rimecms 0.31.3 → 0.31.5

package/dist/core/config/auth/better-auth.server.js

@@ -1,6 +1,7 @@
 import { dev } from '$app/environment';
 import { env } from '$env/dynamic/public';
-import { admin as adminPlugin, apiKey } from 'better-auth/plugins';
+import { apiKey } from '@better-auth/api-key';
+import { admin as adminPlugin } from 'better-auth/plugins';
 import { betterAuthAfterHook, betterAuthBeforeHook } from './better-auth-hooks.server.js';
 import { accessControl, admin, staff, user } from './better-auth-permissions.js';
 export function getBaseAuthConfig(ctx) {

package/dist/core/config/server/write.server.js

@@ -1,5 +1,6 @@
 import { flatten } from 'flat';
 import cache from '../../dev/cache/index.server.js';
+import { CONFIG_DIR } from '../../dev/constants.js';
 /**
  * We actually need to serialize config values that will trigger
  * types, routes, or schema generations, meaning that for now
@@ -59,6 +60,10 @@ const writeMemo = (config) => {
             throw new Error(`Config error : Unable to parse value for key ${key}: ${err.message}`);
         }
     })
+        // Not part of the user's config object, but generated output (routes, schema, hooks) is
+        // relative to it — a RIME_CONFIG_DIR change must invalidate the memo just like a config
+        // change does, even when the config content itself is byte-identical.
+        .concat(`CONFIG_DIR:${CONFIG_DIR}`)
         .join('\n');
     const cached = cache.get('config');
     if (cached !== memoStr) {

package/dist/core/constant.d.ts

@@ -1,3 +1,13 @@
+/** The generated panel route always lives at this fixed matcher-folder id — the literal
+ * folder name never changes, only which segment value src/params/panel.ts's matcher
+ * accepts (see PANEL_ROUTE in core/dev/constants.ts). Route ids never carry the resolved
+ * param value, so these are safe to compare against event.route.id without leaking the
+ * configured secret. */
+export declare const PANEL_ROUTE_ID = "/(rime)/[panel=panel]";
+export declare const PANEL_SIGN_IN_ROUTE_ID = "/(rime)/[panel=panel]/sign-in";
+export declare const PANEL_FORGOT_PASSWORD_ROUTE_ID = "/(rime)/[panel=panel]/forgot-password";
+export declare const PANEL_RESET_PASSWORD_ROUTE_ID = "/(rime)/[panel=panel]/reset-password";
+export declare function isPublicPanelAuthRoute(routeId: string | null): boolean;
 export declare const VERSIONS_STATUS: {
     readonly DRAFT: "draft";
     readonly PUBLISHED: "published";

package/dist/core/constant.js

@@ -1,3 +1,25 @@
+/** The generated panel route always lives at this fixed matcher-folder id — the literal
+ * folder name never changes, only which segment value src/params/panel.ts's matcher
+ * accepts (see PANEL_ROUTE in core/dev/constants.ts). Route ids never carry the resolved
+ * param value, so these are safe to compare against event.route.id without leaking the
+ * configured secret. */
+export const PANEL_ROUTE_ID = '/(rime)/[panel=panel]';
+export const PANEL_SIGN_IN_ROUTE_ID = `${PANEL_ROUTE_ID}/sign-in`;
+export const PANEL_FORGOT_PASSWORD_ROUTE_ID = `${PANEL_ROUTE_ID}/forgot-password`;
+export const PANEL_RESET_PASSWORD_ROUTE_ID = `${PANEL_ROUTE_ID}/reset-password`;
+/** sign-in, forgot-password and reset-password all have to stay reachable by an
+ * unauthenticated visitor (someone locked out, or clicking a reset link from email) even
+ * though they now live under the same hidden [panel=panel] segment as the rest of the
+ * panel — this is the auth-gate's "public, no-session-required" exception, broadened from
+ * sign-in alone to cover all three. */
+const PANEL_PUBLIC_AUTH_ROUTE_IDS = new Set([
+    PANEL_SIGN_IN_ROUTE_ID,
+    PANEL_FORGOT_PASSWORD_ROUTE_ID,
+    PANEL_RESET_PASSWORD_ROUTE_ID
+]);
+export function isPublicPanelAuthRoute(routeId) {
+    return !!routeId && PANEL_PUBLIC_AUTH_ROUTE_IDS.has(routeId);
+}
 export const VERSIONS_STATUS = {
     DRAFT: 'draft',
     PUBLISHED: 'published'

package/dist/core/dev/cli/build/templates.js

@@ -1,9 +1,11 @@
+import { PANEL_ROUTE } from '../../constants.js';
 import { randomId } from '../../../../util/random.js';
 export const envProduction = () => `# BETTER-AUTH
 BETTER_AUTH_SECRET=${randomId(32)}
 
