nibula 2.4.7 → 3.0.0

package/.eleventy.js

@@ -109,13 +109,6 @@ module.exports = function (eleventyConfig) {
     "node_modules/bootstrap/dist/js/bootstrap.bundle.min.js": "js/bootstrap.bundle.min.js",
     "node_modules/bootstrap-icons/font/fonts": "css/fonts",
 
-    // Foundation
-    // "node_modules/foundation-sites/dist/js/foundation.min.js": "js/foundation.min.js",
-
-    // UIkit
-    // "node_modules/uikit/dist/js/uikit.min.js": "js/uikit.min.js",
-    // "node_modules/uikit/dist/js/uikit-icons.min.js": "js/uikit-icons.min.js",
-
     // Bulma — CSS only, no JS passthrough needed
   });
 

package/CHANGELOG.md

@@ -5,6 +5,52 @@ All notable changes to Nibula are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-09-14
+
+### Added
+- Endpoints now export one function per HTTP method instead of checking the method by hand. Unsupported methods get an automatic 405, and the file itself shows at a glance which methods it answers. The old single-function form still works.
+- A `Validate` module with `required`, `integer`, `email` and `minLength`. Each rule either returns the value or stops the request with a 422 and a readable message, so endpoints no longer repeat the same checks.
+- Endpoints receive `query`, `body`, `rawBody` and `headers` in both backends. The PHP side previously left the body to the endpoint, which meant every project reimplemented the same `json_decode`.
+- A `Debug-Mode` header on every response when `APP_ENV` is not `production`, so a site left in debug mode is visible without reading the config.
+
+### Changed
+- **BREAKING** Renamed `src/backend/_core` to `src/backend/core`. The underscore prefix carried no meaning: no tool interpreted it, it only made the path noisier than its siblings.
+- **BREAKING** Renamed `src/backend/api` to `src/backend/endpoints`. The folder holds route files, while `/api` is the public URL prefix, and using one name for two concepts was the main source of confusion when reading the front controller. Endpoints are still reached at `domain/api/endpoint`.
+- **BREAKING** A missing API key now returns 401 instead of 403. The previous code said "forbidden" for a request that was never authenticated.
+- **BREAKING** The backend no longer starts without `config.js` or `config.php`. It used to fall back to the example file, which ships a publicly known API key and allows every origin.
+- **BREAKING** The bundled `nginx.conf`, `.htaccess` and `web.config` now point at `backend/core` instead of `backend/_core`. Any custom server rule referring to the old path needs updating.
+- **BREAKING** Removed the `build-js` command. Projects now call `esbuild` directly in their `build:js` and `serve:js` scripts, with the entry pattern written out in full. `nib` is for the commands it offers, not a wrapper around the build.
+- **BREAKING** The global stylesheet is loaded by the layout instead of being imported by each page. `_global.scss` is now `global.scss`, so Sass compiles it into `out/css/global.css`, and `base.njk` links it before the page's own file. Until now every page's CSS carried a full copy of the framework and of every module, so a visitor reading three pages downloaded the same thing three times with no way to cache it.
+- **BREAKING** Page stylesheets no longer start with `@import "../global"`. A new page opens with the `@use "../root"` line and nothing else, since everything shared now arrives from the layout.
+- **BREAKING** Removed Foundation and UIkit from the frameworks offered at project creation. Four libraries covering the same ground made the choice harder without covering a case the other two miss, and each one carried a module file, a set of markers and a dependency in every project.
+- Endpoints only receive the documented request values. They previously saw every local variable of the front controller by accident, which made internal renames a breaking change without anyone noticing.
+- `RateLimiter` is now created per request like `Response`, instead of taking the response helpers as trailing arguments.
+- The PHP backend removes the `X-Powered-By` header, which exposed the exact PHP version on every response.
+- `Response.php` no longer carries its own access guard and 404 fallback. Every request already goes through the front controller, so the guard could never fire, and it duplicated error-page logic inside a module that only formats responses.
+- Removed the `glob` dependency from new projects. It existed only to expand the entry pattern before handing it to esbuild, which expands it by itself.
+
+### Fixed
+- A custom endpoint key or origin list set to an empty value no longer falls back to the general one.
+- The PHP exception handler no longer captures the config before it exists, which used to hide the real cause of startup errors behind a generic 500.
+
+### Notes
+- **To migrate the stylesheets:** rename `_global.scss` to `global.scss`, remove `@import "../global"` from every file in `scss/pages/`, and add the global stylesheet link to `base.njk` above the page one.
+- **`nib build-js` no longer exists.** A project created before this release has it in its `package.json` and its build will fail after updating. Replace the two scripts with:
+
+```
+  "build:js": "esbuild \"src/frontend/js/pages/*.js\" --bundle --outdir=out/js/pages --minify",
+  "serve:js": "esbuild \"src/frontend/js/pages/*.js\" --bundle --outdir=out/js/pages --watch"
+```
+
+  A TypeScript project uses `src/frontend/ts/pages/*.ts` instead.
+
+- **Foundation and UIkit are no longer offered.** An existing project that uses one keeps working: nothing is removed from it. A new project that wants them can install the package and add the import by hand, the same way any other library works.
+
+## [2.5.0] - 2026-09-07
+
+### Changed
+- The data record a new page gets in `pages.json` comes from `tools/res/templates/template.json` instead of being written inside `settings.json`. It's content, like the route, the stylesheet and the script, and it now sits with the other three templates rather than in the CLI's configuration.
+
 ## [2.4.7] - 2026-09-04
 
