nibula 1.6.0 → 1.6.1

package/CHANGELOG.md

@@ -1,377 +1,384 @@
-# Changelog
-
-All notable changes to Nibula are documented here.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [2.0.0] - 2026-08-06
-
-### Breaking
-- Per-page settings must move out of `site.json`. Take the block under the `pages`
-  key and make it the root object of a new `src/frontend/data/pages.json`, then
-  update `base.njk`, `sitemap.njk` and `llms.njk` to read `pages[title]` instead of
-  `site.pages[title]`. Without `pages.json` the assistant reports the missing file
-  and stops.
-- SCSS and JS import paths change with the `_root`, `_global` and `global` moves.
-  Update the `@use` and `@import` lines in your page entry points accordingly.
-- Existing projects keep working until you run `npm install nibula@latest` inside
-  them: commands now delegate to the project's own copy, so an old project keeps
-  running the version it was built with.
-
-### Changed
-- **Per-page settings moved from `site.json` to a new `pages.json`.** They were nested under a `pages` key in the same file the CLI writes on every page operation; splitting them means a syntax error in one page's record no longer makes the whole site configuration unreadable. Access changes from `{{ site.pages[title] }}` to `{{ pages[title] }}`, and the CLI now reads and writes `pages.json` only.
-- Commands run inside a project now execute the project's own Nibula, taken from its `node_modules`, instead of the globally installed one. `nib cli` typed in a terminal used to run the global copy against local files, so a project scaffolded with an older version could be operated on by a newer CLI expecting a different structure. When the two versions differ, the one being used is reported before the command runs, and the assistant's title shows it as well.
-- `_root.scss` and `_global.scss` moved out of `scss/modules/`. They are not modules — every page imports them and nothing else does — so they now sit at the root of `scss/`.
-- `global.js` and `global.ts` moved out of their `modules/` folders, for the same reason.
-- Import paths updated across existing modules, pages and scaffold templates to match both moves.
-- `base.njk` applies the `url` filter to per-page CSS and JS, to the favicons and to the framework scripts. Without it these paths ignore `pathPrefix`, so every asset 404s on a site published under a subpath — GitHub Pages being the common case.
-- Documentation updated throughout for the new structure and the `site.json` / `pages.json` split.
-
-### Fixed
-- TypeScript page entry points imported modules with a `.js` extension.
-- `logo` was nested inside `legal` in `site.json`, so `{{ site.logo }}` resolved to nothing in the header, the footer, the Open Graph image and the JSON-LD publisher block. It now sits at the root, where the templates already looked for it.
-
-### Removed
-- `legal.cookieControls` from `site.json`.
-- Preconnect hint to `cdn.jsdelivr.net` in `base.njk`. The project loads its framework from `node_modules` through passthrough copy, so the hint opened a TCP and TLS connection to a host that was never used.
-
-## [1.5.3] - 2026-08-05
-
-### Fixed
-- `web.config` no longer breaks on Windows shared hosting. `ApiToNode` was the
-  first rule, so every `/api` request returned a 500: rewriting to an absolute
-  URL needs the ARR module, and the `<serverVariables>` block needs an entry in
-  `applicationHost.config` — neither is available on a shared plan. `ApiToPhp`
-  is now the default and `ApiToNode` ships commented out, with the requirements
-  spelled out above it. `<serverVariables>` is gone; on a server with ARR the
-  forwarded-protocol header is set server-side.
-- The PHP front controller looked for `404.html` only under
-  `$_SERVER['DOCUMENT_ROOT']`, which doesn't resolve to the site root on shared
-  hosting, so an unknown `/api` route returned an empty page. It now falls back
-  to the path relative to `_core`, matching how `index.js` already resolved it.
-- `Content-Type: text/html` was only sent when `404.html` existed; the plain
-  fallback went out undeclared.
-- Requesting a protected endpoint in a browser opened a credentials prompt
-  instead of showing the error. IIS attaches `WWW-Authenticate: Basic` to 401
-  responses, which the browser answers with a login dialog. It is now removed in
-  `web.config`, so the JSON envelope reaches the client as intended.
-- `httpErrors` under `backend/` is set to `PassThrough`. The site root keeps
-  `Replace` so unknown pages get `404.html`, but under `backend/` every response
-  is the API's own JSON envelope and IIS must not substitute its HTML for it.
-- `nib rename` overwrote the page's SEO title in `site.json` with one derived
-  from the new name, discarding whatever you had written. It now moves the
-  record under the new key and changes nothing else. This also fixes the rename
-  failing outright when the record's `seo` field was malformed, since the field
-  is no longer read.
-- `nib rename` rewrote `title` in the route's front matter for the same reason.
-  Only `permalink` is updated now.
-
-### Changed
-- `docs/Deploy.md` documents the new IIS default, and warns that a Node project
-  published to Windows shared hosting should leave the `backend` folder out —
-  the requests would be rewritten onto a PHP front controller the project
-  doesn't contain.
