nibula 2.4.5 → 2.4.6

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to Nibula are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.6] - 2026-08-29
+
+### Changed
+
+- Restored `404.scss` **.not-found** selector to center the not found text 
+- Removed all comments in backend files
+
 ## [2.4.5] - 2026-08-26
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nibula",
-  "version": "2.4.5",
+  "version": "2.4.6",
   "description": "A beginner-friendly static site generator built on Eleventy that stays close to vanilla HTML, CSS and JS — with a page-management CLI, an optional PHP backend, and SEO files generated for you.",
   "keywords": [
     "11ty",

package/src/backend/_core/index.js

@@ -1,267 +1,230 @@
-'use strict';
-
-/**
- * Mirror of src/backend/_core/index.php  (the front controller).
- *
- * PHP was invoked once per request by the web server through PHP-FPM. Node is
- * the server itself, so this file boots an HTTP listener and runs the exact same
- * pipeline for every request:
- *
- *   1. request parsing (strip /api prefix, split segments, reject . / ..)
- *   2. endpoint resolution (dynamic routing with subdirectories + route params)
- *   3. headers + CORS
- *   4. rate limiting
- *   5. authentication guard for protected endpoints
- *   6. dispatch to the matched endpoint file
- *
- * Endpoints keep the same authoring style as PHP: a file that receives
- * { method, requestParams, Response, ... } and calls Response.success/error.
- */
-
-const http = require('http');
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
-const { createResponse, HALT } = require('./modules/Response');
-const RateLimiter = require('./modules/RateLimiter');
-const { loadConfig, handleException } = require('./init');
+"use strict";
+
+const http = require("http");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+const { createResponse, HALT } = require("./modules/Response");
+const RateLimiter = require("./modules/RateLimiter");
+const { loadConfig, handleException } = require("./init");
 
 const CORE_PATH = __dirname;
 
-// Load configuration once (init.php loaded it per invocation; here per process).
 const config = loadConfig();
 
-// Environment: mirror the display_errors toggle by picking the debug flag.
-const APP_ENV = config.APP_ENV || 'production';
+const APP_ENV = config.APP_ENV || "production";
 
-// Where to look for the 404.html generated by the static build.
-// In a Nibula build the backend lives at out/backend/, so the site root (out/)
-// is two levels up from _core. We default to that, so 404.html is found without
-// any extra configuration; override with the DOCUMENT_ROOT env var if needed.
-// (equivalent of $_SERVER['DOCUMENT_ROOT'] in the PHP front controller).
-const DOCUMENT_ROOT = process.env.DOCUMENT_ROOT || path.join(CORE_PATH, '..', '..');
+const DOCUMENT_ROOT =
+  process.env.DOCUMENT_ROOT || path.join(CORE_PATH, "..", "..");
 
-const basePublic = path.join(CORE_PATH, '..', 'api', 'public');
-const baseProtected = path.join(CORE_PATH, '..', 'api', 'protected');
+const basePublic = path.join(CORE_PATH, "..", "api", "public");
+const baseProtected = path.join(CORE_PATH, "..", "api", "protected");
 
-/**
- * hash_equals equivalent: constant-time string comparison, safe on unequal
- * lengths (timingSafeEqual throws if buffers differ in length).
- */
 function hashEquals(known, given) {
-    const a = Buffer.from(String(known));
-    const b = Buffer.from(String(given));
-    if (a.length !== b.length) {
-        return false;
-    }
-    return crypto.timingSafeEqual(a, b);
+  const a = Buffer.from(String(known));
+  const b = Buffer.from(String(given));
+  if (a.length !== b.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(a, b);
 }
 
-/** Serve the static 404 page if available, else a plain fallback. */
 function send404(res) {
-    res.statusCode = 404;
-    const errorPage = DOCUMENT_ROOT ? path.join(DOCUMENT_ROOT, '404.html') : '';
-    if (errorPage && fs.existsSync(errorPage)) {
-        res.setHeader('Content-Type', 'text/html; charset=UTF-8');
-        res.end(fs.readFileSync(errorPage));
-    } else {
-        res.setHeader('Content-Type', 'text/html; charset=UTF-8');
-        res.end('<h1>404 Not Found</h1>The requested URL was not found on this server.');
-    }
+  res.statusCode = 404;
+  const errorPage = DOCUMENT_ROOT ? path.join(DOCUMENT_ROOT, "404.html") : "";
+  if (errorPage && fs.existsSync(errorPage)) {
+    res.setHeader("Content-Type", "text/html; charset=UTF-8");
+    res.end(fs.readFileSync(errorPage));
+  } else {
+    res.setHeader("Content-Type", "text/html; charset=UTF-8");
+    res.end(
+      "<h1>404 Not Found</h1>The requested URL was not found on this server.",
+    );
+  }
 }
 