 ### Changed
@@ -19,8 +65,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Restored `404.scss` **.not-found** selector to center the not found text 
-- Removed all comments in backend files
+- Restored `404.scss` **.not-found** selector to center the not found text.
+- Removed all comments in backend files.
 
 ## [2.4.5] - 2026-08-26
 

package/bin/create.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const readline = require('readline');
+const settings = require('../tools/config/settings.json');
 const { writeSync } = require('fs');
 const { spawnSync } = require('child_process');
 const { color } = require('../tools/lib/colors');
@@ -23,8 +24,6 @@ const LANGUAGE = Object.freeze({
 const FRAMEWORK = Object.freeze({
     BOOTSTRAP:  'bootstrap',
     BULMA:      'bulma',
-    FOUNDATION: 'foundation',
-    UIKIT:      'uikit',
     NONE:       'none',
 });
 
@@ -41,21 +40,19 @@ const COMMENT_STYLE = Object.freeze({
 // ── CHOICES ──────────────────────────────────────────────────────────────────
 
 const LANGUAGE_CHOICES = [
-    { label: 'JavaScript (recommended)', value: LANGUAGE.JAVASCRIPT },
-    { label: 'TypeScript',           value: LANGUAGE.TYPESCRIPT },
+    { label: 'JavaScript', note: 'simpler to start', value: LANGUAGE.JAVASCRIPT },
+    { label: 'TypeScript', note: 'catches mistakes', value: LANGUAGE.TYPESCRIPT },
 ];
 
 const FRAMEWORK_CHOICES = [
-    { label: 'Bootstrap (recommended)', value: FRAMEWORK.BOOTSTRAP  },
-    { label: 'Bulma',               value: FRAMEWORK.BULMA      },
-    { label: 'Foundation',          value: FRAMEWORK.FOUNDATION },
-    { label: 'UIkit',               value: FRAMEWORK.UIKIT      },
-    { label: 'None',                value: FRAMEWORK.NONE       },
+    { label: 'Bootstrap', note: 'the most common', value: FRAMEWORK.BOOTSTRAP },
+    { label: 'Bulma',     note: 'lighter, no JS',  value: FRAMEWORK.BULMA     },
+    { label: 'None',                               value: FRAMEWORK.NONE      },
 ];
 
 const BACKEND_CHOICES = [
-    { label: 'Node.js (No composer required)', value: BACKEND.NODE },
-    { label: 'PHP (Can run everywhere)',  value: BACKEND.PHP  },
+    { label: 'Node.js', note: 'needs a VPS',  value: BACKEND.NODE },
+    { label: 'PHP',     note: 'any hosting',  value: BACKEND.PHP  },
 ];
 