-
-## [1.5.2] - 2026-08-05
-
-### Fixed
-- `nib new` no longer creates an empty `src/frontend/routes` folder. 1.5.1
-  removed it from `CREATE_DIRS` but left it in `MANDATORY_COPY`, so it still
-  arrived from the template. It is now created on demand when the first page is
-  added, and removed again when the last one is deleted.
-
-## [1.5.1] - 2026-08-05
-
-### Fixed
-- `nib new` no longer creates an empty `routes` folder. Page source folders are
-  created on demand when a page is added, and removed again when the last page
-  in them is deleted — `routes`, `scss/pages` and the JS/TS pages folder alike.
-- Removing a page that doesn't exist reported the skip and then went on to strip
-  its entry from `site.json` and `page-components.njk` anyway. It now stops.
-- `example.config.php` was missing the `APP_ENV` key, so PHP projects had no way
-  to discover the debug switch from the template. Behaviour was unaffected —
-  the code already fell back to `production` — but the key is now visible and
-  documented, and the two templates are identical again.
-- The backend's `dev` script set `APP_ENV` as an environment variable, which
-  neither backend reads. It ran in production mode and produced no debug output.
-  The script is gone; error verbosity is set in `config.js` / `config.php`.
-- `bin/create.js` repeated the `mysql2` version already declared in
-  `src/backend/package.json`. It now reads that file, so the two cannot drift.
-- `docs/Deploy.md` pointed at `backend/backend-node.service.example`, removed in
-  1.5.0. The systemd unit is written out in full instead.
-- `docs/Deploy.md` gave the backend path as `/var/www/backend/SITE_FOLDER`,
-  inverted with respect to the rest of the document.
-
-### Changed
-- Nginx setup steps moved from the `nginx.conf` header into `docs/Deploy.md`,
-  under "Your own server". The header keeps only the three placeholders that
-  appear in the file and a pointer to the docs, so a config copied into
-  `/etc/nginx/sites-available/` no longer carries 60 lines of install
-  instructions that were already followed.
-- `docs/Deploy.md` troubleshooting is now a table, with a row for a 502 on
-  `/api` caused by the Node process not running.
-- `.eleventyignore` reduced to `src/frontend/assets/**`. The `scss`, `js` and
-  `src/backend` entries excluded nothing: the first two are not Eleventy
-  template formats and the third is outside the input directory. The last one
-  was also misleading, since `.eleventy.js` deliberately copies `src/backend`
-  into the build.
-- `docs/Backend.md` documents `APP_ENV` in its own section, including the
-  `display_errors` behaviour specific to PHP, and states explicitly that it is
-  a config key rather than an environment variable.
-
-### Notes
-- Existing projects are unaffected: the scaffolding and template changes apply
-  only to newly created ones.
-
-## [1.5.0] - 2026-08-04
-
-### Added
-- `nginx.conf` now covers **both backends** with no manual edits. `/api` is
-  proxied to Node on `127.0.0.1:3000`; if Node is unreachable, the request is
-  retried through the PHP front controller via the internal `@php_backend`
-  location. The same file works for a Node deployment and a PHP one.
-- `nginx.conf` header now documents the PHP-FPM requirement, the version-agnostic
-  socket, and the errors specific to a PHP deployment.
-
-### Changed
-- PHP is invoked through `SCRIPT_FILENAME` instead of by URL, so `.php` requests
-  keep returning 404 even on a PHP deployment and no source file is ever
-  reachable by name.
-- `fastcgi_pass` targets the version-agnostic socket `unix:/run/php/php-fpm.sock`
-  instead of a versioned path, so the config survives PHP upgrades.
-- `web.config` is now blocked anywhere in the tree, not only at the document root.
-- `docs/Backend.md` is limited to writing endpoints: routing, `public` vs
-  `protected`, the `Response` helper and configuration. Examples are Node-only,
-  with a note that PHP behaves identically. Hosting and server requirements
-  moved to `docs/Deploy.md`.
-- `docs/Deploy.md` rewritten around where a site can be published and what each
-  target requires, including why shared hosting cannot run the Node backend.
-
-### Removed
-- `docs/Nginx.md` — the setup steps live in the `nginx.conf` header, where they
-  are read at the moment they are needed.
-- `src/backend/backend-node.service.example` — the systemd unit is documented
-  in `docs/Deploy.md` instead of shipped as a file.
-
-## [1.4.0] - 2026-08-03
-
-### Changed
-- `nginx.conf` is now a complete, ready-to-use site file instead of a set of
-  directives to paste into your own `server` block. Replace three placeholders
-  (`YOUR_DOMAIN`, `SITE_FOLDER`, `YOUR_CERTIFICATE`), symlink it into
-  `sites-enabled/`, reload.
-- Nginx documentation moved from `docs/Deploy.md` to `docs/Nginx.md`;
-  `Deploy.md` now covers only where to publish, one section per server.
-
-### Added
-- HTTP → HTTPS redirect on port 80, with an optional ACME webroot block.
-- TLS setup via Let's Encrypt, with placeholders for the certificate path.
-- Security headers: `X-Content-Type-Options`, `X-Frame-Options`,
-  `Referrer-Policy`, `Strict-Transport-Security` (`max-age=300` by default).