-/** Read and JSON-parse the request body (available to endpoints as ctx.body). */
 function readBody(req) {
-    return new Promise((resolve) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf8');
-            if (!raw) return resolve({ raw: '', json: null });
-            let json = null;
-            try { json = JSON.parse(raw); } catch (e) { json = null; }
-            resolve({ raw, json });
-        });
-        req.on('error', () => resolve({ raw: '', json: null }));
+  return new Promise((resolve) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if (!raw) return resolve({ raw: "", json: null });
+      let json = null;
+      try {
+        json = JSON.parse(raw);
+      } catch (e) {
+        json = null;
+      }
+      resolve({ raw, json });
     });
+    req.on("error", () => resolve({ raw: "", json: null }));
+  });
 }
 
 async function handleRequest(req, res) {
-    const Response = createResponse(res);
+  const Response = createResponse(res);
+
+  try {
+    const method = req.method;
+    const parsedUrl = new URL(req.url, "http://localhost");
+    let uri = parsedUrl.pathname;
+
+    uri = uri.replace(/^\/api/, "");
+    uri = uri.replace(/\/+$/, "");
+    if (uri === "") uri = "/";
+
+    const parts = uri.split("/").filter((p) => p !== "");
+
+    for (const part of parts) {
+      if (part === ".." || part === ".") {
+        Response.error("Bad Request", 400);
+      }
+    }
+
+    let endpointFile = null;
+    let isProtected = false;
+
+    const checkParts = parts.slice();
+    const params = [];
+
+    while (checkParts.length > 0) {
+      const relativePath = checkParts.join("/") + ".js";
+
+      const publicCandidate = path.join(basePublic, relativePath);
+      if (fs.existsSync(publicCandidate)) {
+        endpointFile = publicCandidate;
+        isProtected = false;
+        break;
+      }
 