 // Runtime dependencies for the Node backend, read from the backend's own
@@ -109,16 +106,6 @@ const FRAMEWORKS = {
         njk:      [],
         eleventy: [],
     },
-    [FRAMEWORK.FOUNDATION]: {
-        scss:     'foundation',
-        njk:      ['/js/foundation.min.js'],
-        eleventy: ['foundation-sites/dist/js/foundation.min.js'],
-    },
-    [FRAMEWORK.UIKIT]: {
-        scss:     'uikit',
-        njk:      ['/js/uikit.min.js', '/js/uikit-icons.min.js'],
-        eleventy: ['uikit/dist/js/uikit.min.js', 'uikit/dist/js/uikit-icons.min.js'],
-    },
     [FRAMEWORK.NONE]: {
         scss:     null,
         njk:      [],
@@ -130,7 +117,7 @@ const FRAMEWORKS = {
 
 const GITIGNORE_CONTENT = `
 node_modules/
-src/backend/_core/vendor/
+src/backend/core/vendor/
 out/
 src/backend/config.php
 src/backend/config.js
@@ -143,18 +130,6 @@ const PROJECT_PACKAGE = {
     version:   '0.0.0',
     private:   true,
     outputDir: 'out',
-    "scripts": {
-        "build:css": "sass src/frontend/scss:out/css --no-source-map --style=compressed --quiet --load-path=node_modules",
-        "build:js": "nib build-js",
-        "build:11ty": "eleventy",
-        "build": "npm run clean && npm run build:css && npm run build:js && npm run build:11ty",
-        "serve:css": "sass --watch src/frontend/scss:out/css --no-source-map --quiet --load-path=node_modules",
-        "serve:js": "nib build-js --watch",
-        "serve:11ty": "eleventy --serve --quiet",
-        "clean": "nib clean",
-        "serve": "npm run clean && concurrently \"npm run serve:11ty\" \"npm run serve:css\" \"npm run serve:js\"",
-        "assistant": "nib cli"
-    },
     dependencies: {
         '@11ty/eleventy':     '^3.1.6',
         '@11ty/eleventy-img': '^7.0.0',
@@ -162,11 +137,8 @@ const PROJECT_PACKAGE = {
         'bootstrap':          '^5.3.8',
         'bootstrap-icons':    '^1.13.1',
         'bulma':              '^1.0.4',
-        'foundation-sites':   '^6.9.0',
-        'glob':               '^13.0.6',
         'markdown-it-anchor': '^9.2.1',
         'markdown-it-attrs':  '^5.0.1',
-        'uikit':              '^3.25.21',
     },
     devDependencies: {
         'nibula': `^${SELF_VERSION}`,
@@ -178,6 +150,24 @@ const PROJECT_PACKAGE = {
 