-- `.php` requests return 404, preventing source-code leaks when php-fpm is
-  not configured.
-
-### Removed
-- **Breaking:** the automatic Node → PHP fallback on Nginx. `/api` is now
-  proxied to Node only; if the process is down, Nginx returns 502. For a PHP
-  deployment, edit the `.php` block and `try_files` as described in
-  `docs/Nginx.md`.
-
-### Migration
-Existing Nginx deployments: replace your `server` block with the new
-`nginx.conf` and fill in the three placeholders. If you relied on the PHP
-fallback, follow *Using the PHP backend* in `docs/Nginx.md`.
-
-## [1.3.0] - 2026-08-01
-
-### Added
-- A `global.js` module in `src/frontend/js/modules/`, for code that has to run
-  on every page — a header menu, a theme toggle, a cookie banner. Page entry
-  points import it once and it takes care of running the shared modules, so
-  there's no longer a line to remember in every single page.
-- `docs/Javascript.md` now covers the global module, with the header burger
-  menu as a worked example and a note on when a behaviour belongs in
-  `global.js` rather than in a page.
-
-### Changed
-- Page entry points, and the template new pages are created from, now start
-  with `import '../modules/global.js';`.
-
-### Notes
-- Existing projects keep working as they are. To adopt the global module, add
-  `src/frontend/js/modules/global.js` and the import line at the top of each
-  page entry point.
-
-## [1.2.6] - 2026-08-01
-
-### Fixed
-- The scaffolder created the routes folder as `src/frontend/_routes` instead of
-  `src/frontend/routes`. The CLI writes and looks for page templates in
-  `routes`, so on a freshly created project every page ended up outside the
-  folder Eleventy and the assistant expect.
-
-  ### Notes
-- Projects created with 1.2.5 have an empty `src/frontend/_routes` folder that
-  can be deleted. Pages created before this fix should be moved to
-  `src/frontend/routes`.
-
-## [1.2.5] - 2026-08-01
-
-### Added
-- `nib new` now refuses to run from inside an existing Nibula project. Creating
-  a project inside another one produced a broken setup, since the outer build
-  would pick up the inner project's files. The error message reports the path of
-  the project that was detected, so it's clear which one triggered the check.
-- A GitHub Actions workflow that publishes the package to npm whenever a release
-  is created, using npm's trusted publishing. The workflow verifies that the git
-  tag matches the version in `package.json` before publishing, and attaches a
-  provenance attestation to the published package.
-
-### Changed
-- Rewrote the README: added a section on when Nibula is *not* the right tool,
-  clarified that Composer is only needed with the PHP backend, and moved the
-  editor extensions from the required to the recommended prerequisites.
-
-## [1.2.4] - 2026-07-31
-
-### Changed
-- Internal refactor of `tools/`: the logic is now split across `lib/`, `cli/`
-  and `config/`, with values and messages extracted into `settings.json` and
-  `messages.json`. No behaviour changes — pages, `site.json` and
-  `page-components.njk` are written exactly as before.
-- The CLI now uses a uniform palette: colour is limited to the title box, and
-  the menu numbers are dimmed instead of each carrying its own colour.
-
-### Fixed
-- The last line of the menu never closed the `dim` colour code, which stayed
-  active on the following line.
-
-## [1.2.3] - 2026-07-29
-
-### Fixed
-- `updateOutputPath` no longer strips custom flags from `build:css` and `serve:css`: the output path is now replaced in place instead of regenerating the whole script
-- Missing `--load-path=node_modules` in the regenerated Sass scripts, which broke Bootstrap SCSS imports
-- Malformed `outDir` in `tsconfig.json` when the output path is absolute (`./c:/...`)
-
-## [1.2.2] - 2026-07-23
-
-### Added
-- **Full favicon set**: `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png`
-  (180×180, opaque) in `assets/brand/`. iOS home-screen icons no longer fall back
-  to a screenshot of the page.
-
-### Changed
-- **`data_bs_theme` renamed to `theme`** in `site.json`. It still drives
-  `data-bs-theme` on the `<html>` tag; the shorter name keeps the config readable
-  and independent from the framework naming.
-- **`theme_color` is now a single value** instead of a `light`/`dark` pair. The
-  theme is fixed per build, so two per-scheme colors could contradict the
-  rendered page.
-- **Favicon paths are hardcoded in `base.njk`.** The `favicon` key was removed
-  from `site.json`: it only ever covered one of the three tags, which was more
-  confusing than helpful. Replace the files in `assets/brand/` instead.
-- `_routes/` renamed to `routes/` — it holds entry points, not internals.
-
-### Removed
-- **`mdFile` shortcode** and the `markdown-it` dependency.
-- **`github-markdown-css`** and its two passthrough copies.
-
-### Migration
-- In `site.json`: rename `data_bs_theme` to `theme`, flatten `theme_color` to a
-  single string, drop `favicon`.
-- Place `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png` in
-  `src/frontend/assets/brand/`.
-- If you used `{% mdFile %}`, render the Markdown ahead of time or add
-  `markdown-it` back to your own project.
