Initial commit

server.mjs

@@ -0,0 +1,345 @@
+import http from 'node:http';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Transform } from 'node:stream';
+import { fileURLToPath } from 'node:url';
+import { openAppDb, resolveTimeZone, listBooks, getBook, setBookReadOverride, getDashboard, getCalendar, createPairingCode, getPairingStatus, consumePairingCode, authenticateDevice, listDevices, revokeDevice, updateDevicePluginVersion, recordDeviceSync, getStatus } from './lib/db.mjs';
+import { importKoReaderDb, importPluginPayload, removeExcludedBooks } from './lib/importer.mjs';
+import { scheduleCoverWork, saveEmbeddedCover, saveManualCover, queueOnlineCoverRetry, getBookCoverState, findCoverCandidates, selectCoverCandidate, selectCoverHistory } from './lib/covers.mjs';
+import { json, randomId, cleanText } from './lib/security.mjs';
+import { info, warn, error as logError } from './lib/logger.mjs';
+import { createBackupArchive, sendBooksCsv, sendHighlightsMarkdown } from './lib/exports.mjs';
+
+const VERSION = '2026.09.25';
+const LATEST_PLUGIN_VERSION = '2026.09.25';
+const MIN_COVER_PLUGIN_VERSION = '2026.09.25';
+const MIN_INCREMENTAL_PLUGIN_VERSION = '2026.09.25';
+const ROOT = path.dirname(fileURLToPath(import.meta.url));
+const DATA_DIR = path.resolve(process.env.DATA_PATH || path.join(ROOT, 'data'));
+const PUBLIC_DIR = path.join(ROOT, 'public');
+const UPLOAD_DIR = path.join(DATA_DIR, 'uploads');
+const COVER_DIR = path.join(DATA_DIR, 'covers');
+const HOST = process.env.HOST || '127.0.0.1';
+const PORT = Number(process.env.PORT || 3000);
+const TIME_ZONE = resolveTimeZone(process.env.TZ);
+const MAX_FILE_BYTES = Number(process.env.MAX_FILE_SIZE_MB || 100) * 1024 * 1024;
+const MAX_JSON_BYTES = Number(process.env.MAX_JSON_MB || 20) * 1024 * 1024;
+const MAX_COVER_BYTES = 4 * 1024 * 1024;
+const WEB_CSRF = randomId(24);
+const pairAttempts = new Map();
+
+function versionParts(value){return String(value||'0').split('.').map(x=>Number.parseInt(x,10)||0).slice(0,3)}
+function versionAtLeast(value,minimum){const a=versionParts(value),b=versionParts(minimum);for(let i=0;i<3;i++){if((a[i]||0)>(b[i]||0))return true;if((a[i]||0)<(b[i]||0))return false}return true}
+function deviceView(d){return {...d,needs_update:!versionAtLeast(d.plugin_version,LATEST_PLUGIN_VERSION),supports_cover_sync:versionAtLeast(d.plugin_version,MIN_COVER_PLUGIN_VERSION),supports_incremental_sync:versionAtLeast(d.plugin_version,MIN_INCREMENTAL_PLUGIN_VERSION),latest_plugin_version:LATEST_PLUGIN_VERSION,min_cover_plugin_version:MIN_COVER_PLUGIN_VERSION,min_incremental_plugin_version:MIN_INCREMENTAL_PLUGIN_VERSION}}
+
+try {
+  fs.mkdirSync(UPLOAD_DIR, { recursive: true });
+  fs.mkdirSync(COVER_DIR, { recursive: true });
+  fs.accessSync(DATA_DIR, fs.constants.R_OK | fs.constants.W_OK);
+} catch (err) {
+  if (err?.code === 'EACCES') {
+    logError('startup.storage','kovi cannot write to its data directory.',{dataDir:DATA_DIR});
+    logError('startup.storage.hint','For Docker bind mounts, make sure the host data directory is writable by the container user, or use the default named-volume docker-compose.yml.');
+  }
+  throw err;
+}
+const db = openAppDb(DATA_DIR, {timeZone:TIME_ZONE});
+const excludedOnStartup = removeExcludedBooks(db);
+if (excludedOnStartup) info('library.cleanup','Removed excluded KOReader manual entries already present in the library.',{removed:excludedOnStartup});
+scheduleCoverWork(db, DATA_DIR, [], {reason:'startup'});
+
+function securityHeaders(extra={}) {
+  return {
+    'X-Content-Type-Options':'nosniff',
+    'X-Frame-Options':'DENY',
+    'Referrer-Policy':'no-referrer',
+    'Permissions-Policy':'camera=(), microphone=(), geolocation=()',
+    'Cross-Origin-Resource-Policy':'same-origin',
+    'Content-Security-Policy':"default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+    ...extra,
+  };
+}
+
+async function readJson(req, max=MAX_JSON_BYTES) {
