@nuraly/lumenjs 0.1.2 → 0.1.4

package/dist/dev-server/nuralyui-aliases.js

@@ -4,48 +4,48 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 export const tagToPackage = {
-    'nr-alert': '@nuralyui/alert',
-    'nr-badge': '@nuralyui/badge',
-    'nr-breadcrumb': '@nuralyui/breadcrumb',
-    'nr-button': '@nuralyui/button',
-    'nr-canvas': '@nuralyui/canvas',
-    'nr-card': '@nuralyui/card',
-    'nr-chatbot': '@nuralyui/chatbot',
-    'nr-checkbox': '@nuralyui/checkbox',
-    'nr-collapse': '@nuralyui/collapse',
-    'nr-color-picker': '@nuralyui/color-picker',
-    'nr-datepicker': '@nuralyui/datepicker',
-    'nr-divider': '@nuralyui/divider',
-    'nr-document': '@nuralyui/document',
-    'nr-dropdown': '@nuralyui/dropdown',
-    'nr-file-upload': '@nuralyui/file-upload',
-    'nr-flex': '@nuralyui/flex',
-    'nr-form': '@nuralyui/forms',
-    'nr-grid': '@nuralyui/grid',
-    'nr-icon': '@nuralyui/icon',
-    'nr-image': '@nuralyui/image',
-    'nr-input': '@nuralyui/input',
-    'nr-label': '@nuralyui/label',
-    'nr-layout': '@nuralyui/layout',
-    'nr-menu': '@nuralyui/menu',
-    'nr-modal': '@nuralyui/modal',
-    'nr-panel': '@nuralyui/panel',
-    'nr-popconfirm': '@nuralyui/popconfirm',
-    'nr-radio': '@nuralyui/radio',
-    'nr-select': '@nuralyui/select',
-    'nr-skeleton': '@nuralyui/skeleton',
-    'nr-slider-input': '@nuralyui/slider-input',
-    'nr-table': '@nuralyui/table',
-    'nr-tabs': '@nuralyui/tabs',
-    'nr-tag': '@nuralyui/tag',
-    'nr-textarea': '@nuralyui/textarea',
-    'nr-timeline': '@nuralyui/timeline',
-    'nr-toast': '@nuralyui/toast',
-    'nr-video': '@nuralyui/video',
-    'nr-radio-group': '@nuralyui/radio-group',
-    'nr-iconpicker': '@nuralyui/iconpicker',
-    'nr-container': '@nuralyui/container',
-    'nr-code-editor': '@nuralyui/code-editor',
+    'nr-alert': '@nuraly/lumenui/alert',
+    'nr-badge': '@nuraly/lumenui/badge',
+    'nr-breadcrumb': '@nuraly/lumenui/breadcrumb',
+    'nr-button': '@nuraly/lumenui/button',
+    'nr-canvas': '@nuraly/lumenui/canvas',
+    'nr-card': '@nuraly/lumenui/card',
+    'nr-chatbot': '@nuraly/lumenui/chatbot',
+    'nr-checkbox': '@nuraly/lumenui/checkbox',
+    'nr-collapse': '@nuraly/lumenui/collapse',
+    'nr-color-picker': '@nuraly/lumenui/color-picker',
+    'nr-datepicker': '@nuraly/lumenui/datepicker',
+    'nr-divider': '@nuraly/lumenui/divider',
+    'nr-document': '@nuraly/lumenui/document',
+    'nr-dropdown': '@nuraly/lumenui/dropdown',
+    'nr-file-upload': '@nuraly/lumenui/file-upload',
+    'nr-flex': '@nuraly/lumenui/flex',
+    'nr-form': '@nuraly/lumenui/form',
+    'nr-grid': '@nuraly/lumenui/grid',
+    'nr-icon': '@nuraly/lumenui/icon',
+    'nr-image': '@nuraly/lumenui/image',
+    'nr-input': '@nuraly/lumenui/input',
+    'nr-label': '@nuraly/lumenui/label',
+    'nr-layout': '@nuraly/lumenui/layout',
+    'nr-menu': '@nuraly/lumenui/menu',