 # RIME
 PUBLIC_RIME_URL=http://localhost:3000
+RIME_PANEL_ROUTE=${PANEL_ROUTE}
 RIME_LOG_LEVEL=ERROR
 RIME_LOG_TO_FILE=true
 RIME_CACHE_ENABLED=true

package/dist/core/dev/cli/clear/index.server.js

@@ -2,14 +2,14 @@ import { RIME_DEV_CACHE_DIR } from '../../../constant.server.js';
 import { logger } from '../../../logger/index.server.js';
 import { rmSync } from 'node:fs';
 import path from 'node:path';
-import { INPUT_DIR, OUTPUT_DIR } from '../../constants.js';
+import { CONFIG_DIR, GENERATED_DIR } from '../../constants.js';
 import { prompt } from '../util/prompt.server.js';
 const clearMessage = `Are you sure you want to delete all related rime files (Y/n):
 - ./static/medias
 - ./db
 - ./src/routes/(rime)
-- ./src/lib/${INPUT_DIR}
-- ./src/lib/${OUTPUT_DIR}
+- ./${CONFIG_DIR}
+- ./${GENERATED_DIR}
 - ./src/app.generated.d.ts
 - ./src/rime.generated.d.ts
 - ./src/rime.modules.generated.d.ts
@@ -28,8 +28,8 @@ export const clear = async (args) => {
     // Remove directories
     rmSync(RIME_DEV_CACHE_DIR, { recursive: true, force: true });
     rmSync(path.join('src', 'routes', '(rime)'), { recursive: true, force: true });
-    rmSync(path.join('src', 'lib', INPUT_DIR), { recursive: true, force: true });
-    rmSync(path.join('src', 'lib', OUTPUT_DIR), { recursive: true, force: true });
+    rmSync(CONFIG_DIR, { recursive: true, force: true });
+    rmSync(GENERATED_DIR, { recursive: true, force: true });
     rmSync(path.join('db'), { recursive: true, force: true });
     rmSync(path.join('static', 'medias'), { recursive: true, force: true });
     // Remove files