+  const chunks=[]; let total=0;
+  for await (const chunk of req) {
+    total += chunk.length;
+    if(total > max) throw Object.assign(new Error('JSON payload too large.'),{status:413});
+    chunks.push(chunk);
+  }
+  if(!total) return {};
+  try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+  catch { throw Object.assign(new Error('Invalid JSON.'),{status:400}); }
+}
+
+async function readBinary(req, max=MAX_COVER_BYTES) {
+  const declared=Number(req.headers['content-length']||0);
+  if(declared && declared>max) throw Object.assign(new Error('Cover upload is too large.'),{status:413});
+  const chunks=[]; let total=0;
+  for await (const chunk of req) {
+    total += chunk.length;
+    if(total > max) throw Object.assign(new Error('Cover upload is too large.'),{status:413});
+    chunks.push(chunk);
+  }
+  if(!total) throw Object.assign(new Error('Cover upload was empty.'),{status:400});
+  return Buffer.concat(chunks);
+}
+
+function routeParam(pathname, pattern) {
+  const m = pattern.exec(pathname); return m ? m.slice(1).map(decodeURIComponent) : null;
+}
+
+function requireWebCsrf(req) {
+  if (req.headers['x-kovi-csrf'] !== WEB_CSRF) throw Object.assign(new Error('Missing browser request token.'), {status:403});
+}
+function checkPairRate(req) {
+  const key=req.socket.remoteAddress || 'unknown', now=Date.now(), windowMs=10*60_000;
+  const row=pairAttempts.get(key) || {start:now,count:0};
+  if(now-row.start>windowMs){row.start=now;row.count=0}
+  row.count++;pairAttempts.set(key,row);
+  if(row.count>30) throw Object.assign(new Error('Too many pairing attempts. Try again later.'),{status:429});
+}
+
+function storageStats(){
+  let databaseBytes=0,coverBytes=0,coverFiles=0;
+  try{databaseBytes=fs.statSync(path.join(DATA_DIR,'kovi.sqlite')).size}catch{}
+  try{for(const name of fs.readdirSync(COVER_DIR)){try{const st=fs.statSync(path.join(COVER_DIR,name));if(st.isFile()){coverBytes+=st.size;coverFiles++}}catch{}}}catch{}
+  return {database_bytes:databaseBytes,cover_bytes:coverBytes,cover_files:coverFiles,total_bytes:databaseBytes+coverBytes};
+}
+
+async function handleApi(req,res,url) {
+  if(req.method==='GET' && url.pathname==='/api/session') return json(res,200,{csrf:WEB_CSRF},securityHeaders());
+  if(req.method==='GET' && url.pathname==='/api/health') return json(res,200,{ok:true,name:'kovi',version:VERSION},securityHeaders());
+  if(req.method==='GET' && url.pathname==='/api/plugin/ping') {
+    info('plugin.ping','KOReader ping received.',{remote:req.socket.remoteAddress || 'unknown',userAgent:cleanText(req.headers['user-agent'],120) || 'none'});
+    return json(res,200,{ok:true,name:'kovi',version:VERSION},securityHeaders());
+  }
+  if(req.method==='GET' && url.pathname==='/api/books') return json(res,200,{books:listBooks(db)},securityHeaders());
+  const bookRoute=routeParam(url.pathname,/^\/api\/books\/([^/]+)$/);
+  if(req.method==='GET' && bookRoute){ const book=getBook(db,bookRoute[0]); if(!book)return json(res,404,{error:'Book not found.'},securityHeaders()); const covers=getBookCoverState(db,book.id); return json(res,200,{...book,cover_history:covers?.history||[],cover_candidates:covers?.candidates||[],cover_job:covers?.job||null},securityHeaders()); }
+  const bookReadRoute=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/read$/);
+  if(req.method==='PUT' && bookReadRoute){
+    requireWebCsrf(req);
+    const body=await readJson(req,4096);
+    if(body.read!==null && typeof body.read!=='boolean') return json(res,400,{error:'read must be true, false, or null.'},securityHeaders());
+    const book=setBookReadOverride(db,bookReadRoute[0],body.read);
+    return json(res,book?200:404,book||{error:'Book not found.'},securityHeaders());
+  }
+  if(req.method==='GET' && url.pathname==='/api/dashboard') return json(res,200,getDashboard(db,{from:url.searchParams.get('from'),to:url.searchParams.get('to')}),securityHeaders());