 // ── HELPERS ───────────────────────────────────────────────────────────────────
 
+function projectScripts(language) {
+    const { pages, extension } = settings.languages[language];
+    const entries = `${pages}/*.${extension}`;
+
+    return {
+        'build:css': 'sass src/frontend/scss:out/css --no-source-map --style=compressed --quiet --load-path=node_modules',
+        'build:js': `esbuild "${entries}" --bundle --outdir=out/js/pages --minify`,
+        'build:11ty': 'eleventy',
+        'build': 'npm run clean && npm run build:css && npm run build:js && npm run build:11ty',
+        'serve:css': 'sass --watch src/frontend/scss:out/css --no-source-map --quiet --load-path=node_modules',
+        'serve:js': `esbuild "${entries}" --bundle --outdir=out/js/pages --watch`,
+        'serve:11ty': 'eleventy --serve --quiet',
+        'clean': 'nib clean',
+        'serve': 'npm run clean && concurrently "npm run serve:11ty" "npm run serve:css" "npm run serve:js"',
+        'assistant': 'nib cli',
+    };
+}
+
 function log(msg) {
     writeSync(1, msg + '\n');
 }
@@ -300,7 +290,7 @@ function njkUncomment(content, marker) {
 }
 
 function installDependencies(backend) {
-    const backendCore = path.join(targetDir, 'src', 'backend', '_core');
+    const backendCore = path.join(targetDir, 'src', 'backend', 'core');
 
     log(`${color.blue}\n>> Installing Node modules...${color.reset}`);
     const npm = spawnSync('npm', ['install'], {
@@ -335,7 +325,7 @@ function installDependencies(backend) {
 
     if (probe.status !== 0) {
         log('\n(!) Composer not found — skipping backend dependencies.');
-        log('    Install Composer, then run: cd src/backend/_core && composer install\n');
+        log('    Install Composer, then run: cd src/backend/core && composer install\n');
         return true;
     }
 
@@ -354,7 +344,7 @@ function installDependencies(backend) {
 function applyFramework(framework) {
     const config = FRAMEWORKS[framework];
 
-    const globalScssPath = path.join(targetDir, 'src/frontend/scss/_global.scss');
+    const globalScssPath = path.join(targetDir, 'src/frontend/scss/global.scss');
     if (fs.existsSync(globalScssPath)) {
         let content = fs.readFileSync(globalScssPath, 'utf8');
         ALL_FRAMEWORKS.forEach(fw => {
@@ -395,13 +385,20 @@ function askChoice(question, choices) {
 
         log(`\n>> ${question} (Use arrow keys and press Enter):\n`);
 
+        const labelWidth = Math.max(...choices.map((choice) => choice.label.length));
+
         const render = (firstTime = false) => {
             if (!firstTime) process.stdout.write(`\x1B[${choices.length}A`);
-            const output = choices.map((choice, index) =>
-                index === selectedIndex
-                    ? `  \x1b[36m◉ ${choice.label}\x1b[0m\x1B[K\n`
-                    : `  * ${choice.label}\x1B[K\n`
-            ).join('');
+
+            const output = choices.map((choice, index) => {
+                const selected = index === selectedIndex;
+                const symbol = selected ? `${color.cyan}◉` : '*';
+                const label = selected ? `${choice.label}${color.reset}` : choice.label;
+                const note = choice.note ? `${color.dim} — ${choice.note}${color.reset}` : '';
+
+                return `  ${symbol} ${label}${note}\x1B[K\n`;
+            }).join('');
+
             process.stdout.write(output);
         };
 
@@ -478,6 +475,7 @@ async function init() {
     // Build the project package.json. Clone the shared dependency maps so we
     // never mutate the PROJECT_PACKAGE constant.
     const pkg = { ...PROJECT_PACKAGE };
+    pkg.scripts = projectScripts(language);
     pkg.dependencies    = { ...PROJECT_PACKAGE.dependencies };
     pkg.devDependencies = { ...PROJECT_PACKAGE.devDependencies };
 

package/bin/nibula.js

@@ -16,7 +16,6 @@ const [, , cmd, ...rest] = process.argv;
 
 const CREATE = path.join(__dirname, 'create.js');
 const ASSISTANT = path.join(__dirname, '..', 'tools', 'assistant.js');
-const BUILDJS   = path.join(__dirname, '..', 'tools', 'buildJs.js');
 const CLEAN     = path.join(__dirname, '..', 'tools', 'cleanOutput.js');
 
 const REGISTRY = 'https://registry.npmjs.org/nibula/latest';
@@ -266,11 +265,6 @@ async function main() {
             runNpm(root, 'build');
             break;
         }
-        case 'build-js': {
-            enterProject();
-            run(BUILDJS, rest);
-            break;
-        }
         case 'clean': {
             enterProject();
             run(CLEAN, []);

package/nginx.conf

@@ -100,7 +100,7 @@ server {
     location @php_backend {
         include fastcgi_params;
 