+    'nr-modal': '@nuraly/lumenui/modal',
+    'nr-panel': '@nuraly/lumenui/panel',
+    'nr-popconfirm': '@nuraly/lumenui/popconfirm',
+    'nr-radio': '@nuraly/lumenui/radio',
+    'nr-select': '@nuraly/lumenui/select',
+    'nr-skeleton': '@nuraly/lumenui/skeleton',
+    'nr-slider-input': '@nuraly/lumenui/slider-input',
+    'nr-table': '@nuraly/lumenui/table',
+    'nr-tabs': '@nuraly/lumenui/tabs',
+    'nr-tag': '@nuraly/lumenui/tag',
+    'nr-textarea': '@nuraly/lumenui/textarea',
+    'nr-timeline': '@nuraly/lumenui/timeline',
+    'nr-toast': '@nuraly/lumenui/toast',
+    'nr-video': '@nuraly/lumenui/video',
+    'nr-radio-group': '@nuraly/lumenui/radio-group',
+    'nr-iconpicker': '@nuraly/lumenui/iconpicker',
+    'nr-container': '@nuraly/lumenui/container',
+    'nr-code-editor': '@nuraly/lumenui/code-editor',
 };
 export const implicitDeps = {
     'nr-button': ['nr-icon'],
@@ -67,59 +67,80 @@ export const implicitDeps = {
     'nr-iconpicker': ['nr-icon'],
 };
 /**
- * NuralyUI component alias map — mirrors the studio astro.config.mjs aliases.
- * Points to the component source directories within the studio service.
+ * NuralyUI component alias map.
+ * Maps @nuraly/lumenui/* imports to component source directories.
  */
+/**
+ * Resolve a component directory to its entry file.
+ * Prefers index.ts, falls back to <dirname>.component.ts.
+ */
+function resolveComponentEntry(dirPath) {
+    const indexPath = path.join(dirPath, 'index.ts');
+    if (fs.existsSync(indexPath))
+        return indexPath;
+    const name = path.basename(dirPath);
+    const componentPath = path.join(dirPath, `${name}.component.ts`);
+    if (fs.existsSync(componentPath))
+        return componentPath;
+    return dirPath;
+}
 export function getNuralyUIAliases(nuralyUIPath, nuralyCommonPath) {
-    return {
-        '@nuralyui/alert': path.join(nuralyUIPath, 'alert'),
-        '@nuralyui/badge': path.join(nuralyUIPath, 'badge'),
-        '@nuralyui/breadcrumb': path.join(nuralyUIPath, 'breadcrumb'),
-        '@nuralyui/button': path.join(nuralyUIPath, 'button'),
-        '@nuralyui/canvas': path.join(nuralyUIPath, 'canvas'),
-        '@nuralyui/card': path.join(nuralyUIPath, 'card'),
-        '@nuralyui/chatbot': path.join(nuralyUIPath, 'chatbot'),
-        '@nuralyui/checkbox': path.join(nuralyUIPath, 'checkbox'),
-        '@nuralyui/collapse': path.join(nuralyUIPath, 'collapse'),
-        '@nuralyui/color-picker': path.join(nuralyUIPath, 'colorpicker'),
-        '@nuralyui/datepicker': path.join(nuralyUIPath, 'datepicker'),
-        '@nuralyui/divider': path.join(nuralyUIPath, 'divider'),
-        '@nuralyui/document': path.join(nuralyUIPath, 'document'),
-        '@nuralyui/dropdown': path.join(nuralyUIPath, 'dropdown'),
-        '@nuralyui/file-upload': path.join(nuralyUIPath, 'file-upload'),
-        '@nuralyui/flex': path.join(nuralyUIPath, 'flex'),
-        '@nuralyui/forms': path.join(nuralyUIPath, 'form'),
