@nuraly/lumenjs 0.1.3 → 0.1.4

package/dist/dev-server/plugins/vite-plugin-i18n.js

@@ -47,10 +47,77 @@ export function i18nPlugin(projectDir, config) {
                     res.end(JSON.stringify({ error: 'Invalid locale file' }));
                 }
             });
-            // Watch locale directory for changes and trigger HMR
+            // Watch locale files for changes and send HMR event.
+            // Uses fs.watchFile (stat-based polling) instead of inotify/chokidar so
+            // it works reliably inside Docker containers where inotify misses changes.
             if (fs.existsSync(localesDir)) {
-                server.watcher.add(localesDir);
+                for (const locale of config.locales) {
+                    const filePath = path.join(localesDir, `${locale}.json`);
+                    if (!fs.existsSync(filePath))
+                        continue;
+                    fs.watchFile(filePath, { interval: 500 }, (curr, prev) => {
+                        if (curr.mtimeMs === prev.mtimeMs)
+                            return;
+                        server.ws.send({
+                            type: 'custom',
+                            event: 'lumenjs:i18n-update',
+                            data: { locale },
+                        });
+                    });
+                }
+                server.httpServer?.on('close', () => {
+                    for (const locale of config.locales) {
+                        fs.unwatchFile(path.join(localesDir, `${locale}.json`));
+                    }
+                });
+            }
+        },
+        transformIndexHtml() {
+            return [
+                {
+                    tag: 'script',
+                    attrs: { type: 'module' },
+                    children: `
+// i18n HMR: listen on Vite's WebSocket for locale file changes.
+// Uses window.__lumenjs_i18n_reload (set by the i18n runtime) to update
+// translations in the correct module instance — avoids the duplicate-module
+// problem caused by Vite's cache-busting query strings on /@fs/ imports.
+import { createHotContext } from '/@vite/client';
+const hot = createHotContext('/__nk_i18n_hmr');
+hot.on('lumenjs:i18n-update', async ({ locale }) => {
+  const reload = window.__lumenjs_i18n_reload;
+  if (!reload) return;
+  const updated = await reload(locale);
+  if (!updated) return;
+  function __updateAll(root) {
+    for (const el of root.querySelectorAll('*')) {
+      if (el.requestUpdate) {
+        // Clear Lit's template cache to force a full re-render.
+        // Deleting _$litPart$ forces Lit to re-create the template from scratch.
+        if (el.renderRoot) {
+          if ('_$litPart$' in el.renderRoot) {
+            delete el.renderRoot['_$litPart$'];
+          } else {
+            for (const s of Object.getOwnPropertySymbols(el.renderRoot)) {
+              const v = el.renderRoot[s];
+              if (v && typeof v === 'object' && '_$committedValue' in v) {
+                v._$committedValue = undefined;
+                break;
+              }
             }
+          }
+        }
+        el.requestUpdate();
+      }
+      if (el.shadowRoot) __updateAll(el.shadowRoot);
+    }
+  }
+  __updateAll(document);
+});
+`,
+                    injectTo: 'body',
+                },
+            ];
         },
     };
 }

package/dist/dev-server/plugins/vite-plugin-lit-dedup.d.ts

@@ -1,5 +1,11 @@
 import { Plugin } from 'vite';
 /**
  * Force ALL lit imports to resolve to lumenjs's single lit copy.
+ *
+ * Instead of returning absolute paths directly (which bypasses Vite's ?v= cache
+ * busting and causes module duplication), we resolve the correct entry point
+ * from package.json exports, then delegate to Vite's resolver using a fake
+ * importer within lumenjs node_modules. This ensures consistent ?v= hashing
+ * across all import chains.
  */
 export declare function litDedupPlugin(lumenNodeModules: string, isDev: boolean): Plugin;