-        fastcgi_param SCRIPT_FILENAME $document_root/backend/_core/index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root/backend/core/index.php;
         fastcgi_pass unix:/run/php/php-fpm.sock;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nibula",
-  "version": "2.4.7",
+  "version": "3.0.0",
   "description": "A beginner-friendly static site generator built on Eleventy that stays close to vanilla HTML, CSS and JS — with a page-management CLI, an optional PHP backend, and SEO files generated for you.",
   "keywords": [
     "11ty",
@@ -21,8 +21,7 @@
     "seo-optimization",
     "ssg",
     "static-site-generator",
-    "typescript",
-    "uikit"
+    "typescript"
   ],
   "author": "Michele Garofalo",
   "license": "Apache-2.0",
@@ -62,11 +61,8 @@
     "bulma": "^1.0.4",
     "concurrently": "^9.2.4",
     "esbuild": "^0.28.2",
-    "foundation-sites": "^6.9.0",
-    "glob": "^13.0.6",
     "markdown-it-anchor": "^9.2.1",
     "markdown-it-attrs": "^5.0.1",
-    "sass": "^1.103.1",
-    "uikit": "^3.25.21"
+    "sass": "^1.103.1"
   }
 }

package/src/backend/.htaccess

@@ -2,6 +2,6 @@
     RewriteEngine On
     RewriteBase /api/
 
-    RewriteRule ^_core/index\.php$ - [L]
-    RewriteRule ^(.*)$ _core/index.php [QSA,L]
+    RewriteRule ^core/index\.php$ - [L]
+    RewriteRule ^(.*)$ core/index.php [QSA,L]
 </IfModule>