-
-## [1.1.3] - 2026-07-22
-
-### Changed
-- **The update check no longer runs on every command.** Previously every
-  invocation of `nib` (and the `nbl` / `nibula` aliases) contacted the npm
-  registry before doing anything, adding up to 2.5s of latency to `nib run`,
-  `nib build`, `nib cli` and `nib clean`. The check now runs only for `nib new`
-  and `nib update`; all other commands work entirely offline.
-- **`nib new` now completes the update automatically.** When a newer version is
-  available and you accept the prompt, Nibula installs it and immediately
-  re-runs the scaffolding with the new version, instead of asking you to type
-  `nib new <project-name>` a second time.
-- **New projects are scaffolded at version `0.0.0`** instead of `1.0.0`, so a
-  freshly created site no longer claims a stable public release. Bump it
-  yourself as the project grows, and reach `1.0.0` when you go to production.
-- **Framework SCSS imports are now short and readable.** The framework modules
-  in `src/frontend/scss/modules/frameworks/` used a five-level relative path
-  back to `node_modules`; they now import directly by package name, e.g.
-  `@import "bootstrap/scss/card";`. This matches what the styling docs already
-  showed, and makes commenting modules out far less error-prone.
-- `nib help` no longer appends an "a newer version is available" line, since it
-  no longer performs the check.
-
-### Added
-- Internal `--skip-update-check` flag on `nib new`, set automatically when the
-  command is re-run after a self-update. It prevents a loop if the registry is
-  slow to propagate the new version.
-- `--load-path=node_modules` on the repository's own `build:css` and `serve:css`
-  scripts, so the short framework imports resolve. Generated projects already
-  carried this flag.
-
-### Fixed
-- Repaired the ASCII header boxes and the commented-out example import inside
-  `_bootstrap.scss`, `_bulma.scss` and `_foundation.scss`, where an earlier
-  find-and-replace had injected the `node_modules` path into comment text and
-  broken the alignment.
-- `src/frontend/data` is no longer copied to the output folder. It holds the
-  Eleventy global data file, which is consumed at build time to render meta
-  tags and page config — publishing it produced a dead file in `out/` and
-  exposed the full page map, including `noindex` entries. It remains a watch
-  target, so edits still trigger a rebuild.
-
-### Notes
-- If the updated installation can't be located after `npm install -g` (an
-  unusual `npm root -g` setup, for example), Nibula reports the problem and
-  asks you to re-run the command, rather than scaffolding silently with the
-  old templates.
-- Existing projects are unaffected by the version change: it applies only to
-  newly created ones.
-- Short SCSS imports rely on Sass's `--load-path`, which is passed by the npm
-  scripts. Compiling the stylesheets with a different tool (a VS Code Sass
-  extension, for instance) will need the same load path configured.
-
-## [1.1.0] - 2026-07-21
-
-### Added
-- **Node.js backend** as an alternative to PHP, living side by side in
-  `src/backend/`: `_core/index.js` front controller (which is also the HTTP
-  server), `Response` and `RateLimiter` modules, a `mysql2` pool singleton
-  `Database.js`, `example.config.js`, and a `package.json` for the backend's
-  own dependencies. Same REST API as PHP: routing, `X-Api-Key` auth, CORS and
-  file-based rate limiting are identical.
-- **Backend choice at scaffold time**: `nib new` now asks whether to use Node.js
-  or PHP, in addition to language and CSS framework.
-- `backend/backend-node.service.example` — a ready-to-adapt **systemd** unit for
-  keeping the Node backend running on a server.
-- `config.js` is generated from `example.config.js` at scaffold time (mirroring
-  the existing `config.php` generation).
-- Deployment docs now cover running the Node backend with **`screen`** (quick /
-  small setups) and **systemd** (production), plus environment variables.
-
-### Changed
-- **Composer is now required only when the PHP backend is chosen.** If you pick
-  Node, `composer install` is skipped entirely and the backend's npm
-  dependencies (`mysql2`) are installed instead.
-- `.htaccess`, `web.config` and `nginx.conf` now cover **both** backends. On
-  nginx, `/api` goes to Node and automatically falls back to the PHP front
-  controller when Node is unreachable. On Apache/IIS the active backend is
-  selected by configuration (documented), since per-directory configs can't
-  health-check an upstream.
-- `.gitignore` now also ignores `src/backend/config.js`,
-  `src/backend/node_modules/` and `src/backend/cache/`.
-- Documentation (`README.md`, `docs/Backend.md`, `docs/Deploy.md`) updated:
-  backend examples now use JavaScript/Node as the reference, with the equivalent
-  PHP shown alongside and a note that PHP behaves identically.
-
-### Notes
-- Both backends are always scaffolded, so you can switch later without
-  re-creating the project. The PHP front controller only serves `.php` endpoint
-  files and the Node one only `.js`, so they coexist without conflict.
+# Changelog
+
+All notable changes to Nibula are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.6.1] - 2026-08-06
+
+### Fixed
+- `src/frontend/scss/pages/prova.scss` was left in the template and shipped with 1.6.0, so every new project started with a stylesheet for a page that doesn't exist — no route, no script, no entry in `pages.json`.