+      const protectedCandidate = path.join(baseProtected, relativePath);
+      if (fs.existsSync(protectedCandidate)) {
+        endpointFile = protectedCandidate;
+        isProtected = true;
+        break;
+      }
+
+      params.unshift(checkParts.pop());
+    }
+
+    if (!endpointFile) {
+      send404(res);
+      return;
+    }
+
+    const base = isProtected ? baseProtected : basePublic;
+    let endpointPath = endpointFile
+      .split(path.sep)
+      .join("/")
+      .replace(base.split(path.sep).join("/"), "")
+      .replace(/\.js$/, "")
+      .replace(/^\//, "");
+
+    res.setHeader("Content-Type", "application/json; charset=UTF-8");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+    res.setHeader(
+      "Access-Control-Allow-Methods",
+      "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+    );
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Api-Key");
+
+    const originsForEndpoint =
+      (config.CUSTOM_ENDPOINT_ORIGINS &&
+        config.CUSTOM_ENDPOINT_ORIGINS[endpointPath]) ||
+      config.GENERAL_ALLOWED_ORIGINS ||
+      [];
+
+    const origin = req.headers["origin"] || "";
+
+    if (origin !== "" && originsForEndpoint.includes(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+    } else if (originsForEndpoint.includes("*")) {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    }
+
+    if (method === "OPTIONS") {
+      res.statusCode = 204;
+      res.end();
+      return;
+    }
+
+    // Rate limit: 60 requests / 60 seconds per IP
+    const ip =
+      (req.headers["x-forwarded-for"] || "").split(",")[0].trim() ||
+      req.socket.remoteAddress ||
+      "";
+    RateLimiter.check(ip, 60, 60, Response, res);
+
+    if (isProtected) {
+      const validKey =
+        (config.CUSTOM_ENDPOINT_KEYS &&
+          config.CUSTOM_ENDPOINT_KEYS[endpointPath]) ||
+        config.GENERAL_API_KEY ||
+        "";
+      const apiKey = req.headers["x-api-key"] || "";
+
+      if (validKey === "" || !hashEquals(validKey, apiKey)) {
+        Response.error("Unauthorized. X_API_KEY is incorrect or missing", 403);
+      }
+    }
+
+    const handler = require(endpointFile);
+
+    const context = {
+      method, // HTTP method
+      requestParams: params, // leftover URL segments (route params)
+      Response, // request-bound Response helper
+      query: Object.fromEntries(parsedUrl.searchParams), // parsed query string
+      body: body.json, // parsed JSON body (or null)
+      rawBody: body.raw, // raw body string
+      headers: req.headers,
+      req,
+      res,
+      config,
+      CORE_PATH,
+    };
+
+    await handler(context);
+
+    if (!res.writableEnded) {
+      res.end();
+    }
+  } catch (err) {
+    if (err === HALT) {
+      return;
+    }
     try {
-        // =====================================================
-        // 1. REQUEST PARSING
-        // =====================================================
-        const method = req.method;
-        const parsedUrl = new URL(req.url, 'http://localhost');
-        let uri = parsedUrl.pathname;
-
-        // Strip a leading /api, then trim trailing slash (rtrim(..., '/') ?: '/').
-        uri = uri.replace(/^\/api/, '');
-        uri = uri.replace(/\/+$/, '');
-        if (uri === '') uri = '/';
-
-        const parts = uri.split('/').filter((p) => p !== '');
-
-        for (const part of parts) {
-            if (part === '..' || part === '.') {
-                Response.error('Bad Request', 400);
-            }
-        }
-
-        // =====================================================
-        // 2. ENDPOINT RESOLUTION (ROUTING WITH SUBDIRECTORIES)
-        // =====================================================
-        let endpointFile = null;
-        let isProtected = false;
-
-        const checkParts = parts.slice();
-        const params = [];
-
-        while (checkParts.length > 0) {
-            const relativePath = checkParts.join('/') + '.js';
-
-            const publicCandidate = path.join(basePublic, relativePath);
-            if (fs.existsSync(publicCandidate)) {
-                endpointFile = publicCandidate;
-                isProtected = false;
-                break;
-            }
-
-            const protectedCandidate = path.join(baseProtected, relativePath);
-            if (fs.existsSync(protectedCandidate)) {
-                endpointFile = protectedCandidate;
-                isProtected = true;
-                break;
-            }
-
-            // No match: peel the last segment as a route param and retry.
-            params.unshift(checkParts.pop());
-        }
-
-        // No endpoint → HTML 404 page.
-        if (!endpointFile) {
-            send404(res);
-            return;
-        }
-
-        // Compute the endpoint path (relative, without extension) used as the key
-        // for CUSTOM_ENDPOINT_KEYS / CUSTOM_ENDPOINT_ORIGINS.
-        const base = isProtected ? baseProtected : basePublic;
-        let endpointPath = endpointFile
-            .split(path.sep).join('/')
-            .replace(base.split(path.sep).join('/'), '')
-            .replace(/\.js$/, '')
-            .replace(/^\//, '');
-
-        // =====================================================
-        // 3. HEADERS AND CORS (only if the endpoint exists)
-        // =====================================================
-        res.setHeader('Content-Type', 'application/json; charset=UTF-8');
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('X-Frame-Options', 'DENY');
-        res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Api-Key');
-
-        const originsForEndpoint =
-            (config.CUSTOM_ENDPOINT_ORIGINS && config.CUSTOM_ENDPOINT_ORIGINS[endpointPath]) ||
-            config.GENERAL_ALLOWED_ORIGINS ||
-            [];
-
-        const origin = req.headers['origin'] || '';
-
-        if (origin !== '' && originsForEndpoint.includes(origin)) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-            res.setHeader('Vary', 'Origin');
-        } else if (originsForEndpoint.includes('*')) {
-            res.setHeader('Access-Control-Allow-Origin', '*');
-        }
-
-        if (method === 'OPTIONS') {
-            res.statusCode = 204;
-            res.end();
-            return;
-        }
-
-        // Rate limit: 60 requests / 60 seconds per IP (same defaults as PHP).
-        const ip = (req.headers['x-forwarded-for'] || '').split(',')[0].trim()
-            || req.socket.remoteAddress
-            || '';
-        RateLimiter.check(ip, 60, 60, Response, res);
-
-        // =====================================================
-        // 4. AUTHENTICATION GUARD
-        // =====================================================
-        if (isProtected) {
-            const validKey =
-                (config.CUSTOM_ENDPOINT_KEYS && config.CUSTOM_ENDPOINT_KEYS[endpointPath]) ||
-                config.GENERAL_API_KEY ||
-                '';
-            const apiKey = req.headers['x-api-key'] || '';
-
-            if (validKey === '' || !hashEquals(validKey, apiKey)) {
-                Response.error('Unauthorized. X_API_KEY is incorrect or missing', 403);
-            }
-        }
-
-        // =====================================================
-        // 5. DISPATCH
-        // =====================================================
-        const body = await readBody(req);
-
-        // eslint-disable-next-line import/no-dynamic-require, global-require
-        const handler = require(endpointFile);
-
-        const context = {
-            method,               // HTTP method
-            requestParams: params, // leftover URL segments (route params)
-            Response,             // request-bound Response helper
-            query: Object.fromEntries(parsedUrl.searchParams), // parsed query string
-            body: body.json,      // parsed JSON body (or null)
-            rawBody: body.raw,    // raw body string
-            headers: req.headers,
-            req,
-            res,
-            config,
-            CORE_PATH,
-        };
-
-        await handler(context);
-
-        // If the endpoint returned without sending a response, mirror PHP's
-        // implicit end of script: nothing more to do. Close if still open.
-        if (!res.writableEnded) {
-            res.end();
-        }
-    } catch (err) {
-        if (err === HALT) {
-            // A response was already sent; unwind quietly (≈ PHP exit).
-            return;
-        }
-        // set_exception_handler equivalent: any real error → 500.
-        try {
-            handleException(err, config, Response);
-        } catch (inner) {
-            if (inner === HALT) return;
-            if (!res.writableEnded) {
-                res.statusCode = 500;
-                res.end(JSON.stringify({ status: 'error', message: 'Internal server error', code: 500 }));
-            }
-        }
+      handleException(err, config, Response);
+    } catch (inner) {
+      if (inner === HALT) return;
+      if (!res.writableEnded) {
+        res.statusCode = 500;
+        res.end(
+          JSON.stringify({
+            status: "error",
+            message: "Internal server error",
+            code: 500,
+          }),
+        );
+      }
     }
+  }
 }
 