-        '@nuralyui/grid': path.join(nuralyUIPath, 'grid'),
-        '@nuralyui/icon': path.join(nuralyUIPath, 'icon'),
-        '@nuralyui/image': path.join(nuralyUIPath, 'image'),
-        '@nuralyui/input': path.join(nuralyUIPath, 'input'),
-        '@nuralyui/label': path.join(nuralyUIPath, 'label'),
-        '@nuralyui/layout': path.join(nuralyUIPath, 'layout'),
-        '@nuralyui/menu': path.join(nuralyUIPath, 'menu'),
-        '@nuralyui/modal': path.join(nuralyUIPath, 'modal'),
-        '@nuralyui/panel': path.join(nuralyUIPath, 'panel'),
-        '@nuralyui/popconfirm': path.join(nuralyUIPath, 'popconfirm'),
-        '@nuralyui/radio': path.join(nuralyUIPath, 'radio'),
-        '@nuralyui/select': path.join(nuralyUIPath, 'select'),
-        '@nuralyui/skeleton': path.join(nuralyUIPath, 'skeleton'),
-        '@nuralyui/slider-input': path.join(nuralyUIPath, 'slider-input'),
-        '@nuralyui/table': path.join(nuralyUIPath, 'table'),
-        '@nuralyui/tabs': path.join(nuralyUIPath, 'tabs'),
-        '@nuralyui/tag': path.join(nuralyUIPath, 'tag'),
-        '@nuralyui/textarea': path.join(nuralyUIPath, 'textarea'),
-        '@nuralyui/timeline': path.join(nuralyUIPath, 'timeline'),
-        '@nuralyui/toast': path.join(nuralyUIPath, 'toast'),
-        '@nuralyui/video': path.join(nuralyUIPath, 'video'),
-        '@nuralyui/radio-group': path.join(nuralyUIPath, 'radio-group'),
-        '@nuralyui/iconpicker': path.join(nuralyUIPath, 'iconpicker'),
-        '@nuralyui/container': path.join(nuralyUIPath, 'container'),
-        '@nuralyui/code-editor': path.join(nuralyUIPath, 'code-editor'),
-        '@nuralyui/common/controllers': path.join(nuralyCommonPath, 'controllers.ts'),
-        '@nuralyui/common/mixins': path.join(nuralyCommonPath, 'mixins.ts'),
-        '@nuralyui/common/utils': path.join(nuralyCommonPath, 'utils.ts'),
-        '@nuralyui/common/themes': path.join(nuralyCommonPath, 'themes.ts'),
-        '@nuralyui/common': path.join(nuralyCommonPath, 'index.ts'),
+    const componentNames = {
+        '@nuraly/lumenui/alert': 'alert',
+        '@nuraly/lumenui/badge': 'badge',
+        '@nuraly/lumenui/breadcrumb': 'breadcrumb',
+        '@nuraly/lumenui/button': 'button',
+        '@nuraly/lumenui/canvas': 'canvas',
+        '@nuraly/lumenui/card': 'card',
+        '@nuraly/lumenui/chatbot': 'chatbot',
+        '@nuraly/lumenui/checkbox': 'checkbox',
+        '@nuraly/lumenui/collapse': 'collapse',
+        '@nuraly/lumenui/color-picker': 'colorpicker',
+        '@nuraly/lumenui/datepicker': 'datepicker',
+        '@nuraly/lumenui/divider': 'divider',
+        '@nuraly/lumenui/document': 'document',
+        '@nuraly/lumenui/dropdown': 'dropdown',
+        '@nuraly/lumenui/file-upload': 'file-upload',
+        '@nuraly/lumenui/flex': 'flex',
+        '@nuraly/lumenui/form': 'form',
+        '@nuraly/lumenui/grid': 'grid',
+        '@nuraly/lumenui/icon': 'icon',