package/dist/dev-server/plugins/vite-plugin-lit-dedup.js

@@ -2,12 +2,76 @@ import path from 'path';
 import fs from 'fs';
 /**
  * Force ALL lit imports to resolve to lumenjs's single lit copy.
+ *
+ * Instead of returning absolute paths directly (which bypasses Vite's ?v= cache
+ * busting and causes module duplication), we resolve the correct entry point
+ * from package.json exports, then delegate to Vite's resolver using a fake
+ * importer within lumenjs node_modules. This ensures consistent ?v= hashing
+ * across all import chains.
  */
 export function litDedupPlugin(lumenNodeModules, isDev) {
+    // Cache resolved export paths per (pkgName, subpath) to avoid repeated pkg.json reads
+    const exportCache = new Map();
+    function resolveExport(pkgName, subpath, ssr) {
+        const cacheKey = `${pkgName}:${subpath}:${ssr}`;
+        if (exportCache.has(cacheKey))
+            return exportCache.get(cacheKey);
+        const pkgDir = path.join(lumenNodeModules, pkgName);
+        if (!fs.existsSync(pkgDir)) {
+            exportCache.set(cacheKey, null);
+            return null;
+        }
+        let resolved = null;
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf-8'));
+            const exports = pkg.exports;
+            if (exports) {
+                const exportKey = subpath ? './' + subpath : '.';
+                const entry = exports[exportKey];
+                if (entry) {
+                    let entryPath;
+                    if (ssr) {
+                        entryPath = isDev
+                            ? (entry?.node?.development || entry?.node?.default || entry?.node || entry?.development || entry?.default || entry)
+                            : (entry?.node?.default || entry?.node || entry?.default || entry);
+                    }
+                    else {
+                        entryPath = isDev
+                            ? (entry?.browser?.development || entry?.development || entry?.browser?.default || entry?.default || entry)
+                            : (entry?.browser?.default || entry?.browser || entry?.default || entry);
+                    }
+                    if (typeof entryPath === 'string') {
+                        let finalPath = entryPath;
+                        // In dev mode, prefer development/ builds to avoid mixing prod/dev modules
+                        if (isDev && !entryPath.includes('/development/')) {
+                            const devEntryPath = entryPath.replace(/^\.\//, '');
+                            const devFullPath = path.join(pkgDir, 'development', devEntryPath);
+                            if (fs.existsSync(devFullPath)) {
+                                finalPath = './development/' + devEntryPath;
+                            }
+                        }
+                        resolved = finalPath;
+                    }
+                }
+            }
+            if (!resolved && subpath) {
+                resolved = './' + subpath;
+            }
+            if (!resolved) {
+                const entry = pkg.module || pkg.main || 'index.js';
+                resolved = './' + entry;
+            }
+        }
+        catch {
+            resolved = subpath ? './' + subpath : null;
+        }
+        exportCache.set(cacheKey, resolved);
+        return resolved;
+    }
     return {
         name: 'lumenjs-lit-dedup',
         enforce: 'pre',
-        resolveId(source, importer, options) {
+        async resolveId(source, importer, options) {
             if (!importer)
                 return;
             const isLitImport = source === 'lit' || source.startsWith('lit/')
@@ -23,40 +87,20 @@ export function litDedupPlugin(lumenNodeModules, isDev) {
             const pkgName = source.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
             const subpath = source.startsWith('@') ? parts.slice(2).join('/') : parts.slice(1).join('/');
             const pkgDir = path.join(lumenNodeModules, pkgName);
-            if (!fs.existsSync(pkgDir))
+            const resolved = resolveExport(pkgName, subpath, !!options?.ssr);
+            if (!resolved)
                 return;
-            try {
-                const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf-8'));
-                const exports = pkg.exports;
-                if (exports) {
-                    const exportKey = subpath ? './' + subpath : '.';
-                    const entry = exports[exportKey];
-                    if (entry) {
-                        let resolved;
-                        if (options?.ssr) {
-                            resolved = isDev
-                                ? (entry?.node?.development || entry?.node?.default || entry?.node || entry?.development || entry?.default || entry)
-                                : (entry?.node?.default || entry?.node || entry?.default || entry);
-                        }
-                        else {
-                            resolved = isDev
-                                ? (entry?.browser?.development || entry?.development || entry?.browser?.default || entry?.default || entry)
-                                : (entry?.browser?.default || entry?.browser || entry?.default || entry);
-                        }
-                        if (typeof resolved === 'string') {
-                            return path.join(pkgDir, resolved);
-                        }
-                    }
-                }
-                if (subpath) {
-                    return path.join(pkgDir, subpath);
-                }
-                const entry = pkg.module || pkg.main || 'index.js';
-                return path.join(pkgDir, entry);
-            }
-            catch {
-                return subpath ? path.join(pkgDir, subpath) : pkgDir;
-            }
+            // Compute the absolute path for the resolved entry
+            const absolutePath = path.join(pkgDir, resolved);
+            // Delegate to Vite's resolver using a fake importer inside lumenjs node_modules.
+            // This ensures Vite's importAnalysis adds consistent ?v= cache busting,
+            // preventing module duplication between different import chains.
+            const fakeImporter = path.join(lumenNodeModules, '_lumenjs_dedup_anchor.js');
+            const result = await this.resolve(absolutePath, fakeImporter, { skipSelf: true });
+            if (result)
+                return result;
+            // Fallback to absolute path if Vite's resolver fails
+            return absolutePath;
         }
     };
 }