-const HOST = process.env.HOST || '127.0.0.1';
-const PORT = parseInt(process.env.PORT || '3000', 10);
+const HOST = process.env.HOST || "127.0.0.1";
+const PORT = parseInt(process.env.PORT || "3000", 10);
 
 const server = http.createServer(handleRequest);
 
 server.listen(PORT, HOST, () => {
-    // eslint-disable-next-line no-console
-    console.log(`[backend-node] listening on http://${HOST}:${PORT} (env: ${APP_ENV})`);
+  console.log(
+    `[backend-node] listening on http://${HOST}:${PORT} (env: ${APP_ENV})`,
+  );
 });
 
 module.exports = server;

package/src/backend/_core/index.php

@@ -5,16 +5,9 @@ declare(strict_types=1);
 define('CORE_ACCESS', true);
 define('CORE_PATH', __DIR__);
 
-/**
- * Load dependencies and initial configuration.
- */
 require_once __DIR__ . '/init.php';
 require_once __DIR__ . '/modules/Response.php';
 
-// =====================================================
-// 1. REQUEST PARSING
-// =====================================================
-
 $method = $_SERVER['REQUEST_METHOD'];
 $uri    = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
 
@@ -27,26 +20,15 @@ foreach ($parts as $part) {
     }
 }
 
-// =====================================================
-// 2. ENDPOINT RESOLUTION (ROUTING WITH SUBDIRECTORIES)
-// =====================================================
-
 $basePublic    = __DIR__ . '/../api/public/';
 $baseProtected = __DIR__ . '/../api/protected/';
 
 $endpointFile  = null;
 $isProtected   = false;
 $requestParams = [];
-
-// Temporary variables for the lookup loop
 $checkParts = $parts;
 $params     = [];
 
-/**
- * Dynamic routing logic: find the deepest matching endpoint file.
- * At each iteration, the last URL segment is peeled off and stored
- * as a route parameter until a matching file is found.
- */
 while (count($checkParts) > 0) {
     $relativePath = implode('/', $checkParts) . '.php';
 
@@ -57,30 +39,19 @@ while (count($checkParts) > 0) {
         break;
     }
 
-    // Then check whether this is a protected route
     if (file_exists($baseProtected . $relativePath)) {
         $endpointFile = $baseProtected . $relativePath;
         $isProtected  = true;
         break;
     }
 