package/src/backend/core/index.js

@@ -0,0 +1,329 @@
+"use strict";
+
+const DEBUG_HEADER = "Debug-Mode";
+const DEBUG_HEADER_VALUE = "true";
+
+const http = require("http");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+const { createResponse, HALT } = require("./modules/Response");
+const { createValidator } = require("./modules/Validate");
+const { createRateLimiter } = require("./modules/RateLimiter");
+const { loadConfig, isDebug, handleException } = require("./init");
+
+const CORE_PATH = __dirname;
+
+const URL_PREFIX = "/api";
+const ENDPOINT_EXTENSION = ".js";
+const ERROR_PAGE = "404.html";
+const ENDPOINTS_FOLDER = "endpoints";
+const PUBLIC_FOLDER = "public";
+const PROTECTED_FOLDER = "protected";
+
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = "3000";
+const RATE_LIMIT_REQUESTS = 60;
+const RATE_LIMIT_WINDOW_SECONDS = 60;
+
+const STATUS_NO_CONTENT = 204;
+const STATUS_BAD_REQUEST = 400;
+const STATUS_UNAUTHORIZED = 401;
+const STATUS_NOT_FOUND = 404;
+const STATUS_METHOD_NOT_ALLOWED = 405;
+const STATUS_SERVER_ERROR = 500;
+
+const ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+const ALLOWED_HEADERS = "Content-Type, X-Api-Key";
+const JSON_CONTENT_TYPE = "application/json; charset=UTF-8";
+const HTML_CONTENT_TYPE = "text/html; charset=UTF-8";
+
+const config = loadConfig();
+const debugMode = isDebug(config);
+
+const DOCUMENT_ROOT =
+  process.env.DOCUMENT_ROOT || path.join(CORE_PATH, "..", "..");
+const basePublic = path.join(CORE_PATH, "..", ENDPOINTS_FOLDER, PUBLIC_FOLDER);
+const baseProtected = path.join(
+  CORE_PATH,
+  "..",
+  ENDPOINTS_FOLDER,
+  PROTECTED_FOLDER,
+);
+
+function hashEquals(known, given) {
+  const knownBuffer = Buffer.from(String(known));
+  const givenBuffer = Buffer.from(String(given));
+
+  if (knownBuffer.length !== givenBuffer.length) {
+    return false;
+  }
+
+  return crypto.timingSafeEqual(knownBuffer, givenBuffer);
+}
+
+function sendErrorPage(res) {
+  const errorPage = path.join(DOCUMENT_ROOT, ERROR_PAGE);
+
+  res.statusCode = STATUS_NOT_FOUND;
+  res.setHeader("Content-Type", HTML_CONTENT_TYPE);
+  res.end(
+    fs.existsSync(errorPage)
+      ? fs.readFileSync(errorPage)
+      : "<h1>404 Not Found</h1>The requested URL was not found on this server.",
+  );
+}
+
+function parseSegments(pathname) {
+  const uri = pathname
+    .replace(new RegExp(`^${URL_PREFIX}`), "")
+    .replace(/\/+$/, "");
+
+  return uri.split("/").filter((segment) => segment !== "");
+}
+
+function resolveEndpoint(segments) {
+  const remaining = segments.slice();
+  const params = [];
+
+  while (remaining.length > 0) {
+    const relativePath = remaining.join("/") + ENDPOINT_EXTENSION;
+
+    const publicCandidate = path.join(basePublic, relativePath);
+    if (fs.existsSync(publicCandidate)) {
+      return {
+        file: publicCandidate,
+        base: basePublic,
+        isProtected: false,
+        params,
+      };
+    }
+
+    const protectedCandidate = path.join(baseProtected, relativePath);
+    if (fs.existsSync(protectedCandidate)) {
+      return {
+        file: protectedCandidate,
+        base: baseProtected,
+        isProtected: true,
+        params,
+      };
+    }
+
+    params.unshift(remaining.pop());
+  }
+
+  return null;
+}
+
+function toEndpointKey(file, base) {
+  return file
+    .split(path.sep)
+    .join("/")
+    .replace(base.split(path.sep).join("/"), "")
+    .replace(new RegExp(`\\${ENDPOINT_EXTENSION}$`), "")
+    .replace(/^\//, "");
+}
+
+function applySecurityHeaders(res) {
+  res.setHeader("Content-Type", JSON_CONTENT_TYPE);
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "DENY");
+  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+  res.setHeader("Access-Control-Allow-Methods", ALLOWED_METHODS);
+  res.setHeader("Access-Control-Allow-Headers", ALLOWED_HEADERS);
+
+  if (debugMode) {
+    res.setHeader(DEBUG_HEADER, DEBUG_HEADER_VALUE);
+  }
+}
+
+function applyCors(res, endpointKey, origin) {
+  const allowedOrigins =
+    config.CUSTOM_ENDPOINT_ORIGINS?.[endpointKey] ??
+    config.GENERAL_ALLOWED_ORIGINS ??
+    [];
+