package/dist/dev-server/plugins/vite-plugin-lit-hmr.js

@@ -26,15 +26,57 @@ if (import.meta.hot) {
       if (key === "constructor") continue;
       Object.defineProperty(OldClass.prototype, key, desc);
     }
+    const newCssText = NewClass.styles?.cssText || '';
     if (NewClass.styles) {
       OldClass.styles = NewClass.styles;
       OldClass.elementStyles = undefined;
-      OldClass.finalizeStyles();
+      OldClass.finalized = false;
+      try { OldClass.finalizeStyles(); } catch {}
     }
     if (NewClass.properties) {
       OldClass.properties = NewClass.properties;
     }
-    document.querySelectorAll("${tagName}").forEach((el) => {
+    function __queryShadowAll(root, sel) {
+      const results = [...root.querySelectorAll(sel)];
+      for (const el of root.querySelectorAll('*')) {
+        if (el.shadowRoot) results.push(...__queryShadowAll(el.shadowRoot, sel));
+      }
+      return results;
+    }
+    __queryShadowAll(document, "${tagName}").forEach((el) => {
+      if (el.renderRoot) {
+        // Update styles: try adoptedStyleSheets first, fall back to <style> tag
+        if (OldClass.elementStyles && OldClass.elementStyles.length > 0) {
+          const sheets = OldClass.elementStyles
+            .filter(s => s instanceof CSSStyleSheet || (s && s.styleSheet))
+            .map(s => s instanceof CSSStyleSheet ? s : s.styleSheet);
+          if (sheets.length && el.renderRoot.adoptedStyleSheets !== undefined) {
+            el.renderRoot.adoptedStyleSheets = sheets;
+          }
+        } else if (newCssText) {
+          const styleEl = el.renderRoot.querySelector('style');
+          if (styleEl) styleEl.textContent = newCssText;
+        }
+        // Clear stale SSR inline styles from child elements
+        el.renderRoot.querySelectorAll('[style]').forEach((child) => {
+          child.removeAttribute('style');
+        });
+        // Clear Lit's template cache to force a full re-render.
+        // Deleting the ChildPart forces Lit to re-create the entire template
+        // from scratch instead of diffing against stale cached values.
+        if ('_$litPart$' in el.renderRoot) {
+          delete el.renderRoot['_$litPart$'];
+        } else {
+          // Lit 2.x fallback: clear via symbols
+          for (const s of Object.getOwnPropertySymbols(el.renderRoot)) {
+            const v = el.renderRoot[s];
+            if (v && typeof v === 'object' && '_$committedValue' in v) {
+              v._$committedValue = undefined;
+              break;
+            }
+          }
+        }
+      }
       if (el.requestUpdate) el.requestUpdate();
     });
   });