-    // No file matched: treat the last segment as a route parameter and try again
     array_unshift($params, array_pop($checkParts));
 }
 
-/**
- * IF THE ENDPOINT DOES NOT EXIST, RETURN AN HTML 404 PAGE.
- */
 if (!$endpointFile) {
     http_response_code(404);
     header_remove('WWW-Authenticate');
 
-    /**
-     * In a Nibula build the backend lives at out/backend/, so the site root
-     * (out/) is two levels up from _core. DOCUMENT_ROOT is preferred when it
-     * resolves, but on shared hosting it often points elsewhere, so the
-     * relative path is used as a fallback. Same resolution as index.js.
-     */
     $documentRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
     $errorPage    = $documentRoot . '/404.html';
 
@@ -104,10 +75,6 @@ $base         = str_replace('\\', '/', $base);
 $endpointPath = str_replace('\\', '/', $endpointFile);
 $endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
 
-// =====================================================
-// 3. HEADERS AND CORS (Only if the endpoint exists)
-// =====================================================
-
 header('Content-Type: application/json; charset=UTF-8');
 header_remove('WWW-Authenticate');
 header('X-Content-Type-Options: nosniff');
@@ -137,10 +104,6 @@ if ($method === 'OPTIONS') {
 require_once __DIR__ . '/modules/RateLimiter.php';
 RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
 
-// =====================================================
-// 4. AUTHENTICATION GUARD
-// =====================================================
-
 if ($isProtected) {
     $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
     $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
@@ -150,12 +113,6 @@ if ($isProtected) {
     }
 }
 
-// =====================================================
-// 5. DISPATCH
-// =====================================================
-
-// Parameters are the remaining URL segments not consumed during endpoint resolution
 $requestParams = $params;
 
-// Load and execute the matched endpoint file
 require $endpointFile;

package/src/backend/_core/init.js

@@ -1,37 +1,17 @@
-'use strict';
+"use strict";
 
-/**
- * Mirror of src/backend/_core/init.php
- *
- * init.php did three things:
- *   1. registered a global exception handler that turns any throwable into a
- *      500 JSON response (verbose in debug, generic in production);
- *   2. registered an error handler that promoted PHP warnings to exceptions;
- *   3. loaded config.php.
- *
- * In Node there is no per-request global handler, so the exception-to-500
- * translation lives in the front controller (index.js), which calls
- * handleException() below. Here we expose config loading and that helper.
- */
-
-const fs = require('fs');
-const path = require('path');
+const fs = require("fs");
+const path = require("path");
 
-/**
- * Load configuration. dirname(__dirname) in PHP pointed at the folder holding
- * config.php (the backend root). Here that is the parent of _core.
- * If config.js is missing (e.g. fresh clone) we fall back to example.config.js,
- * mirroring the "copy example.config to config" guidance.
- */
 function loadConfig() {
-    const backendRoot = path.join(__dirname, '..');
-    const configPath = path.join(backendRoot, 'config.js');
-    const examplePath = path.join(backendRoot, 'example.config.js');
+  const backendRoot = path.join(__dirname, "..");
+  const configPath = path.join(backendRoot, "config.js");
+  const examplePath = path.join(backendRoot, "example.config.js");
 
-    if (fs.existsSync(configPath)) {
-        return require(configPath);
-    }
-    return require(examplePath);
+  if (fs.existsSync(configPath)) {
+    return require(configPath);
+  }
+  return require(examplePath);
 }
 
 /**
@@ -41,12 +21,12 @@ function loadConfig() {
  * @param {object} Response request-bound helper
  */
 function handleException(exception, config, Response) {
-    const isDebug = (config.APP_ENV || 'production') !== 'production';
-    Response.error(
-        isDebug ? exception.message : 'Internal server error',
-        500,
-        isDebug ? { stack: exception.stack } : null
-    );
+  const isDebug = (config.APP_ENV || "production") !== "production";
+  Response.error(
+    isDebug ? exception.message : "Internal server error",
+    500,
+    isDebug ? { stack: exception.stack } : null,
+  );
 }
 
 module.exports = { loadConfig, handleException };

package/src/backend/_core/init.php

@@ -5,7 +5,6 @@ declare(strict_types=1);
 require_once __DIR__ . '/vendor/autoload.php';
 require_once __DIR__ . '/modules/Response.php';
 