+  if(req.method==='GET' && url.pathname==='/api/calendar') return json(res,200,getCalendar(db,{from:url.searchParams.get('from'),to:url.searchParams.get('to')}),securityHeaders());
+  if(req.method==='GET' && url.pathname==='/api/devices') return json(res,200,{devices:listDevices(db).map(deviceView),latest_plugin_version:LATEST_PLUGIN_VERSION},securityHeaders());
+  if(req.method==='GET' && url.pathname==='/api/status') return json(res,200,{...getStatus(db),storage:storageStats(),version:VERSION,latest_plugin_version:LATEST_PLUGIN_VERSION,time_zone:TIME_ZONE,generated_at:new Date().toISOString()},securityHeaders({'Cache-Control':'no-store'}));
+  if(req.method==='GET' && url.pathname==='/api/export/books.csv'){sendBooksCsv(res,db,securityHeaders());return true}
+  if(req.method==='GET' && url.pathname==='/api/export/highlights.md'){sendHighlightsMarkdown(res,db,securityHeaders());return true}
+  if(req.method==='GET' && url.pathname==='/api/backup'){
+    const backupPath=path.join(UPLOAD_DIR,`kovi-backup-${Date.now()}-${randomId(6)}.tar.gz`);
+    await createBackupArchive(db,DATA_DIR,backupPath,{version:VERSION});
+    try{const st=await fsp.stat(backupPath);res.writeHead(200,securityHeaders({'Content-Type':'application/gzip','Content-Disposition':`attachment; filename="kovi-backup-${new Date().toISOString().slice(0,10)}.tar.gz"`,'Content-Length':st.size,'Cache-Control':'no-store'}));await pipeline(fs.createReadStream(backupPath),res)}finally{await fsp.rm(backupPath,{force:true}).catch(()=>{})}
+    return true;
+  }
+
+  if(req.method==='POST' && url.pathname==='/api/pairing-codes') {
+    requireWebCsrf(req);
+    const body=await readJson(req,4096);
+    const label=cleanText(body.label,80)||'KOReader';
+    const pair=createPairingCode(db,label);
+    info('pairing.code.created','Created a short-lived pairing request.',{requestId:pair.requestId,label,expiresAt:new Date(pair.expiresAt).toISOString()});
+    return json(res,201,pair,securityHeaders());
+  }
+
+  const pairingStatus=routeParam(url.pathname,/^\/api\/pairing-codes\/([^/]+)$/);
+  if(req.method==='GET' && pairingStatus){
+    const status=getPairingStatus(db,pairingStatus[0]);
+    return json(res,status?200:404,status||{error:'Pairing request not found.'},securityHeaders());
+  }
+
+  const revoke=routeParam(url.pathname,/^\/api\/devices\/([^/]+)\/revoke$/);
+  if(req.method==='POST' && revoke) {
+    requireWebCsrf(req);
+    const changed=revokeDevice(db,revoke[0]);
+    if(changed) info('device.revoked','Revoked a KOReader device token.',{deviceId:revoke[0]});
+    return json(res,changed?200:404,{ok:changed},securityHeaders());
+  }
+
+  if(req.method==='POST' && url.pathname==='/api/plugin/pair') {
+    checkPairRate(req);
+    const body=await readJson(req,32*1024);
+    const paired=consumePairingCode(db,body.code,{deviceId:body.device_id,model:cleanText(body.model,120),version:cleanText(body.version,40)});
+    if(!paired) {
+      warn('pairing.rejected','Pairing attempt rejected because the code was invalid, expired, or already used.',{remote:req.socket.remoteAddress || 'unknown',deviceId:cleanText(body.device_id,128),model:cleanText(body.model,120)});
+      return json(res,401,{error:'Pairing code is invalid, expired, or already used.'},securityHeaders());
+    }
+    info('device.paired','KOReader paired successfully.',{deviceId:paired.deviceId,model:cleanText(body.model,120),pluginVersion:cleanText(body.version,40),remote:req.socket.remoteAddress || 'unknown'});
+    if(!versionAtLeast(body.version,MIN_COVER_PLUGIN_VERSION)) warn('plugin.outdated','Paired KOReader plugin is too old for embedded-cover and ISBN sync.',{deviceId:paired.deviceId,pluginVersion:cleanText(body.version,40),minimumVersion:MIN_COVER_PLUGIN_VERSION,latestVersion:LATEST_PLUGIN_VERSION});
+    return json(res,200,{message:'KOReader paired with kovi.',token:paired.token,device_id:paired.deviceId,latest_plugin_version:LATEST_PLUGIN_VERSION,update_recommended:!versionAtLeast(body.version,LATEST_PLUGIN_VERSION)},securityHeaders());