package/dist/dev-server/plugins/vite-plugin-llms.d.ts

@@ -0,0 +1,2 @@
+import type { Plugin } from 'vite';
+export declare function lumenLlmsPlugin(projectDir: string): Plugin;

package/dist/dev-server/plugins/vite-plugin-llms.js

@@ -0,0 +1,92 @@
+import fs from 'fs';
+import path from 'path';
+import { scanPages, scanApiRoutes } from '../../build/scan.js';
+import { readProjectConfig } from '../config.js';
+import { fileGetApiMethods } from '../../shared/utils.js';
+import { generateLlmsTxt, resolveDynamicEntries } from '../../llms/generate.js';
+export function lumenLlmsPlugin(projectDir) {
+    const pagesDir = path.join(projectDir, 'pages');
+    const apiDir = path.join(projectDir, 'api');
+    return {
+        name: 'lumenjs-llms',
+        configureServer(server) {
+            server.middlewares.use(async (req, res, next) => {
+                const url = (req.url || '').split('?')[0];
+                if (url !== '/llms.txt')
+                    return next();
+                // Check for user override in public/
+                const publicOverride = path.join(projectDir, 'public', 'llms.txt');
+                if (fs.existsSync(publicOverride)) {
+                    // Let Vite's static serving handle it
+                    return next();
+                }
+                try {
+                    const config = readProjectConfig(projectDir);
+                    const pages = scanPages(pagesDir);
+                    const apiEntries = scanApiRoutes(apiDir);
+                    // Build API routes with methods
+                    const apiRoutes = apiEntries.map(entry => ({
+                        path: entry.routePath,
+                        methods: fileGetApiMethods(entry.filePath),
+                    })).filter(r => r.methods.length > 0);
+                    // Build page data with loader resolution
+                    const llmsPages = [];
+                    for (const page of pages) {
+                        const llmsPage = {
+                            path: page.routePath,
+                            hasLoader: page.hasLoader,
+                            hasSubscribe: page.hasSubscribe,
+                        };
+                        if (page.hasLoader) {
+                            const isDynamic = page.routePath.includes(':');
+                            if (isDynamic) {
+                                // Extract param name from route like /blog/:slug
+                                const paramMatch = page.routePath.match(/:([^/]+)/);
+                                const paramName = paramMatch ? paramMatch[1] : '';
+                                if (paramName) {
+                                    const entries = await resolveDynamicEntries({ path: page.routePath, paramName }, (filePath) => server.ssrLoadModule(filePath), pages.map(p => ({ path: p.routePath, filePath: p.filePath, hasLoader: p.hasLoader })));
+                                    if (entries) {
+                                        llmsPage.dynamicEntries = entries;
+                                    }
+                                }
+                            }
+                            else {
+                                // Static page — call loader directly
+                                try {
+                                    const mod = await server.ssrLoadModule(page.filePath);
+                                    if (mod?.loader) {
+                                        const data = await mod.loader({ params: {}, query: {}, url: page.routePath, headers: {} });
+                                        if (data && !data.__nk_redirect) {
+                                            llmsPage.loaderData = data;
+                                        }
+                                    }
+                                }
+                                catch {
+                                    // Skip loader errors
+                                }
+                            }
+                        }
+                        llmsPages.push(llmsPage);
+                    }
+                    const content = generateLlmsTxt({
+                        title: config.title,
+                        pages: llmsPages,
+                        apiRoutes,
+                        integrations: config.integrations,
+                        i18n: config.i18n ? { locales: config.i18n.locales, defaultLocale: config.i18n.defaultLocale } : undefined,
+                        db: config.db,
+                    });
+                    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                    res.setHeader('Cache-Control', 'no-store');
+                    res.statusCode = 200;
+                    res.end(content);
+                }
+                catch (err) {
+                    console.error('[LumenJS] Error generating llms.txt:', err);
+                    res.statusCode = 500;
+                    res.end('Error generating llms.txt');
+                }
+            });
+        },
+    };
+}