-// --- GESTORE GLOBALE ERRORI E ECCEZIONI ---
 set_exception_handler(function ($exception) use (&$config) {
     $isDebug = ($config['APP_ENV'] ?? 'production') !== 'production';
     Response::error(
@@ -20,11 +19,8 @@ set_error_handler(function ($severity, $message, $file, $line) {
     throw new ErrorException($message, 0, $severity, $file, $line);
 });
 
-// --- CARICAMENTO CONFIGURAZIONE ---
-// dirname(__DIR__) punta alla cartella /api/ dove ora si trova config.php
 $config = require dirname(__DIR__) . '/config.php';
 
-// --- CONFIGURAZIONE AMBIENTE ---
 if (($config['APP_ENV'] ?? 'production') === 'production') {
     ini_set('display_errors', '0');
     error_reporting(0);

package/src/backend/_core/modules/RateLimiter.js

@@ -1,58 +1,47 @@
-'use strict';
+"use strict";
 
-/**
- * Mirror of src/backend/_core/modules/RateLimiter.php
- *
- * Same algorithm and same on-disk format: one JSON file per IP under ../../cache,
- * holding an array of request timestamps. Old timestamps outside the window are
- * pruned, the current one appended, and if the count exceeds the limit a 429 is
- * returned (with a Retry-After header) through the request-bound Response helper.
- */
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
 
 class RateLimiter {
-    /**
-     * @param {string} ip
-     * @param {number} maxRequests
-     * @param {number} windowSeconds
-     * @param {object} Response  request-bound helper from createResponse(res)
-     * @param {object} res       raw http response (to set Retry-After)
-     */
-    static check(ip, maxRequests = 60, windowSeconds = 60, Response, res) {
-        const cacheDir = path.join(__dirname, '..', '..', 'cache');
-
-        if (!fs.existsSync(cacheDir)) {
-            fs.mkdirSync(cacheDir, { recursive: true, mode: 0o755 });
-        }
-
-        const hash = crypto.createHash('md5').update(ip).digest('hex');
-        const cacheFile = path.join(cacheDir, 'rl_' + hash + '.json');
-        const now = Math.floor(Date.now() / 1000);
-        let data = [];
-
-        if (fs.existsSync(cacheFile)) {
-            try {
-                data = JSON.parse(fs.readFileSync(cacheFile, 'utf8')) || [];
-            } catch (e) {
-                data = [];
-            }
-        }
-
-        data = data.filter((ts) => ts > (now - windowSeconds));
-        data.push(now);
-
-        // LOCK_EX equivalent: an exclusive write. Node's writeFileSync is atomic
-        // enough for this single-process model.
-        fs.writeFileSync(cacheFile, JSON.stringify(data));
-
-        if (data.length > maxRequests) {
-            res.setHeader('Retry-After', String(windowSeconds));
-            Response.error('Too Many Requests', 429);
-        }
+  /**
+   * @param {string} ip
+   * @param {number} maxRequests
+   * @param {number} windowSeconds
+   * @param {object} Response  request-bound helper from createResponse(res)
+   * @param {object} res       raw http response (to set Retry-After)
+   */
+  static check(ip, maxRequests = 60, windowSeconds = 60, Response, res) {
+    const cacheDir = path.join(__dirname, "..", "..", "cache");
+
+    if (!fs.existsSync(cacheDir)) {
+      fs.mkdirSync(cacheDir, { recursive: true, mode: 0o755 });
+    }
+
+    const hash = crypto.createHash("md5").update(ip).digest("hex");
+    const cacheFile = path.join(cacheDir, "rl_" + hash + ".json");
+    const now = Math.floor(Date.now() / 1000);
+    let data = [];
+
+    if (fs.existsSync(cacheFile)) {
+      try {
+        data = JSON.parse(fs.readFileSync(cacheFile, "utf8")) || [];
+      } catch (e) {
+        data = [];
+      }
+    }
+
+    data = data.filter((ts) => ts > now - windowSeconds);
+    data.push(now);
+
+    fs.writeFileSync(cacheFile, JSON.stringify(data));
+
+    if (data.length > maxRequests) {
+      res.setHeader("Retry-After", String(windowSeconds));
+      Response.error("Too Many Requests", 429);
     }
+  }
 }
 
 module.exports = RateLimiter;

package/src/backend/_core/modules/Response.js

@@ -1,59 +1,46 @@
-'use strict';
+"use strict";
 