+  if (origin !== "" && allowedOrigins.includes(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+
+    return;
+  }
+
+  if (allowedOrigins.includes("*")) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+  }
+}
+
+function authorize(endpointKey, givenKey, Response) {
+  const validKey =
+    config.CUSTOM_ENDPOINT_KEYS?.[endpointKey] ?? config.GENERAL_API_KEY ?? "";
+
+  if (validKey === "" || !hashEquals(validKey, givenKey)) {
+    Response.error(
+      "Unauthorized. X-Api-Key is incorrect or missing",
+      STATUS_UNAUTHORIZED,
+    );
+  }
+}
+
+function clientAddress(req) {
+  const forwarded = (req.headers["x-forwarded-for"] || "").split(",")[0].trim();
+
+  return forwarded || req.socket.remoteAddress || "";
+}
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      let json = {};
+
+      try {
+        json = raw ? JSON.parse(raw) : {};
+      } catch (error) {
+        json = {};
+      }
+
+      resolve({ raw, json });
+    });
+    req.on("error", () => resolve({ raw: "", json: {} }));
+  });
+}
+
+function loadHandlers(file) {
+  if (debugMode) {
+    delete require.cache[require.resolve(file)];
+  }
+
+  return require(file);
+}
+
+async function dispatch(file, context, Response) {
+  const handlers = loadHandlers(file);
+
+  if (typeof handlers === "function") {
+    await handlers(context);
+
+    return;
+  }
+
+  const methodHandler = handlers[context.method.toLowerCase()];
+
+  if (typeof methodHandler !== "function") {
+    Response.error("Method not allowed", STATUS_METHOD_NOT_ALLOWED);
+  }
+
+  await methodHandler(context);
+}
+
+async function handleRequest(req, res) {
+  const Response = createResponse(res);
+
+  try {
+    const parsedUrl = new URL(req.url, `http://${DEFAULT_HOST}`);
+    const segments = parseSegments(parsedUrl.pathname);
+
+    if (segments.some((segment) => segment === "." || segment === "..")) {
+      Response.error("Bad Request", STATUS_BAD_REQUEST);
+    }
+
+    const endpoint = resolveEndpoint(segments);
+
+    if (endpoint === null) {
+      sendErrorPage(res);
+
+      return;
+    }
+
+    const endpointKey = toEndpointKey(endpoint.file, endpoint.base);
+
+    applySecurityHeaders(res);
+    applyCors(res, endpointKey, req.headers.origin || "");
+
+    if (req.method === "OPTIONS") {
+      res.statusCode = STATUS_NO_CONTENT;
+      res.end();
+
+      return;
+    }
+
+    createRateLimiter(Response, res).check(
+      clientAddress(req),
+      RATE_LIMIT_REQUESTS,
+      RATE_LIMIT_WINDOW_SECONDS,
+    );
+
+    if (endpoint.isProtected) {
+      authorize(endpointKey, req.headers["x-api-key"] || "", Response);
+    }
+
+    const body = await readBody(req);
+
+    await dispatch(
+      endpoint.file,
+      {
+        method: req.method,
+        requestParams: endpoint.params,
+        query: Object.fromEntries(parsedUrl.searchParams),
+        body: body.json,
+        rawBody: body.raw,
+        headers: req.headers,
+        Response,
+        Validate: createValidator(Response),
+        config,
+        CORE_PATH,
+        req,
+        res,
+      },
+      Response,
+    );
+
+    if (!res.writableEnded) {
+      res.end();
+    }
+  } catch (error) {
+    if (error === HALT) {
+      return;
+    }
+
+    try {
+      handleException(error, config, Response);
+    } catch (inner) {
+      if (inner === HALT) {
+        return;
+      }
+
+      if (!res.writableEnded) {
+        res.statusCode = STATUS_SERVER_ERROR;
+        res.end(
+          JSON.stringify({
+            status: "error",
+            message: "Internal server error",
+            code: STATUS_SERVER_ERROR,
+          }),
+        );
+      }
+    }
+  }
+}
+
+const host = process.env.HOST || DEFAULT_HOST;
+const port = parseInt(process.env.PORT || DEFAULT_PORT, 10);
+
+const server = http.createServer(handleRequest);
+
+server.listen(port, host, () => {
+  console.log(`Backend started listening on http://${host}:${port}`);
+  if (debugMode) {
+    console.log(
+      'WARNING: error details are exposed in responses. Set APP_ENV to "production" in config.js before publishing.',
+    );
+  }
+});
+
+module.exports = server;