+  }
+
+  if(req.method==='POST' && url.pathname==='/api/plugin/import') {
+    const device=authenticateDevice(db,req.headers.authorization);
+    if(!device) {
+      warn('plugin.sync.rejected','Rejected plugin sync with missing or invalid device token.',{remote:req.socket.remoteAddress || 'unknown'});
+      return json(res,401,{error:'Device token is missing or invalid.'},securityHeaders());
+    }
+    const body=await readJson(req);
+    const reportedVersion=cleanText(body?.version,40)||device.plugin_version||'';
+    if(reportedVersion) updateDevicePluginVersion(db,device.id,reportedVersion);
+    info('plugin.sync.start','KOReader sync started.',{deviceId:device.id,books:Array.isArray(body?.books)?body.books.length:0,stats:Array.isArray(body?.stats)?body.stats.length:0,annotationSets:Array.isArray(body?.annotation_sets)?body.annotation_sets.length:0});
+    const result=importPluginPayload(db,body,device);
+    const coverQueueIds=[...new Set([...(result.newBookIds||[]),...(result.coverRefreshIds||[])])];
+    scheduleCoverWork(db,DATA_DIR,coverQueueIds,{reason:`plugin-sync:${device.id}`,delayMs:(result.coverRequests?.length||0)>0?4000:50});
+    if((result.coverRequests?.length||0)>0 && !versionAtLeast(reportedVersion,MIN_COVER_PLUGIN_VERSION)) warn('plugin.outdated.cover-sync','KOReader ignored server cover requests because its plugin predates embedded-cover sync. Update the kovi plugin on the reader.',{deviceId:device.id,pluginVersion:reportedVersion||'unknown',minimumVersion:MIN_COVER_PLUGIN_VERSION,missingCoverRequests:result.coverRequests.length});
+    recordDeviceSync(db,device.id,result,{mode:result.syncMode,cursorBefore:result.syncCursorBefore,cursorAfter:result.syncCursorAfter});
+    info('plugin.sync.complete','KOReader sync completed.',{deviceId:device.id,...result,coverRequests:result.coverRequests?.length||0,newBookIds:undefined,coverRefreshIds:undefined});
+    return json(res,200,{
+      message:`Synced ${result.booksSeen} books, ${result.sessionsSeen} reading rows, and ${result.annotationsStored} annotations.`,
+      ...result,
+      sync_cursor:result.syncCursorAfter,
+      sync_mode:result.syncMode,
+      cover_requests:result.coverRequests||[],
+      latest_plugin_version:LATEST_PLUGIN_VERSION,
+      update_recommended:!versionAtLeast(reportedVersion,LATEST_PLUGIN_VERSION),
+      coverRequests:undefined,
+    },securityHeaders());
+  }
+
+  if(req.method==='POST' && url.pathname==='/api/plugin/cover') {
+    const device=authenticateDevice(db,req.headers.authorization);
+    if(!device) {
+      warn('cover.embedded.rejected','Rejected embedded cover upload with missing or invalid device token.',{remote:req.socket.remoteAddress || 'unknown'});
+      return json(res,401,{error:'Device token is missing or invalid.'},securityHeaders());
+    }
+    const md5=cleanText(req.headers['x-kovi-book-md5'],128);
+    if(!md5) return json(res,400,{error:'Book MD5 header is required.'},securityHeaders());
+    const payload=await readBinary(req);
+    const saved=saveEmbeddedCover(db,DATA_DIR,md5,payload);
+    if(saved.ignored) {
+      info('cover.embedded.ignored','Ignored embedded cover because a manual cover has priority.',{deviceId:device.id,bookId:saved.book?.id,title:saved.book?.title,reason:saved.reason});
+      return json(res,200,{ok:true,ignored:true,reason:saved.reason},securityHeaders());
+    }
+    info('cover.embedded.saved','Stored an embedded cover supplied by KOReader.',{deviceId:device.id,bookId:saved.bookId,title:saved.title,bytes:saved.bytes,type:saved.type});
+    return json(res,201,{ok:true,book_id:saved.bookId,path:saved.path},securityHeaders());
+  }
+
+  if(req.method==='PUT' && url.pathname==='/api/import/sqlite') {
+    requireWebCsrf(req);
+    const contentLength=Number(req.headers['content-length']||0);