+        '@nuraly/lumenui/image': 'image',
+        '@nuraly/lumenui/input': 'input',
+        '@nuraly/lumenui/label': 'label',
+        '@nuraly/lumenui/layout': 'layout',
+        '@nuraly/lumenui/menu': 'menu',
+        '@nuraly/lumenui/modal': 'modal',
+        '@nuraly/lumenui/panel': 'panel',
+        '@nuraly/lumenui/popconfirm': 'popconfirm',
+        '@nuraly/lumenui/radio': 'radio',
+        '@nuraly/lumenui/select': 'select',
+        '@nuraly/lumenui/skeleton': 'skeleton',
+        '@nuraly/lumenui/slider-input': 'slider-input',
+        '@nuraly/lumenui/table': 'table',
+        '@nuraly/lumenui/tabs': 'tabs',
+        '@nuraly/lumenui/tag': 'tag',
+        '@nuraly/lumenui/textarea': 'textarea',
+        '@nuraly/lumenui/timeline': 'timeline',
+        '@nuraly/lumenui/toast': 'toast',
+        '@nuraly/lumenui/video': 'video',
+        '@nuraly/lumenui/radio-group': 'radio-group',
+        '@nuraly/lumenui/iconpicker': 'iconpicker',
+        '@nuraly/lumenui/container': 'container',
+        '@nuraly/lumenui/code-editor': 'code-editor',
     };
+    const aliases = {};
+    for (const [pkg, dir] of Object.entries(componentNames)) {
+        aliases[pkg] = resolveComponentEntry(path.join(nuralyUIPath, dir));
+    }
+    // Workflow canvas only — excludes whiteboard/mermaid for environments without mermaid
+    aliases['@nuraly/lumenui/workflow-canvas'] = path.join(nuralyUIPath, 'canvas/workflow-canvas-only.ts');
+    aliases['@nuralyui/common/controllers'] = path.join(nuralyCommonPath, 'controllers.ts');
+    aliases['@nuralyui/common/mixins'] = path.join(nuralyCommonPath, 'mixins.ts');
+    aliases['@nuralyui/common/utils'] = path.join(nuralyCommonPath, 'utils.ts');
+    aliases['@nuralyui/common/themes'] = path.join(nuralyCommonPath, 'themes.ts');
+    aliases['@nuralyui/common'] = path.join(nuralyCommonPath, 'index.ts');
+    return aliases;
 }
 /**
  * Resolves the NuralyUI source path dynamically.
@@ -127,9 +148,9 @@ export function getNuralyUIAliases(nuralyUIPath, nuralyCommonPath) {
  * then falls back to well-known paths and environment variable.
  */
 export function resolveNuralyUIPaths(projectDir) {
-    const nuralyUIRelPath = 'services/studio/src/features/runtime/components/ui/nuraly-ui';
+    const nuralyUIRelPath = 'libs/nuraly-ui';
     const candidates = [
-        // Walk up from project dir to find the monorepo root containing services/
+        // Walk up from project dir to find the monorepo root containing libs/
         findMonorepoRoot(projectDir, nuralyUIRelPath),
         // Relative to lumenjs lib (in-repo: libs/lumenjs → repo root)
         path.resolve(__dirname, '../../..', nuralyUIRelPath),

package/dist/dev-server/plugins/vite-plugin-api-routes.js

@@ -1,6 +1,7 @@
 import path from 'path';
 import fs from 'fs';
 import { readBody } from '../../shared/utils.js';
+import { useStorage } from '../../storage/index.js';
 /**
  * LumenJS API Routes plugin.