package/dist/dev-server/plugins/vite-plugin-loaders.js

@@ -61,6 +61,11 @@ export function lumenLoadersPlugin(pagesDir) {
                     delete query.__params;
                 }
                 const filePath = resolvePageFile(pagesDir, pagePath);
+                if (filePath && !filePath.startsWith(path.resolve(pagesDir) + path.sep)) {
+                    res.statusCode = 400;
+                    res.end();
+                    return;
+                }
                 if (!filePath) {
                     res.statusCode = 404;
                     res.end();
@@ -87,7 +92,7 @@ export function lumenLoadersPlugin(pagesDir) {
                     const push = (data) => {
                         res.write(`data: ${JSON.stringify(data)}\n\n`);
                     };
-                    const cleanup = mod.subscribe({ params, push, headers: req.headers, locale });
+                    const cleanup = mod.subscribe({ params, push, headers: req.headers, locale, user: req.nkAuth?.user ?? null });
                     res.on('close', () => {
                         if (typeof cleanup === 'function')
                             cleanup();
@@ -131,8 +136,14 @@ export function lumenLoadersPlugin(pagesDir) {
                     catch { /* ignore */ }
                     delete query.__params;
                 }
-                // Find the page file
+                // Find the page file (validate path stays within pagesDir)
                 const filePath = resolvePageFile(pagesDir, pagePath);
+                if (filePath && !filePath.startsWith(path.resolve(pagesDir) + path.sep)) {
+                    res.statusCode = 400;
+                    res.setHeader('Content-Type', 'application/json');
+                    res.end(JSON.stringify({ error: 'Invalid page path' }));
+                    return;
+                }
                 if (!filePath) {
                     res.statusCode = 404;
                     res.setHeader('Content-Type', 'application/json');
@@ -157,7 +168,43 @@ export function lumenLoadersPlugin(pagesDir) {
                     // Extract locale from query if provided by the client router
                     const locale = query.__locale;
                     delete query.__locale;
-                    const result = await mod.loader({ params, query, url: pagePath, headers: req.headers, locale });
+                    // If auth middleware hasn't populated nkAuth, try to parse from cookie or bearer token
+                    let user = req.nkAuth?.user ?? null;
+                    if (!user) {
+                        try {
+                            const authConfigPath = path.join(pagesDir, '..', 'lumenjs.auth.ts');
+                            if (fs.existsSync(authConfigPath)) {
+                                const { loadAuthConfig } = await import('../../auth/config.js');
+                                const authCfg = await loadAuthConfig(path.join(pagesDir, '..'), server.ssrLoadModule.bind(server));
+                                if (authCfg) {
+                                    // Try bearer token first
+                                    const authHeader = req.headers.authorization;
+                                    if (authHeader?.startsWith('Bearer ')) {
+                                        const { verifyAccessToken } = await import('../../auth/token.js');
+                                        const tokenUser = verifyAccessToken(authHeader.slice(7), authCfg.session.secret);
+                                        if (tokenUser) {
+                                            user = tokenUser;
+                                            req.nkAuth = { user: tokenUser, session: { accessToken: authHeader.slice(7), expiresAt: 0, user: tokenUser } };
+                                        }
+                                    }
+                                    // Fall back to cookie
+                                    if (!user && req.headers.cookie) {
+                                        const { parseSessionCookie, decryptSession } = await import('../../auth/session.js');
+                                        const cookieVal = parseSessionCookie(req.headers.cookie, authCfg.session.cookieName);