+- Open Graph and Twitter Card tags read `seo.title` and `seo.description` directly, with none of the fallbacks the `<title>` and meta description already had. A page that left those fields empty in `pages.json` published an empty social preview — exactly the case the fallbacks exist for. They now follow the same chain.
+- `data-theme` was missing from the `<html>` tag. It is documented as the hook to target in SCSS for theme variables, so a selector written against it never matched.
+
+## [1.6.0] - 2026-08-06
+
+### Breaking
+- Per-page settings must move out of `site.json`. Take the block under the `pages`
+  key and make it the root object of a new `src/frontend/data/pages.json`, then
+  update `base.njk`, `sitemap.njk` and `llms.njk` to read `pages[title]` instead of
+  `site.pages[title]`. Without `pages.json` the assistant reports the missing file
+  and stops.
+- SCSS and JS import paths change with the `_root`, `_global` and `global` moves.
+  Update the `@use` and `@import` lines in your page entry points accordingly.
+- Existing projects keep working until you run `npm install nibula@latest` inside
+  them: commands now delegate to the project's own copy, so an old project keeps
+  running the version it was built with.
+
+### Changed
+- **Per-page settings moved from `site.json` to a new `pages.json`.** They were nested under a `pages` key in the same file the CLI writes on every page operation; splitting them means a syntax error in one page's record no longer makes the whole site configuration unreadable. Access changes from `{{ site.pages[title] }}` to `{{ pages[title] }}`, and the CLI now reads and writes `pages.json` only.
+- Commands run inside a project now execute the project's own Nibula, taken from its `node_modules`, instead of the globally installed one. `nib cli` typed in a terminal used to run the global copy against local files, so a project scaffolded with an older version could be operated on by a newer CLI expecting a different structure. When the two versions differ, the one being used is reported before the command runs, and the assistant's title shows it as well.
+- `_root.scss` and `_global.scss` moved out of `scss/modules/`. They are not modules — every page imports them and nothing else does — so they now sit at the root of `scss/`.
+- `global.js` and `global.ts` moved out of their `modules/` folders, for the same reason.
+- Import paths updated across existing modules, pages and scaffold templates to match both moves.
+- `base.njk` applies the `url` filter to per-page CSS and JS, to the favicons and to the framework scripts. Without it these paths ignore `pathPrefix`, so every asset 404s on a site published under a subpath — GitHub Pages being the common case.
+- Documentation updated throughout for the new structure and the `site.json` / `pages.json` split.
+
+### Fixed
+- TypeScript page entry points imported modules with a `.js` extension.
+- `logo` was nested inside `legal` in `site.json`, so `{{ site.logo }}` resolved to nothing in the header, the footer, the Open Graph image and the JSON-LD publisher block. It now sits at the root, where the templates already looked for it.
+
+### Removed
+- `legal.cookieControls` from `site.json`.
+- Preconnect hint to `cdn.jsdelivr.net` in `base.njk`. The project loads its framework from `node_modules` through passthrough copy, so the hint opened a TCP and TLS connection to a host that was never used.
+
+## [1.5.3] - 2026-08-05
+
+### Fixed
+- `web.config` no longer breaks on Windows shared hosting. `ApiToNode` was the
+  first rule, so every `/api` request returned a 500: rewriting to an absolute
+  URL needs the ARR module, and the `<serverVariables>` block needs an entry in
+  `applicationHost.config` — neither is available on a shared plan. `ApiToPhp`
+  is now the default and `ApiToNode` ships commented out, with the requirements
+  spelled out above it. `<serverVariables>` is gone; on a server with ARR the
+  forwarded-protocol header is set server-side.
+- The PHP front controller looked for `404.html` only under
+  `$_SERVER['DOCUMENT_ROOT']`, which doesn't resolve to the site root on shared
+  hosting, so an unknown `/api` route returned an empty page. It now falls back
+  to the path relative to `_core`, matching how `index.js` already resolved it.
+- `Content-Type: text/html` was only sent when `404.html` existed; the plain
+  fallback went out undeclared.
+- Requesting a protected endpoint in a browser opened a credentials prompt
+  instead of showing the error. IIS attaches `WWW-Authenticate: Basic` to 401
+  responses, which the browser answers with a login dialog. It is now removed in
+  `web.config`, so the JSON envelope reaches the client as intended.
+- `httpErrors` under `backend/` is set to `PassThrough`. The site root keeps
+  `Replace` so unknown pages get `404.html`, but under `backend/` every response
+  is the API's own JSON envelope and IIS must not substitute its HTML for it.
+- `nib rename` overwrote the page's SEO title in `site.json` with one derived
+  from the new name, discarding whatever you had written. It now moves the
+  record under the new key and changes nothing else. This also fixes the rename
+  failing outright when the record's `seo` field was malformed, since the field
+  is no longer read.
+- `nib rename` rewrote `title` in the route's front matter for the same reason.
+  Only `permalink` is updated now.
+
+### Changed
+- `docs/Deploy.md` documents the new IIS default, and warns that a Node project
+  published to Windows shared hosting should leave the `backend` folder out —
+  the requests would be rewritten onto a PHP front controller the project
+  doesn't contain.