+    const filename=cleanText(req.headers['x-kovi-filename'],255)||'statistics.sqlite3';
+    if(contentLength && contentLength>MAX_FILE_BYTES) return json(res,413,{error:`File exceeds ${Math.round(MAX_FILE_BYTES/1024/1024)} MB limit.`},securityHeaders());
+    const tempPath=path.join(UPLOAD_DIR,`${Date.now()}-${randomId(12)}.sqlite`);
+    let size=0; let first=Buffer.alloc(0);
+    const limiter=new Transform({
+      transform(chunk,enc,cb){
+        size+=chunk.length;
+        if(first.length<16) first=Buffer.concat([first,chunk]).subarray(0,16);
+        if(size>MAX_FILE_BYTES) return cb(Object.assign(new Error('File too large.'),{status:413}));
+        cb(null,chunk);
+      }
+    });
+    info('import.sqlite.start','Manual KOReader database upload started.',{filename,contentLength:contentLength||undefined,remote:req.socket.remoteAddress || 'unknown'});
+    try {
+      await pipeline(req,limiter,fs.createWriteStream(tempPath,{flags:'wx',mode:0o600}));
+      if(size<16 || first.toString('ascii',0,16)!=='SQLite format 3\u0000') throw Object.assign(new Error('The selected file is not a SQLite database.'),{status:400});
+      const result=importKoReaderDb(db,tempPath,{filename,fileSize:size});
+      scheduleCoverWork(db,DATA_DIR,result.newBookIds||[],{reason:'manual-import'});
+      info(result.duplicate?'import.sqlite.duplicate':'import.sqlite.complete',result.duplicate?'Manual import matched an already-imported database.':'Manual KOReader database import completed.',{filename,fileSize:size,...result,newBookIds:undefined,sourceHash:undefined,warnings:result.warnings?.length||0});
+      return json(res,200,{message:result.duplicate?'This exact database was already imported.':'Import complete.',...result},securityHeaders());
+    } finally {
+      await fsp.rm(tempPath,{force:true}).catch(()=>{});
+    }
+  }
+
+  if(req.method==='POST' && url.pathname==='/api/covers/retry') {
+    requireWebCsrf(req);
+    const ids=db.prepare(`SELECT id FROM books WHERE cover_path IS NULL AND cover_status IN ('none','error','pending')`).all().map(r=>r.id);
+    info('cover.retry.all','User requested retry for missing covers.',{queued:ids.length});
+    scheduleCoverWork(db,DATA_DIR,ids,{reason:'user-retry-all'});
+    return json(res,202,{message:'Cover lookup queued.',queued:ids.length},securityHeaders());
+  }
+
+  const manualBookCover=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/cover$/);
+  if(req.method==='PUT' && manualBookCover) {
+    requireWebCsrf(req);
+    const payload=await readBinary(req);
+    const saved=saveManualCover(db,DATA_DIR,manualBookCover[0],payload);
+    info('cover.manual.saved','Stored a cover uploaded from the browser.',{bookId:saved.bookId,title:saved.title,bytes:saved.bytes,type:saved.type});
+    return json(res,201,{ok:true,book_id:saved.bookId,path:saved.path,cover_source:'manual-upload'},securityHeaders());
+  }
+
+  const candidateSearch=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/cover\/candidates$/);
+  if(req.method==='POST' && candidateSearch){
+    requireWebCsrf(req);
+    info('cover.candidates.start','User requested alternative cover candidates.',{bookId:candidateSearch[0]});
+    const candidates=await findCoverCandidates(db,DATA_DIR,candidateSearch[0]);
+    if(candidates===null)return json(res,404,{error:'Book not found.'},securityHeaders());
+    info('cover.candidates.complete','Alternative cover search completed.',{bookId:candidateSearch[0],candidates:candidates.length});
+    return json(res,200,{candidates},securityHeaders());
+  }
+
+  const candidateSelect=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/cover\/candidates\/([^/]+)$/);
+  if(req.method==='PUT' && candidateSelect){
+    requireWebCsrf(req);const selected=selectCoverCandidate(db,candidateSelect[0],candidateSelect[1]);
+    if(selected===null)return json(res,404,{error:'Book not found.'},securityHeaders());