  *
@@ -42,6 +43,9 @@ export function lumenApiRoutesPlugin(apiDir, projectDir) {
                 // Map /api/foo/bar → api/foo/bar.ts
                 const routePath = pathname.replace(/^\//, '');
                 const filePath = findApiFile(apiDir, routePath);
+                if (filePath && !filePath.startsWith(path.resolve(apiDir) + path.sep)) {
+                    return next();
+                }
                 if (!filePath) {
                     return next();
                 }
@@ -78,11 +82,21 @@ export function lumenApiRoutesPlugin(apiDir, projectDir) {
                         files,
                         headers: req.headers,
                         projectDir: projectDir || path.dirname(apiDir),
+                        nkAuth: req.nkAuth || null,
+                        storage: useStorage(),
                     };
                     const result = await handler(nkRequest);
-                    res.statusCode = 200;
-                    res.setHeader('Content-Type', 'application/json');
-                    res.end(JSON.stringify(result));
+                    if (result && result.__nk_binary && Buffer.isBuffer(result.body)) {
+                        res.statusCode = result.status || 200;
+                        for (const [k, v] of Object.entries(result.headers || {}))
+                            res.setHeader(k, v);
+                        res.end(result.body);
+                    }
+                    else {
+                        res.statusCode = 200;
+                        res.setHeader('Content-Type', 'application/json');
+                        res.end(JSON.stringify(result));
+                    }
                 }
                 catch (err) {
                     const status = err?.status || 500;
@@ -167,10 +181,20 @@ function extractParams(apiDir, routePath, filePath) {
     }
     return params;
 }
-function readRawBody(req) {
+const MAX_API_BODY = 10 * 1024 * 1024; // 10 MB
+function readRawBody(req, maxSize = MAX_API_BODY) {
     return new Promise((resolve, reject) => {
         const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > maxSize) {
+                req.destroy();
+                reject(new Error('Request body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
         req.on('end', () => resolve(Buffer.concat(chunks)));
         req.on('error', reject);
     });

package/dist/dev-server/plugins/vite-plugin-auth.d.ts

@@ -0,0 +1,6 @@
+import { Plugin } from 'vite';
+/**
+ * Vite dev plugin for authentication.
+ * Registers auth session middleware, auth route handlers, and guard enforcement.
+ */
+export declare function authPlugin(projectDir: string): Plugin;

package/dist/dev-server/plugins/vite-plugin-auth.js

@@ -0,0 +1,223 @@
+import path from 'path';
+import { loadAuthConfig } from '../../auth/config.js';
+import { createAuthMiddleware } from '../../auth/middleware.js';
+import { handleAuthRoutes } from '../../auth/routes.js';
+import { enforceGuard } from '../../auth/guard.js';
+import { hasNativeAuth } from '../../auth/config.js';
+import { enforcePermissionGuard, isPermissionGuard } from '../../permissions/guard.js';
+import { ensurePermissionTables } from '../../permissions/tables.js';
+import { PermissionService } from '../../permissions/service.js';
+import { loadEmailConfig, sendEmail, renderEmailTemplate } from '../../email/index.js';
+import { setProjectDir } from '../../db/context.js';
+import { useDb, waitForMigrations } from '../../db/index.js';
+import { ensureUsersTable } from '../../auth/native-auth.js';
+import fs from 'fs';
+/** Run seed.ts via Vite ssrLoadModule so TypeScript is handled. Only runs once per DB. */
+async function runPgSeedIfNeeded(server, db, projectDir) {
+    const seedPath = path.join(projectDir, 'data', 'seed.ts');
+    if (!fs.existsSync(seedPath))
+        return;
+    try {
+        await db.exec(`CREATE TABLE IF NOT EXISTS _lumen_seed_applied (
+      name TEXT PRIMARY KEY,
+      applied_at TIMESTAMP NOT NULL DEFAULT NOW()
+    )`);
+        const row = await db.get('SELECT 1 FROM _lumen_seed_applied WHERE name = $1', 'data/seed.ts');
+        if (row)
+            return;
+        await db.run('INSERT INTO _lumen_seed_applied (name) VALUES ($1) ON CONFLICT DO NOTHING', 'data/seed.ts');
+        console.log('[LumenJS] Running seed file (PG)...');
+        const mod = await server.ssrLoadModule(seedPath);
+        const seedFn = mod.default || mod;
+        if (typeof seedFn === 'function')
+            await seedFn();
+        console.log('[LumenJS] Seed applied (PG).');
+    }
+    catch (err) {
+        try {
+            await db.run('DELETE FROM _lumen_seed_applied WHERE name = $1', 'data/seed.ts');
+        }
+        catch { }
+        console.error('[LumenJS] PG seed failed:', err.message);
+    }
+}
+/**
+ * Extract URL params by matching a route pattern against a path.