package/dist/core/dev/cli/init/index.server.js

@@ -9,7 +9,7 @@ import { cp, mkdir } from 'fs/promises';
 import fs from 'node:fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { INPUT_DIR } from '../../constants.js';
+import { CONFIG_DIR, OUTPUT_DIR, PANEL_ROUTE } from '../../constants.js';
 import { generate } from '../generate/index.server.js';
 import { installDependencies } from '../util/package-manager.server.js';
 import { getPackageInfoByKey } from '../util/package.server.js';
@@ -25,6 +25,8 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         const envUpdates = {
             BETTER_AUTH_SECRET: randomId(32),
             PUBLIC_RIME_URL: 'http://localhost:5173',
+            RIME_CONFIG_DIR: CONFIG_DIR,
+            RIME_PANEL_ROUTE: PANEL_ROUTE,
             '# RIME_SMTP_USER': 'user@mail.com',
             '# RIME_SMTP_PASSWORD': 'supersecret',
             '# RIME_SMTP_PORT': '465',
@@ -53,7 +55,7 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         }
     }
     function setConfig(name) {
-        const configDirPath = path.resolve(root, 'src/lib', INPUT_DIR);
+        const configDirPath = path.resolve(root, CONFIG_DIR);
         const configPath = path.join(configDirPath, 'rime.config.server.ts');
         if (!existsSync(configPath)) {
             if (!existsSync(configDirPath)) {
@@ -83,21 +85,24 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
             return;
         }
         let gitignoreContent = readFileSync(gitignorePath, 'utf-8');
+        // OUTPUT_DIR is derived from RIME_CONFIG_DIR, so its first character isn't always '+' —
+        // escape every regex metacharacter generically instead of hand-picking one to backslash.
+        const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const updates = [
-            '\\.cache',
+            '.cache',
             '/logs',
             '/db',
-            '\\+rime.generated',
+            OUTPUT_DIR,
             'src/app.generated.d.ts',
             'src/rime.generated.d.ts'
         ];
         if (!gitignoreContent.includes('# rime'))
             gitignoreContent += '\n# rime';
         for (const line of updates) {
-            const exists = gitignoreContent.match(new RegExp(`^${line}`, 'm'));
+            const exists = gitignoreContent.match(new RegExp(`^${escapeRegExp(line)}`, 'm'));
             if (!exists) {
                 // Add new value if doesn't exist
-                gitignoreContent += `\n${line.replace('\\', '')}`;
+                gitignoreContent += `\n${line}`;
             }
         }
         writeFileSync(gitignorePath, gitignoreContent);
@@ -108,10 +113,11 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         if (!existsSync(drizzleConfigPath)) {
             writeFileSync(drizzleConfigPath, templates.drizzleConfig(name.toString()));
             logger.info('[✓] Drizzle config added');
+            return;
         }
-        else {
-            logger.info('[✓] Drizzle config already exists (skip)');
-        }
+        logger.info(templates.regenerateDrizzleConfig(root)
+            ? '[✓] Drizzle config schema path updated'
+            : '[✓] Drizzle config already exists (skip)');
     }
     function configureVite() {
         const configPath = path.resolve(root, 'vite.config.ts');
@@ -182,23 +188,6 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         }
         return null;
     }
-    function setHooks() {
-        const hooksPath = path.join(root, 'src', 'hooks.server.ts');
-        const srcDir = path.join(root, 'src');
-        // Check if file exists
-        if (!existsSync(hooksPath)) {
-            // Ensure src directory exists
-            if (!existsSync(srcDir)) {
-                mkdirSync(srcDir, { recursive: true });
-            }
-            // Create hooks.server.ts with template content
-            writeFileSync(hooksPath, templates.hooks(), 'utf-8');
-            logger.info('[✓] hooks.server.ts created');
-        }
-        else {
-            logger.info('[✓] hooks.server.ts already exists (skip)');
-        }
-    }
     async function copyAssets() {
         try {
             const currentDir = path.dirname(fileURLToPath(import.meta.url));
@@ -219,7 +208,6 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         setConfig(name);
         setDatabase();
         setDrizzle(name);
-        setHooks();
         configureVite();
         await copyAssets();
         !skipInstall && installDependencies();
@@ -244,7 +232,6 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
         setConfig(name);
         setDatabase();
         setDrizzle(name);
-        setHooks();
         configureVite();
         await copyAssets();
         !skipInstall && installDependencies();

package/dist/core/dev/cli/init/templates.d.ts

@@ -2,3 +2,17 @@ export declare const env: () => string;
 export declare const defaultConfig: (name: string) => string;
 export declare const drizzleConfig: (name: string) => string;
 export declare const hooks: () => string;
+/** Writes src/hooks.server.ts if missing. If it already exists, patches only the config
+ * import line if it's stale (e.g. after RIME_CONFIG_DIR changes the import path) — the rest
+ * of the file may carry real customizations (e.g. an appended handler), so this never
+ * touches anything else. Called both at `rime init` and whenever the dev server detects a
+ * config change, so the import path never goes stale between the two. Returns whether it
+ * wrote anything. */
+export declare function regenerateHooks(root?: string): boolean;
+/** Patches drizzle.config.ts's schema path line if it's stale (e.g. after RIME_CONFIG_DIR
+ * changes) — only that one line, since the rest of the file may carry real customizations
+ * (verbose, custom fields, etc.). Must run before generateSchema()'s own drizzle-kit
+ * generate/migrate shell-out, which reads this file from disk. No-op if the file doesn't
+ * exist — creating it from scratch needs a project name, which is `rime init`'s job
+ * (setDrizzle() in init/index.server.ts). Returns whether it patched anything. */
+export declare function regenerateDrizzleConfig(root?: string): boolean;

package/dist/core/dev/cli/init/templates.js

@@ -1,8 +1,18 @@
 import { randomId } from '../../../../util/random.js';
-import { configImportPaths, OUTPUT_DIR } from '../../constants.js';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { CONFIG_DIR, GENERATED_DIR, PANEL_ROUTE, configImportPaths } from '../../constants.js';
 const PACKAGE = 'rimecms';
 export const env = () => `BETTER_AUTH_SECRET=${randomId(32)}
 PUBLIC_RIME_URL=http://localhost:5173
+RIME_CONFIG_DIR=${CONFIG_DIR}
+
+# Panel URL segment (e.g. /panel/...). Change it to hide the panel from
+# automated CMS-admin scanners — requests to the old segment 404 instead of
+# revealing a login page. Run 'rime generate' (or restart 'rime dev') after
+# changing this — the dev server only regenerates routes when it detects a
+# change under RIME_CONFIG_DIR, not on every restart.
+RIME_PANEL_ROUTE=${PANEL_ROUTE}
 