+
+## [1.5.2] - 2026-08-05
+
+### Fixed
+- `nib new` no longer creates an empty `src/frontend/routes` folder. 1.5.1
+  removed it from `CREATE_DIRS` but left it in `MANDATORY_COPY`, so it still
+  arrived from the template. It is now created on demand when the first page is
+  added, and removed again when the last one is deleted.
+
+## [1.5.1] - 2026-08-05
+
+### Fixed
+- `nib new` no longer creates an empty `routes` folder. Page source folders are
+  created on demand when a page is added, and removed again when the last page
+  in them is deleted — `routes`, `scss/pages` and the JS/TS pages folder alike.
+- Removing a page that doesn't exist reported the skip and then went on to strip
+  its entry from `site.json` and `page-components.njk` anyway. It now stops.
+- `example.config.php` was missing the `APP_ENV` key, so PHP projects had no way
+  to discover the debug switch from the template. Behaviour was unaffected —
+  the code already fell back to `production` — but the key is now visible and
+  documented, and the two templates are identical again.
+- The backend's `dev` script set `APP_ENV` as an environment variable, which
+  neither backend reads. It ran in production mode and produced no debug output.
+  The script is gone; error verbosity is set in `config.js` / `config.php`.
+- `bin/create.js` repeated the `mysql2` version already declared in
+  `src/backend/package.json`. It now reads that file, so the two cannot drift.
+- `docs/Deploy.md` pointed at `backend/backend-node.service.example`, removed in
+  1.5.0. The systemd unit is written out in full instead.
+- `docs/Deploy.md` gave the backend path as `/var/www/backend/SITE_FOLDER`,
+  inverted with respect to the rest of the document.
+
+### Changed
+- Nginx setup steps moved from the `nginx.conf` header into `docs/Deploy.md`,
+  under "Your own server". The header keeps only the three placeholders that
+  appear in the file and a pointer to the docs, so a config copied into
+  `/etc/nginx/sites-available/` no longer carries 60 lines of install
+  instructions that were already followed.
+- `docs/Deploy.md` troubleshooting is now a table, with a row for a 502 on
+  `/api` caused by the Node process not running.
+- `.eleventyignore` reduced to `src/frontend/assets/**`. The `scss`, `js` and
+  `src/backend` entries excluded nothing: the first two are not Eleventy
+  template formats and the third is outside the input directory. The last one
+  was also misleading, since `.eleventy.js` deliberately copies `src/backend`
+  into the build.
+- `docs/Backend.md` documents `APP_ENV` in its own section, including the
+  `display_errors` behaviour specific to PHP, and states explicitly that it is
+  a config key rather than an environment variable.
+
+### Notes
+- Existing projects are unaffected: the scaffolding and template changes apply
+  only to newly created ones.
+
+## [1.5.0] - 2026-08-04
+
+### Added
+- `nginx.conf` now covers **both backends** with no manual edits. `/api` is
+  proxied to Node on `127.0.0.1:3000`; if Node is unreachable, the request is
+  retried through the PHP front controller via the internal `@php_backend`
+  location. The same file works for a Node deployment and a PHP one.
+- `nginx.conf` header now documents the PHP-FPM requirement, the version-agnostic
+  socket, and the errors specific to a PHP deployment.
+
+### Changed
+- PHP is invoked through `SCRIPT_FILENAME` instead of by URL, so `.php` requests
+  keep returning 404 even on a PHP deployment and no source file is ever
+  reachable by name.
+- `fastcgi_pass` targets the version-agnostic socket `unix:/run/php/php-fpm.sock`
+  instead of a versioned path, so the config survives PHP upgrades.
+- `web.config` is now blocked anywhere in the tree, not only at the document root.
+- `docs/Backend.md` is limited to writing endpoints: routing, `public` vs
+  `protected`, the `Response` helper and configuration. Examples are Node-only,
+  with a note that PHP behaves identically. Hosting and server requirements
+  moved to `docs/Deploy.md`.
+- `docs/Deploy.md` rewritten around where a site can be published and what each
+  target requires, including why shared hosting cannot run the Node backend.
+
+### Removed
+- `docs/Nginx.md` — the setup steps live in the `nginx.conf` header, where they
+  are read at the moment they are needed.
+- `src/backend/backend-node.service.example` — the systemd unit is documented
+  in `docs/Deploy.md` instead of shipped as a file.
+
+## [1.4.0] - 2026-08-03
+
+### Changed
+- `nginx.conf` is now a complete, ready-to-use site file instead of a set of
+  directives to paste into your own `server` block. Replace three placeholders
+  (`YOUR_DOMAIN`, `SITE_FOLDER`, `YOUR_CERTIFICATE`), symlink it into
+  `sites-enabled/`, reload.
+- Nginx documentation moved from `docs/Deploy.md` to `docs/Nginx.md`;
+  `Deploy.md` now covers only where to publish, one section per server.
+
+### Added
+- HTTP → HTTPS redirect on port 80, with an optional ACME webroot block.