+    if(!selected)return json(res,404,{error:'Cover candidate not found.'},securityHeaders());
+    info('cover.candidate.selected','User selected an alternative cover.',{bookId:candidateSelect[0],candidateId:candidateSelect[1]});
+    return json(res,200,{ok:true},securityHeaders());
+  }
+
+  const historySelect=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/cover\/history\/([^/]+)$/);
+  if(req.method==='PUT' && historySelect){
+    requireWebCsrf(req);const selected=selectCoverHistory(db,historySelect[0],historySelect[1]);
+    if(selected===null)return json(res,404,{error:'Book not found.'},securityHeaders());
+    if(!selected)return json(res,404,{error:'Cover history item not found.'},securityHeaders());
+    info('cover.history.selected','User restored a previous cover.',{bookId:historySelect[0],coverId:historySelect[1]});
+    return json(res,200,{ok:true},securityHeaders());
+  }
+
+  const retryBookCover=routeParam(url.pathname,/^\/api\/books\/([^/]+)\/cover\/retry$/);
+  if(req.method==='POST' && retryBookCover) {
+    requireWebCsrf(req);
+    const book=queueOnlineCoverRetry(db,DATA_DIR,retryBookCover[0],{reason:'user-retry-book'});
+    if(!book) return json(res,404,{error:'Book not found.'},securityHeaders());
+    info('cover.retry.book','User requested a cover retry for one book.',{bookId:book.id,title:book.title});
+    return json(res,202,{message:'Cover lookup queued for this book.'},securityHeaders());
+  }
+
+  return false;
+}
+
+const MIME={'.html':'text/html; charset=utf-8','.css':'text/css; charset=utf-8','.js':'text/javascript; charset=utf-8','.svg':'image/svg+xml','.png':'image/png','.jpg':'image/jpeg','.jpeg':'image/jpeg','.webp':'image/webp','.gif':'image/gif','.ico':'image/x-icon','.zip':'application/zip'};
+async function serveFile(res,filePath,{cache=false}={}) {
+  try {
+    const st=await fsp.stat(filePath); if(!st.isFile()) return false;
+    res.writeHead(200,securityHeaders({'Content-Type':MIME[path.extname(filePath).toLowerCase()]||'application/octet-stream','Content-Length':st.size,'Cache-Control':cache?'public, max-age=86400':'no-cache'}));
+    fs.createReadStream(filePath).pipe(res); return true;
+  } catch { return false; }
+}
+
+const server=http.createServer(async(req,res)=>{
+  try{
+    const url=new URL(req.url,`http://${req.headers.host||'localhost'}`);
+    if(url.pathname.startsWith('/api/')){
+      const handled=await handleApi(req,res,url); if(handled!==false) return;
+      return json(res,404,{error:'Not found.'},securityHeaders());
+    }
+    if(url.pathname.startsWith('/covers/')){
+      const name=path.basename(url.pathname); if(name!==url.pathname.slice('/covers/'.length)) return json(res,400,{error:'Bad path.'},securityHeaders());
+      if(await serveFile(res,path.join(COVER_DIR,name),{cache:true})) return;
+      return json(res,404,{error:'Cover not found.'},securityHeaders());
+    }
+    const requested=url.pathname==='/'?'index.html':url.pathname.slice(1);
+    const normalized=path.normalize(requested);
+    if(normalized.startsWith('..')) return json(res,400,{error:'Bad path.'},securityHeaders());
+    if(await serveFile(res,path.join(PUBLIC_DIR,normalized))) return;
+    if(await serveFile(res,path.join(PUBLIC_DIR,'index.html'))) return;
+    res.writeHead(404); res.end('Not found');
+  }catch(err){
+    const status=err.status||500;
+    if(status>=500) logError('request.error','Request failed unexpectedly.',{method:req.method,url:req.url,error:err.message,stack:err.stack});
+    else warn('request.rejected','Request rejected.',{method:req.method,url:req.url,status,error:err.message});
+    if(!res.headersSent) json(res,status,{error:err.status?err.message:'Something went wrong.'},securityHeaders()); else res.destroy();
+  }
+});
+
+server.listen(PORT,HOST,()=>info('startup.ready','kovi is ready.',{version:VERSION,url:`http://${HOST}:${PORT}`,dataDir:DATA_DIR,timeZone:TIME_ZONE,maxUploadMb:Math.round(MAX_FILE_BYTES/1024/1024)}));