web.config

@@ -1,17 +1,44 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--
+  IIS config for the Nibula backend folder.
+
+  The front controller is the only reachable file: every other path is rewritten
+  onto it and answered as an API request, so endpoint sources, config.php,
+  migrations and vendor files are never served.
+
+  httpErrors is set to PassThrough here, unlike the site root. Everything under
+  this folder is the API, and the front controller already answers errors with
+  its own JSON envelope (401 for a missing X-Api-Key, 404 for an unknown
+  endpoint, 500 for an unhandled exception). Without PassThrough, IIS replaces
+  those bodies with its own HTML and every API error reaches the client in the
+  wrong format.
+-->
 <configuration>
     <system.webServer>
         <rewrite>
             <rules>
+
                 <rule name="PassThroughCoreIndex" stopProcessing="true">
                     <match url="^_core/index\.php$" ignoreCase="true" />
                     <action type="None" />
                 </rule>
+
                 <rule name="RewriteToFrontController" stopProcessing="true">
                     <match url="^(.*)$" ignoreCase="true" />
                     <action type="Rewrite" url="_core/index.php" appendQueryString="true" />
                 </rule>
+
             </rules>
         </rewrite>
+
+        <directoryBrowse enabled="false" />
+
+        <httpErrors errorMode="Custom" existingResponse="PassThrough" />
+
+        <httpProtocol>
+            <customHeaders>
+                <remove name="WWW-Authenticate" />
+            </customHeaders>
+        </httpProtocol>
     </system.webServer>
 </configuration>

package/src/frontend/web.config

@@ -1,18 +1,17 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  IIS config for a Nibula site — covers BOTH backends.
-
-  IIS (like Apache, unlike nginx) cannot health-check an upstream, so it cannot
-  auto-fall back from Node to PHP. URL Rewrite processes rules top-down and the
-  first match with stopProcessing="true" wins:
-
-    - "ApiToNode" wins if present -> /api is reverse-proxied to the Node backend
-      (requires the Application Request Routing + URL Rewrite modules, with proxy
-      enabled: ARR > Server Proxy Settings > Enable proxy).
-    - To use the PHP backend instead, remove or comment the "ApiToNode" rule;
-      "ApiToPhp" then rewrites /api to the PHP front controller.
-
-  On Windows shared hosting without ARR, keep only "ApiToPhp".
+  IIS config for a Nibula site.
+
+  URL Rewrite processes rules top-down and the first match with
+  stopProcessing="true" wins. The default is the PHP backend, because it is the
+  only one that runs on Windows shared hosting (Aruba and similar), where you
+  cannot install server modules.
+
+  To use the NODE backend instead, uncomment the "ApiToNode" rule below and
+  delete "ApiToPhp". This requires a server you control, with the Application
+  Request Routing and URL Rewrite modules installed and proxying enabled
+  (ARR > Server Proxy Settings > Enable proxy). On shared hosting it will fail
+  with a 500: rewriting to an absolute URL without ARR is not allowed.
 -->
 <configuration>
     <system.webServer>
@@ -25,20 +24,18 @@
                     <action type="CustomResponse" statusCode="404" />
                 </rule>
 
-                <!-- Node backend (requires ARR). Remove this rule to use PHP. -->
-                <rule name="ApiToNode" stopProcessing="true">
+                <!-- PHP backend: rewrite /api to the PHP front controller. -->
+                <rule name="ApiToPhp" stopProcessing="true">
                     <match url="^api/(.*)" ignoreCase="true" />
-                    <action type="Rewrite" url="http://127.0.0.1:3000/api/{R:1}" appendQueryString="true" />
-                    <serverVariables>
-                        <set name="HTTP_X_FORWARDED_PROTO" value="https" />
-                    </serverVariables>
+                    <action type="Rewrite" url="backend/_core/index.php" appendQueryString="true" />
                 </rule>
 
-                <!-- PHP backend fallback: rewrite /api to the PHP front controller. -->
-                <rule name="ApiToPhp" stopProcessing="true">
+                <!-- Node backend (requires ARR). Delete "ApiToPhp" above to use this.
+                <rule name="ApiToNode" stopProcessing="true">
                     <match url="^api/(.*)" ignoreCase="true" />
-                    <action type="Rewrite" url="backend/_core/index.php" appendQueryString="true" />
+                    <action type="Rewrite" url="http://127.0.0.1:3000/api/{R:1}" appendQueryString="true" />
                 </rule>
+                -->
 
             </rules>
         </rewrite>
@@ -52,4 +49,4 @@
             <error statusCode="403" path="/404.html" responseMode="ExecuteURL" />
         </httpErrors>
     </system.webServer>
-</configuration>
+</configuration>

package/tools/lib/pageActions.js

@@ -18,11 +18,11 @@ function templatePath(name) {
     return path.join(PATHS.templates, name);
 }
 
-function applyFrontMatter(filePath, values) {
+function applyFrontMatter(filePath, values, keys = Object.keys(FRONT_MATTER_PATTERNS)) {
     let content = readText(filePath);
 
-    for (const [key, pattern] of Object.entries(FRONT_MATTER_PATTERNS)) {
-        content = content.replace(pattern, formatText(settings.frontMatter[key], values));
+    for (const key of keys) {
+        content = content.replace(FRONT_MATTER_PATTERNS[key], formatText(settings.frontMatter[key], values));
     }
 
     writeText(filePath, content);
@@ -96,7 +96,7 @@ function renamePage(oldName, newName) {
             moveFile(source, destination);
             log('page.fileRenamed', { source, destination });
 
-            if (isRoute) applyFrontMatter(destination, values);
+            if (isRoute) applyFrontMatter(destination, values, ['permalink']);
         }
     } catch (error) {
         log('page.renameFailed', { error: error.message });

package/tools/lib/siteData.js

@@ -79,11 +79,7 @@ function renameSiteData(oldName, newName) {
         return;
     }
 
-    const record = data[PAGES_KEY][oldCamelName];
-    data[PAGES_KEY][newCamelName] = {
-        ...record,
-        [SEO_KEY]: { ...record[SEO_KEY], [TITLE_KEY]: toTitleCase(newName) },
-    };
+    data[PAGES_KEY][newCamelName] = data[PAGES_KEY][oldCamelName];
     delete data[PAGES_KEY][oldCamelName];
 
     writeSiteData(data);