+- TLS setup via Let's Encrypt, with placeholders for the certificate path.
+- Security headers: `X-Content-Type-Options`, `X-Frame-Options`,
+  `Referrer-Policy`, `Strict-Transport-Security` (`max-age=300` by default).
+- `.php` requests return 404, preventing source-code leaks when php-fpm is
+  not configured.
+
+### Removed
+- **Breaking:** the automatic Node → PHP fallback on Nginx. `/api` is now
+  proxied to Node only; if the process is down, Nginx returns 502. For a PHP
+  deployment, edit the `.php` block and `try_files` as described in
+  `docs/Nginx.md`.
+
+### Migration
+Existing Nginx deployments: replace your `server` block with the new
+`nginx.conf` and fill in the three placeholders. If you relied on the PHP
+fallback, follow *Using the PHP backend* in `docs/Nginx.md`.
+
+## [1.3.0] - 2026-08-01
+
+### Added
+- A `global.js` module in `src/frontend/js/modules/`, for code that has to run
+  on every page — a header menu, a theme toggle, a cookie banner. Page entry
+  points import it once and it takes care of running the shared modules, so
+  there's no longer a line to remember in every single page.
+- `docs/Javascript.md` now covers the global module, with the header burger
+  menu as a worked example and a note on when a behaviour belongs in
+  `global.js` rather than in a page.
+
+### Changed
+- Page entry points, and the template new pages are created from, now start
+  with `import '../modules/global.js';`.
+
+### Notes
+- Existing projects keep working as they are. To adopt the global module, add
+  `src/frontend/js/modules/global.js` and the import line at the top of each
+  page entry point.
+
+## [1.2.6] - 2026-08-01
+
+### Fixed
+- The scaffolder created the routes folder as `src/frontend/_routes` instead of
+  `src/frontend/routes`. The CLI writes and looks for page templates in
+  `routes`, so on a freshly created project every page ended up outside the
+  folder Eleventy and the assistant expect.
+
+  ### Notes
+- Projects created with 1.2.5 have an empty `src/frontend/_routes` folder that
+  can be deleted. Pages created before this fix should be moved to
+  `src/frontend/routes`.
+
+## [1.2.5] - 2026-08-01
+
+### Added
+- `nib new` now refuses to run from inside an existing Nibula project. Creating
+  a project inside another one produced a broken setup, since the outer build
+  would pick up the inner project's files. The error message reports the path of
+  the project that was detected, so it's clear which one triggered the check.
+- A GitHub Actions workflow that publishes the package to npm whenever a release
+  is created, using npm's trusted publishing. The workflow verifies that the git
+  tag matches the version in `package.json` before publishing, and attaches a
+  provenance attestation to the published package.
+
+### Changed
+- Rewrote the README: added a section on when Nibula is *not* the right tool,
+  clarified that Composer is only needed with the PHP backend, and moved the
+  editor extensions from the required to the recommended prerequisites.
+
+## [1.2.4] - 2026-07-31
+
+### Changed
+- Internal refactor of `tools/`: the logic is now split across `lib/`, `cli/`
+  and `config/`, with values and messages extracted into `settings.json` and
+  `messages.json`. No behaviour changes — pages, `site.json` and
+  `page-components.njk` are written exactly as before.
+- The CLI now uses a uniform palette: colour is limited to the title box, and
+  the menu numbers are dimmed instead of each carrying its own colour.
+
+### Fixed
+- The last line of the menu never closed the `dim` colour code, which stayed
+  active on the following line.
+
+## [1.2.3] - 2026-07-29
+
+### Fixed
+- `updateOutputPath` no longer strips custom flags from `build:css` and `serve:css`: the output path is now replaced in place instead of regenerating the whole script
+- Missing `--load-path=node_modules` in the regenerated Sass scripts, which broke Bootstrap SCSS imports
+- Malformed `outDir` in `tsconfig.json` when the output path is absolute (`./c:/...`)
+
+## [1.2.2] - 2026-07-23
+
+### Added
+- **Full favicon set**: `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png`
+  (180×180, opaque) in `assets/brand/`. iOS home-screen icons no longer fall back
+  to a screenshot of the page.
+
+### Changed
+- **`data_bs_theme` renamed to `theme`** in `site.json`. It still drives
+  `data-bs-theme` on the `<html>` tag; the shorter name keeps the config readable
+  and independent from the framework naming.
+- **`theme_color` is now a single value** instead of a `light`/`dark` pair. The
+  theme is fixed per build, so two per-scheme colors could contradict the
+  rendered page.
+- **Favicon paths are hardcoded in `base.njk`.** The `favicon` key was removed
+  from `site.json`: it only ever covered one of the three tags, which was more
+  confusing than helpful. Replace the files in `assets/brand/` instead.
+- `_routes/` renamed to `routes/` — it holds entry points, not internals.
+
+### Removed
+- **`mdFile` shortcode** and the `markdown-it` dependency.
+- **`github-markdown-css`** and its two passthrough copies.
+
+### Migration
+- In `site.json`: rename `data_bs_theme` to `theme`, flatten `theme_color` to a
+  single string, drop `favicon`.