+ * Pattern: /apps/workflows/:workflowId → { workflowId: 'abc-123' }
+ */
+function matchRouteParams(pattern, pathname) {
+    const params = {};
+    const patternParts = pattern.split('/');
+    const pathParts = pathname.split('/');
+    for (let i = 0; i < patternParts.length; i++) {
+        if (patternParts[i].startsWith(':')) {
+            const key = patternParts[i].slice(1);
+            if (pathParts[i])
+                params[key] = decodeURIComponent(pathParts[i]);
+        }
+    }
+    return params;
+}
+/**
+ * Vite dev plugin for authentication.
+ * Registers auth session middleware, auth route handlers, and guard enforcement.
+ */
+export function authPlugin(projectDir) {
+    let authConfig = null;
+    let db = null;
+    let permissionService = null;
+    return {
+        name: 'lumenjs-auth',
+        configureServer(server) {
+            // 1. Auth session middleware — parse cookie, attach req.nkAuth
+            server.middlewares.use(async (req, res, next) => {
+                if (!authConfig) {
+                    try {
+                        authConfig = await loadAuthConfig(projectDir, server.ssrLoadModule.bind(server));
+                        // Auto-wire email sending if email plugin is configured and auth has no custom onEvent
+                        if (authConfig && !authConfig.onEvent) {
+                            try {
+                                const emailConfig = await loadEmailConfig(projectDir, server.ssrLoadModule.bind(server));
+                                if (emailConfig) {
+                                    const { readProjectConfig } = await import('../../dev-server/config.js');
+                                    const appName = readProjectConfig(projectDir).title;
+                                    authConfig.onEvent = async (event) => {
+                                        try {
+                                            const data = { appName, url: event.type === 'password-changed' ? '' : event.url, email: event.email };
+                                            if (event.type === 'verification-email') {
+                                                const html = renderEmailTemplate(emailConfig, 'verify-email', data);
+                                                if (html)
+                                                    await sendEmail(emailConfig, { to: event.email, subject: `Verify your email - ${appName}`, html });
+                                            }
+                                            else if (event.type === 'password-reset') {
+                                                const html = renderEmailTemplate(emailConfig, 'password-reset', data);
+                                                if (html)
+                                                    await sendEmail(emailConfig, { to: event.email, subject: `Reset your password - ${appName}`, html });
+                                            }
+                                        }
+                                        catch (emailErr) {
+                                            console.error('[LumenJS Email] Failed to send:', emailErr?.message);
+                                        }
+                                    };
+                                    console.log('[LumenJS] Email auto-wired with auth module');
+                                }
+                            }
+                            catch { }
+                        }
+                        // Initialize DB for native auth
+                        if (authConfig && hasNativeAuth(authConfig) && !db) {
+                            try {
+                                setProjectDir(projectDir);
+                                db = useDb();
+                                await waitForMigrations();
+                                // Run PG seed via ssrLoadModule so TypeScript is handled
+                                if (db.isPg) {
+                                    await runPgSeedIfNeeded(server, db, projectDir);
+                                }
+                                await ensureUsersTable(db);
+                                if (authConfig.permissions.enabled) {
+                                    await ensurePermissionTables(db);
+                                    permissionService = new PermissionService(db, authConfig.permissions);
+                                    console.log('[LumenJS] Permission module initialized');
+                                }
+                            }
+                            catch (dbErr) {
+                                console.warn('[LumenJS Auth] DB init failed, native auth disabled:', dbErr?.message);
+                            }
+                        }
+                    }
+                    catch (err) {
+                        console.error('[LumenJS Auth] Failed to load config:', err);
+                        return next();
+                    }
+                }
+                if (!authConfig)
+                    return next();
+                const middleware = createAuthMiddleware(authConfig, db);