-/**
- * Mirror of src/backend/_core/modules/Response.php
- *
- * In PHP the Response helper writes JSON and calls exit() to stop execution.
- * Node has no per-request exit, so each method writes to the response and then
- * throws the HALT sentinel. The front controller catches HALT and stops the
- * dispatch, reproducing the same "the endpoint stops here" behaviour.
- *
- * A fresh, response-bound helper is created per request via createResponse(res)
- * so overlapping async requests never clash (PHP was process-per-request).
- */
-
-// Sentinel thrown to unwind execution after a response has been sent (≈ PHP exit).
-const HALT = Symbol('RESPONSE_HALT');
+const HALT = Symbol("RESPONSE_HALT");
 
 function jsonEncode(obj) {
-    // JSON.stringify already leaves unicode unescaped and does not escape slashes,
-    // matching PHP's JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES.
-    return JSON.stringify(obj);
+  return JSON.stringify(obj);
 }
 
 function createResponse(res) {
-    return {
-        success(data = null, code = 200) {
-            res.statusCode = code;
-            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
-            res.end(jsonEncode({
-                status: 'success',
-                data: data,
-            }));
-            throw HALT;
-        },
+  return {
+    success(data = null, code = 200) {
+      res.statusCode = code;
+      res.setHeader("Content-Type", "application/json; charset=UTF-8");
+      res.end(
+        jsonEncode({
+          status: "success",
+          data: data,
+        }),
+      );
+      throw HALT;
+    },
 
-        error(message, code = 400, details = null) {
-            res.statusCode = code;
-            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
-            const body = {
-                status: 'error',
-                message: message,
-                code: code,
-            };
-            if (details !== null) {
-                body.details = details;
-            }
-            res.end(jsonEncode(body));
-            throw HALT;
-        },
+    error(message, code = 400, details = null) {
+      res.statusCode = code;
+      res.setHeader("Content-Type", "application/json; charset=UTF-8");
+      const body = {
+        status: "error",
+        message: message,
+        code: code,
+      };
+      if (details !== null) {
+        body.details = details;
+      }
+      res.end(jsonEncode(body));
+      throw HALT;
+    },
 
-        noContent() {
-            res.statusCode = 204;
-            res.end();
-            throw HALT;
-        },
-    };
+    noContent() {
+      res.statusCode = 204;
+      res.end();
+      throw HALT;
+    },
+  };
 }
 
 module.exports = { createResponse, HALT };

package/src/backend/api/protected/example-protected.js

@@ -1,23 +1,16 @@
-'use strict';
-
-/**
- * Mirror of src/backend/api/protected/example-protected.php
- *
- * Protected endpoint: the API key check (X-Api-Key header) runs automatically in
- * the front controller before this file is loaded, so here we just handle logic.
- */
+"use strict";
 
 module.exports = ({ method, requestParams, Response }) => {
-    if (method !== 'GET') {
-        Response.error('Method not allowed', 405);
-    }
+  if (method !== "GET") {
+    Response.error("Method not allowed", 405);
+  }
 
-    //
-    // Your endpoint logic here. You can access route parameters in requestParams
-    //
+  //
+  // Your endpoint logic here. You can access route parameters in requestParams
+  //
 
-    Response.success({
-        message: 'Protected endpoint is working',
-        params: requestParams,
-    });
+  Response.success({
+    message: "Protected endpoint is working",
+    params: requestParams,
+  });
 };

package/src/backend/api/public/example-public.js

@@ -1,24 +1,16 @@
-'use strict';
-
-/**
- * Mirror of src/backend/api/public/example-public.php
- *
- * Public endpoint: no API key required. Receives the request context and calls
- * the request-bound Response helper, exactly like the PHP file used the global
- * Response class and $method / $requestParams.
- */
+"use strict";
 
 module.exports = ({ method, requestParams, Response }) => {
-    if (method !== 'GET') {
-        Response.error('Method not allowed', 405);
-    }
+  if (method !== "GET") {
+    Response.error("Method not allowed", 405);
+  }
 
-    //
-    // Your endpoint logic here. You can access route parameters in requestParams
-    //
+  //
+  // Your endpoint logic here. You can access route parameters in requestParams
+  //
 