 # RIME_CACHE_ENABLED=false
 # RIME_SMTP_USER=user@mail.com
@@ -40,7 +50,7 @@ export const drizzleConfig = (name) => `
 import { defineConfig, type Config } from 'drizzle-kit';
 
 export const config: Config = {
-  schema: './src/lib/${OUTPUT_DIR}/schema.server.ts',
+  schema: './${GENERATED_DIR}/schema.server.ts',
   out: './db',
   strict: false,
   dialect: 'sqlite',
@@ -53,9 +63,54 @@ export default defineConfig(config);
 `;
 // Regenerated fresh by rime init every time (setHooks() only skips if the file already
 // exists, and `rime clear`/useConfig.js delete it first) — safe to make mode-aware.
+const HOOKS_DIR = path.resolve(process.cwd(), 'src');
 export const hooks = () => `import { sequence } from '@sveltejs/kit/hooks';
 import { handlers } from '${PACKAGE}/server';
-import config from '.${configImportPaths().server.replace('$lib', '/lib')}';
+import config from '${configImportPaths(HOOKS_DIR).server}';
 
 export const handle = sequence(...(await handlers(config)));
 `;
+const HOOKS_CONFIG_IMPORT_LINE_REGEX = /^import config from ['"][^'"]*['"];\s*$/m;
+/** Writes src/hooks.server.ts if missing. If it already exists, patches only the config
+ * import line if it's stale (e.g. after RIME_CONFIG_DIR changes the import path) — the rest
+ * of the file may carry real customizations (e.g. an appended handler), so this never
+ * touches anything else. Called both at `rime init` and whenever the dev server detects a
+ * config change, so the import path never goes stale between the two. Returns whether it
+ * wrote anything. */
+export function regenerateHooks(root = process.cwd()) {
+    const hooksPath = path.join(root, 'src', 'hooks.server.ts');
+    const srcDir = path.join(root, 'src');
+    if (!existsSync(hooksPath)) {
+        if (!existsSync(srcDir)) {
+            mkdirSync(srcDir, { recursive: true });
+        }
+        writeFileSync(hooksPath, hooks(), 'utf-8');
+        return true;
+    }
+    const expectedImportLine = `import config from '${configImportPaths(HOOKS_DIR).server}';`;
+    const content = readFileSync(hooksPath, 'utf-8');
+    if (HOOKS_CONFIG_IMPORT_LINE_REGEX.test(content) && !content.includes(expectedImportLine)) {
+        writeFileSync(hooksPath, content.replace(HOOKS_CONFIG_IMPORT_LINE_REGEX, expectedImportLine));
+        return true;
+    }
+    return false;
+}
+const DRIZZLE_SCHEMA_LINE_REGEX = /^\s*schema:\s*['"][^'"]*['"],?\s*$/m;
+/** Patches drizzle.config.ts's schema path line if it's stale (e.g. after RIME_CONFIG_DIR
+ * changes) — only that one line, since the rest of the file may carry real customizations
+ * (verbose, custom fields, etc.). Must run before generateSchema()'s own drizzle-kit
+ * generate/migrate shell-out, which reads this file from disk. No-op if the file doesn't
+ * exist — creating it from scratch needs a project name, which is `rime init`'s job
+ * (setDrizzle() in init/index.server.ts). Returns whether it patched anything. */
+export function regenerateDrizzleConfig(root = process.cwd()) {
+    const drizzleConfigPath = path.join(root, 'drizzle.config.ts');
+    if (!existsSync(drizzleConfigPath))
+        return false;
+    const expectedSchemaLine = `  schema: './${GENERATED_DIR}/schema.server.ts',`;
+    const content = readFileSync(drizzleConfigPath, 'utf-8');
+    if (DRIZZLE_SCHEMA_LINE_REGEX.test(content) && !content.includes(expectedSchemaLine)) {
+        writeFileSync(drizzleConfigPath, content.replace(DRIZZLE_SCHEMA_LINE_REGEX, expectedSchemaLine));
+        return true;
+    }
+    return false;
+}