+                                        if (cookieVal) {
+                                            const session = await decryptSession(cookieVal, authCfg.session.secret);
+                                            if (session?.user) {
+                                                user = session.user;
+                                                req.nkAuth = { user: session.user, session };
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        catch { }
+                    }
+                    const result = await mod.loader({ params, query, url: pagePath, headers: req.headers, locale, user });
                     if (isRedirectResponse(result)) {
                         res.statusCode = result.status || 302;
                         res.setHeader('Location', result.location);
@@ -197,8 +244,8 @@ export function lumenLoadersPlugin(pagesDir) {
             // Apply to page files and layout files within the pages directory
             if (!id.startsWith(pagesDir) || !id.endsWith('.ts'))
                 return;
-            const hasLoader = code.includes('export') && code.includes('loader') && /export\s+(async\s+)?function\s+loader\s*\(/.test(code);
-            const hasSubscribe = code.includes('export') && code.includes('subscribe') && /export\s+(async\s+)?function\s+subscribe\s*\(/.test(code);
+            const hasLoader = hasTopLevelServerFunction(code, 'loader');
+            const hasSubscribe = hasTopLevelServerFunction(code, 'subscribe');
             if (!hasLoader && !hasSubscribe)
                 return;
             let result = code;
@@ -225,8 +272,13 @@ export function lumenLoadersPlugin(pagesDir) {
  * GET /__nk_loader/__layout/?__dir=dashboard
  */
 async function handleLayoutLoader(server, pagesDir, dir, req, res) {
-    // Resolve the layout file from the directory
-    const layoutDir = path.join(pagesDir, dir);
+    // Resolve the layout file from the directory (validate path stays within pagesDir)
+    const layoutDir = path.resolve(pagesDir, dir);
+    if (!layoutDir.startsWith(path.resolve(pagesDir) + path.sep) && layoutDir !== path.resolve(pagesDir)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid layout directory' }));
+        return;
+    }
     let layoutFile = null;
     for (const ext of ['.ts', '.js']) {
         const p = path.join(layoutDir, `_layout${ext}`);
@@ -261,7 +313,37 @@ async function handleLayoutLoader(server, pagesDir, dir, req, res) {
             }
         }
         const locale = query.__locale;
-        const result = await mod.loader({ params: {}, query: {}, url: `/__layout/${dir}`, headers: req.headers, locale });
+        // If auth middleware hasn't populated nkAuth, try to parse from cookie or bearer token
+        let user = req.nkAuth?.user ?? null;
+        if (!user) {
+            try {
+                const authConfigPath = path.join(pagesDir, '..', 'lumenjs.auth.ts');
+                if (fs.existsSync(authConfigPath)) {
+                    const { loadAuthConfig } = await import('../../auth/config.js');
+                    const authCfg = await loadAuthConfig(path.join(pagesDir, '..'), server.ssrLoadModule.bind(server));
+                    if (authCfg) {
+                        const authHeader = req.headers.authorization;
+                        if (authHeader?.startsWith('Bearer ')) {
+                            const { verifyAccessToken } = await import('../../auth/token.js');
+                            const tokenUser = verifyAccessToken(authHeader.slice(7), authCfg.session.secret);
+                            if (tokenUser)
+                                user = tokenUser;
+                        }
+                        if (!user && req.headers.cookie) {
+                            const { parseSessionCookie, decryptSession } = await import('../../auth/session.js');
+                            const cookieVal = parseSessionCookie(req.headers.cookie, authCfg.session.cookieName);
+                            if (cookieVal) {
+                                const session = await decryptSession(cookieVal, authCfg.session.secret);
+                                if (session?.user)
+                                    user = session.user;
+                            }
+                        }