-    Response.success({
-        message: 'Public endpoint is working',
-        params: requestParams,
-    });
+  Response.success({
+    message: "Public endpoint is working",
+    params: requestParams,
+  });
 };

package/src/backend/database/Database.js

@@ -1,19 +1,5 @@
 'use strict';
 
-/**
- * Mirror of src/backend/database/Database.php
- *
- * PDO singleton → a single shared mysql2 connection pool. Config is read from
- * ../config.js (same relative location as the PHP version's ../config.php).
- * Options map the PDO attributes as closely as mysql2 allows:
- *   - ERRMODE_EXCEPTION      → mysql2 rejects/throws on error by default
- *   - FETCH_ASSOC            → rowsAsArray:false (objects keyed by column) is default
- *   - EMULATE_PREPARES false → native prepared statements via pool.execute()
- *
- * Requires the "mysql2" package (npm install mysql2). getInstance() returns the
- * promise-based pool; use pool.execute(sql, params) for prepared statements.
- */
-
 const path = require('path');
 
 let instance = null;
@@ -21,11 +7,8 @@ let instance = null;
 class Database {
     static getInstance() {
         if (instance === null) {
-            // Lazy require so the backend boots even without a DB configured.
-            // eslint-disable-next-line global-require
             const mysql = require('mysql2/promise');
 
-            // eslint-disable-next-line global-require
             const config = require(path.join(__dirname, '..', 'config.js'));
 
             instance = mysql.createPool({

package/src/backend/example.config.js

@@ -1,37 +1,36 @@
-'use strict';
+"use strict";
 
 /**
  * Mirror of src/backend/example.config.php
  *
- * Versioned, secret-free template. On setup, copy this file to config.js and
- * fill in real values. config.js is git-ignored and stays local.
+ * Copy this file to config.js and fill in real values. config.js is git-ignored and stays local.
  */
 
 module.exports = {
-    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
-    GENERAL_API_KEY: 'DEFAULT_KEY',
+  // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
+  GENERAL_API_KEY: "DEFAULT_KEY",
 
-    // If you want to restrict access to protected endpoints to specific clients, define custom keys per endpoint.
-    // For subfolder endpoints, use the relative path ('subfolder/endpoint')
-    CUSTOM_ENDPOINT_KEYS: {
-        'subfolder/example-protected': 'custom-key',
-    },
+  // If you want to restrict access to protected endpoints to specific clients, define custom keys per endpoint.
+  // For subfolder endpoints, use the relative path ('subfolder/endpoint')
+  CUSTOM_ENDPOINT_KEYS: {
+    "subfolder/example-protected": "custom-key",
+  },
 
-    GENERAL_ALLOWED_ORIGINS: [
-        '*',
-        // 'https://example.com',
-    ],
+  GENERAL_ALLOWED_ORIGINS: [
+    "*",
+    // 'https://example.com',
+  ],
 
-    CUSTOM_ENDPOINT_ORIGINS: {
-        'subfolder/example-protected': ['https://app.example.com'],
-    },
+  CUSTOM_ENDPOINT_ORIGINS: {
+    "subfolder/example-protected": ["https://app.example.com"],
+  },
 
-    // Database configuration
-    DB_HOST: '127.0.0.1',
-    DB_NAME: 'example_db',
-    DB_USER: 'root',
-    DB_PASS: '',
+  // Database configuration
+  DB_HOST: "127.0.0.1",
+  DB_NAME: "example_db",
+  DB_USER: "root",
+  DB_PASS: "",
 
-    // Environment: 'production' hides error details; anything else = debug.
-    APP_ENV: 'production',
+  // Environment: 'production' hides error details; anything else = debug.
+  APP_ENV: "production",
 };

package/src/backend/example.config.php

@@ -2,10 +2,9 @@
 declare(strict_types=1);
 
 /**
- * Mirror of src/backend/example.config.js
+ * Mirror of src/backend/example.config.php
  *
- * Versioned, secret-free template. On setup, copy this file to config.php and
- * fill in real values. config.php is git-ignored and stays local.
+ * Copy this file to config.php and fill in real values. config.php is git-ignored and stays local.
  */
 
 return [

package/src/frontend/scss/pages/404.scss

@@ -8,6 +8,11 @@
 // @import "../modules/moduleName";
 
 // Add any custom rule specific to this page below:
-// body {
-//     background-color: root.$custom-color;
-// }
+.not-found {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  align-items: center;
+  min-height: 60vh;
+  text-align: center;
+}