+                middleware(req, res, next);
+            });
+            // 2. Auth route handlers — login, callback, logout, me
+            server.middlewares.use(async (req, res, next) => {
+                if (!authConfig)
+                    return next();
+                const url = req.url || '';
+                if (!url.startsWith('/__nk_auth/'))
+                    return next();
+                try {
+                    const handled = await handleAuthRoutes(authConfig, req, res, db);
+                    if (!handled)
+                        next();
+                }
+                catch (err) {
+                    console.error('[LumenJS Auth] Route handler error:', err);
+                    next();
+                }
+            });
+            // 3. Guard enforcement — check page auth export, redirect/403
+            server.middlewares.use(async (req, res, next) => {
+                if (!authConfig)
+                    return next();
+                const url = req.url || '';
+                // Only enforce on page requests (no static files, no API, no internal)
+                const lastSegment = url.split('?')[0].split('/').pop() || '';
+                const isStaticFile = lastSegment.includes('.') && /\.\w{1,10}$/.test(lastSegment);
+                if (isStaticFile || url.startsWith('/@') || url.startsWith('/__nk_') || url.startsWith('/api/') || url.startsWith('/node_modules')) {
+                    return next();
+                }
+                try {
+                    const pagesDir = path.join(projectDir, 'pages');
+                    const { resolvePageFile } = await import('./vite-plugin-loaders.js');
+                    const pageFile = resolvePageFile(pagesDir, url.split('?')[0]);
+                    if (!pageFile)
+                        return next();
+                    const mod = await server.ssrLoadModule(pageFile);
+                    const authExport = mod.auth ?? (authConfig.guards.defaultAuth ? true : null);
+                    if (!authExport)
+                        return next();
+                    // Permission guard: { permission: 'workflow:read', resourceParam: 'workflowId' }
+                    let result;
+                    if (isPermissionGuard(authExport) && permissionService) {
+                        // Extract URL params from the page file path pattern
+                        const { filePathToRoute } = await import('../../shared/utils.js');
+                        const routePattern = filePathToRoute(path.relative(pagesDir, pageFile));
+                        const urlParams = matchRouteParams(routePattern, url.split('?')[0]);
+                        result = await enforcePermissionGuard(authExport, req.nkAuth?.user, authConfig.routes.loginPage, url, urlParams, permissionService);
+                    }
+                    else {
+                        result = enforceGuard(authExport, req.nkAuth, authConfig.routes.loginPage, url);
+                    }
+                    if ('redirect' in result) {
+                        res.writeHead(302, { Location: result.redirect });
+                        res.end();
+                        return;
+                    }
+                    if ('forbidden' in result) {
+                        res.writeHead(403, { 'Content-Type': 'text/plain' });
+                        res.end('Forbidden');
+                        return;
+                    }
+                    next();
+                }
+                catch (guardErr) {
+                    console.error('[LumenJS Auth] Guard error:', guardErr?.message);
+                    next();
+                }
+            });
+        },
+        // Strip `export const auth = ...` from client code and add __nk_has_auth flag
+        transform(code, id, options) {
+            if (options?.ssr)
+                return;
+            const pagesDir = path.join(projectDir, 'pages');
+            if (!id.startsWith(pagesDir))
+                return;
+            if (!/export\s+const\s+auth\s*=/.test(code))
+                return;
+            // Strip the auth export statement
+            let transformed = code.replace(/export\s+const\s+auth\s*=\s*[^;]+;/g, '');
+            // Add client-side flags
+            transformed += '\nexport const __nk_has_auth = true;\n';
+            return { code: transformed, map: null };
+        },
+    };
+}

package/dist/dev-server/plugins/vite-plugin-auto-define.d.ts

@@ -0,0 +1,16 @@
+import { Plugin } from 'vite';
+/**
+ * Auto-registers custom elements for page and layout files.
+ *
+ * Scans for the exported class that extends LitElement and appends a
+ * `customElements.define('tag-name', ClassName)` call. The tag name is
+ * derived from the file path using the same convention the router uses:
+ *
+ *   pages/index.ts          → page-index
+ *   pages/docs/routing.ts   → page-docs-routing
+ *   pages/_layout.ts        → layout-root
+ *   pages/docs/_layout.ts   → layout-docs
+ *
+ * This removes the need for `@customElement('...')` in page/layout files.
+ */
+export declare function autoDefinePlugin(pagesDir: string): Plugin;