+                    }
+                }
+            }
+            catch { }
+        }
+        const result = await mod.loader({ params: {}, query: {}, url: `/__layout/${dir}`, headers: req.headers, locale, user });
         if (isRedirectResponse(result)) {
             res.statusCode = result.status || 302;
             res.setHeader('Location', result.location);
@@ -362,14 +444,33 @@ function findDynamicPage(baseDir, segments) {
     }
     return null;
 }
+/**
+ * Check if code has a top-level export of a server function (before the class definition).
+ * In LumenJS, loader/subscribe are always declared before `export class`.
+ */
+function hasTopLevelServerFunction(code, fnName) {
+    const classStart = code.search(/export\s+class\s+\w+/);
+    const fnRegex = new RegExp(`export\\s+(async\\s+)?function\\s+${fnName}\\s*\\(`);
+    const match = fnRegex.exec(code);
+    if (!match)
+        return false;
+    // Real server functions appear before the class; code examples appear inside the class
+    if (classStart >= 0 && match.index > classStart)
+        return false;
+    return true;
+}
 /**
  * Strip a named server-side function (loader/subscribe) from client code using brace-depth tracking.
  */
 function stripServerFunction(code, fnName) {
+    const classStart = code.search(/export\s+class\s+\w+/);
     const regex = new RegExp(`export\\s+(async\\s+)?function\\s+${fnName}\\s*\\(`);
-    const match = code.match(regex);
+    const match = regex.exec(code);
     if (!match)
         return code;
+    // Only strip if the match is before the class (top-level, not inside a code example)
+    if (classStart >= 0 && match.index > classStart)
+        return code;
     const startIdx = match.index;
     let parenDepth = 1;
     let sigIdx = startIdx + match[0].length;
@@ -386,9 +487,36 @@ function stripServerFunction(code, fnName) {
     let depth = 1;
     let i = braceStart + 1;
     while (i < code.length && depth > 0) {
-        if (code[i] === '{')
+        const ch = code[i];
+        // Skip string literals and template literals to avoid counting braces inside them
+        if (ch === "'" || ch === '"' || ch === '`') {
+            const quote = ch;
+            i++;
+            while (i < code.length && code[i] !== quote) {
+                if (code[i] === '\\')
+                    i++; // skip escaped char
+                i++;
+            }
+            i++; // skip closing quote
+            continue;
+        }
+        // Skip single-line comments
+        if (ch === '/' && code[i + 1] === '/') {
+            while (i < code.length && code[i] !== '\n')
+                i++;
+            continue;
+        }
+        // Skip multi-line comments
+        if (ch === '/' && code[i + 1] === '*') {
+            i += 2;
+            while (i < code.length - 1 && !(code[i] === '*' && code[i + 1] === '/'))
+                i++;
+            i += 2;
+            continue;
+        }
+        if (ch === '{')
             depth++;
-        else if (code[i] === '}')
+        else if (ch === '}')
             depth--;
         i++;
     }
@@ -401,7 +529,12 @@ function stripServerFunction(code, fnName) {
  * GET /__nk_subscribe/__layout/?__dir=<dir>
  */
 async function handleLayoutSubscribe(server, pagesDir, dir, query, req, res) {
-    const layoutDir = path.join(pagesDir, dir);
+    const layoutDir = path.resolve(pagesDir, dir);
+    if (!layoutDir.startsWith(path.resolve(pagesDir) + path.sep) && layoutDir !== path.resolve(pagesDir)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid layout directory' }));
+        return;
+    }
     let layoutFile = null;
     for (const ext of ['.ts', '.js']) {
         const p = path.join(layoutDir, `_layout${ext}`);
@@ -432,7 +565,7 @@ async function handleLayoutSubscribe(server, pagesDir, dir, query, req, res) {
         const push = (data) => {
             res.write(`data: ${JSON.stringify(data)}\n\n`);
         };
-        const cleanup = mod.subscribe({ params: {}, push, headers: req.headers, locale });
+        const cleanup = mod.subscribe({ params: {}, push, headers: req.headers, locale, user: req.nkAuth?.user ?? null });
         res.on('close', () => {
             if (typeof cleanup === 'function')
                 cleanup();