+- Place `favicon.svg`, `favicon-32.png` and `apple-touch-icon.png` in
+  `src/frontend/assets/brand/`.
+- If you used `{% mdFile %}`, render the Markdown ahead of time or add
+  `markdown-it` back to your own project.
+
+## [1.1.3] - 2026-07-22
+
+### Changed
+- **The update check no longer runs on every command.** Previously every
+  invocation of `nib` (and the `nbl` / `nibula` aliases) contacted the npm
+  registry before doing anything, adding up to 2.5s of latency to `nib run`,
+  `nib build`, `nib cli` and `nib clean`. The check now runs only for `nib new`
+  and `nib update`; all other commands work entirely offline.
+- **`nib new` now completes the update automatically.** When a newer version is
+  available and you accept the prompt, Nibula installs it and immediately
+  re-runs the scaffolding with the new version, instead of asking you to type
+  `nib new <project-name>` a second time.
+- **New projects are scaffolded at version `0.0.0`** instead of `1.0.0`, so a
+  freshly created site no longer claims a stable public release. Bump it
+  yourself as the project grows, and reach `1.0.0` when you go to production.
+- **Framework SCSS imports are now short and readable.** The framework modules
+  in `src/frontend/scss/modules/frameworks/` used a five-level relative path
+  back to `node_modules`; they now import directly by package name, e.g.
+  `@import "bootstrap/scss/card";`. This matches what the styling docs already
+  showed, and makes commenting modules out far less error-prone.
+- `nib help` no longer appends an "a newer version is available" line, since it
+  no longer performs the check.
+
+### Added
+- Internal `--skip-update-check` flag on `nib new`, set automatically when the
+  command is re-run after a self-update. It prevents a loop if the registry is
+  slow to propagate the new version.
+- `--load-path=node_modules` on the repository's own `build:css` and `serve:css`
+  scripts, so the short framework imports resolve. Generated projects already
+  carried this flag.
+
+### Fixed
+- Repaired the ASCII header boxes and the commented-out example import inside
+  `_bootstrap.scss`, `_bulma.scss` and `_foundation.scss`, where an earlier
+  find-and-replace had injected the `node_modules` path into comment text and
+  broken the alignment.
+- `src/frontend/data` is no longer copied to the output folder. It holds the
+  Eleventy global data file, which is consumed at build time to render meta
+  tags and page config — publishing it produced a dead file in `out/` and
+  exposed the full page map, including `noindex` entries. It remains a watch
+  target, so edits still trigger a rebuild.
+
+### Notes
+- If the updated installation can't be located after `npm install -g` (an
+  unusual `npm root -g` setup, for example), Nibula reports the problem and
+  asks you to re-run the command, rather than scaffolding silently with the
+  old templates.
+- Existing projects are unaffected by the version change: it applies only to
+  newly created ones.
+- Short SCSS imports rely on Sass's `--load-path`, which is passed by the npm
+  scripts. Compiling the stylesheets with a different tool (a VS Code Sass
+  extension, for instance) will need the same load path configured.
+
+## [1.1.0] - 2026-07-21
+
+### Added
+- **Node.js backend** as an alternative to PHP, living side by side in
+  `src/backend/`: `_core/index.js` front controller (which is also the HTTP
+  server), `Response` and `RateLimiter` modules, a `mysql2` pool singleton
+  `Database.js`, `example.config.js`, and a `package.json` for the backend's
+  own dependencies. Same REST API as PHP: routing, `X-Api-Key` auth, CORS and
+  file-based rate limiting are identical.
+- **Backend choice at scaffold time**: `nib new` now asks whether to use Node.js
+  or PHP, in addition to language and CSS framework.
+- `backend/backend-node.service.example` — a ready-to-adapt **systemd** unit for
+  keeping the Node backend running on a server.
+- `config.js` is generated from `example.config.js` at scaffold time (mirroring
+  the existing `config.php` generation).
+- Deployment docs now cover running the Node backend with **`screen`** (quick /
+  small setups) and **systemd** (production), plus environment variables.
+
+### Changed
+- **Composer is now required only when the PHP backend is chosen.** If you pick
+  Node, `composer install` is skipped entirely and the backend's npm
+  dependencies (`mysql2`) are installed instead.
+- `.htaccess`, `web.config` and `nginx.conf` now cover **both** backends. On
+  nginx, `/api` goes to Node and automatically falls back to the PHP front
+  controller when Node is unreachable. On Apache/IIS the active backend is
+  selected by configuration (documented), since per-directory configs can't
+  health-check an upstream.
+- `.gitignore` now also ignores `src/backend/config.js`,
+  `src/backend/node_modules/` and `src/backend/cache/`.
+- Documentation (`README.md`, `docs/Backend.md`, `docs/Deploy.md`) updated:
+  backend examples now use JavaScript/Node as the reference, with the equivalent
+  PHP shown alongside and a note that PHP behaves identically.
+
+### Notes
+- Both backends are always scaffolded, so you can switch later without
+  re-creating the project. The PHP front controller only serves `.php` endpoint
+  files and the Node one only `.js`, so they coexist without conflict.