package/dist/core/dev/constants.d.ts

@@ -1,15 +1,28 @@
-export declare const OUTPUT_DIR = "+rime.generated";
-export declare const INPUT_DIR = "+rime";
-/** Where the panel/live route templates (common.server.ts) should import the client config
- * from, and where the dev-server watcher/hot-reload should read the server config from —
- * one source of truth instead of hardcoding the path at each call site. */
-export declare function configImportPaths(): {
+export declare const CONFIG_DIR: string;
+export declare const GENERATED_DIR: string;
+export declare const INPUT_DIR: string;
+export declare const OUTPUT_DIR: string;
+/** The panel's URL segment (e.g. "panel" -> /panel/...). Kept as a bare segment, never a
+ * PUBLIC_-prefixed env var: SvelteKit ships every PUBLIC_ value into the JS bundle of every
+ * page (including the public site), which would defeat the point of letting an operator hide
+ * this path from automated CMS-admin scanners. */
+export declare const PANEL_ROUTE: string;
+/** Turns an absolute path into an import specifier relative to `fromDir`, always prefixed
+ * with `./` or `../` so it never gets mistaken for a bare package specifier. */
+export declare function relativeImportSpecifier(fromDir: string, toAbsolutePath: string): string;
+export declare function generatedConfigServerPath(): string;
+/** Where the panel/live route templates (common.server.ts) and the generated hooks.server.ts
+ * should import the client/server config from — a relative import specifier computed from
+ * `fromDir` (the absolute directory of the file doing the importing), so it resolves whether
+ * GENERATED_DIR lives under src/lib or elsewhere. One source of truth instead of hardcoding the
+ * path (or relying on the $lib alias, which only ever points at src/lib) at each call site. */
+export declare function configImportPaths(fromDir: string): {
     client: string;
     server: string;
 };
 /** Same idea as configImportPaths — one source of truth for where the generated schema
  * lives instead of hardcoding the path at each call site. */
-export declare function schemaPath(root?: string): string;
+export declare function schemaPath(projectRoot?: string): string;
 /**
  * True when `metaUrl` (pass the caller's own `import.meta.url` — this can't be one shared
  * value, it depends on which file is asking) is running from inside an installed `rimecms`

package/dist/core/dev/constants.js

@@ -1,19 +1,67 @@
+import dotenv from 'dotenv';
 import path from 'node:path';
-export const OUTPUT_DIR = '+rime.generated';
-export const INPUT_DIR = '+rime';
-/** Where the panel/live route templates (common.server.ts) should import the client config
- * from, and where the dev-server watcher/hot-reload should read the server config from —
- * one source of truth instead of hardcoding the path at each call site. */
-export function configImportPaths() {
+import { isValidSlug } from '../../util/string.js';
+// Must run before RIME_CONFIG_DIR is read below. ES import hoisting evaluates this module's
+// top-level code before any *importing* file's own top-level statements — including a
+// dotenv.config() call there — so loading .env here, first, is the only way every entry point
+// (CLI, dev-server, drizzle.config.ts, etc.) reliably sees it. override:true so .env is the
+// explicit source of truth, not whatever a shell plugin (autoenv, direnv, ...) already exported
+// from some other project's .env. The only dotenv.config() call in the codebase — a second one
+// elsewhere would race this one.
+dotenv.config({ override: true });
+const root = process.cwd();
+const SRC_ROOT = path.resolve(root, 'src');
+export const CONFIG_DIR = process.env.RIME_CONFIG_DIR || 'src/+rime';
+export const GENERATED_DIR = `${CONFIG_DIR}.generated`;
+export const INPUT_DIR = path.basename(CONFIG_DIR);
+export const OUTPUT_DIR = `${INPUT_DIR}.generated`;
+/** The panel's URL segment (e.g. "panel" -> /panel/...). Kept as a bare segment, never a
+ * PUBLIC_-prefixed env var: SvelteKit ships every PUBLIC_ value into the JS bundle of every
+ * page (including the public site), which would defeat the point of letting an operator hide
+ * this path from automated CMS-admin scanners. */
+export const PANEL_ROUTE = (process.env.RIME_PANEL_ROUTE || 'panel').replace(/^\/+|\/+$/g, '');
+if (!isValidSlug(PANEL_ROUTE)) {
+    throw new Error(`RIME_PANEL_ROUTE must be a single URL segment (letters, numbers, "_"/"-", starting with a letter) — got "${PANEL_ROUTE}"`);
+}
+const RESERVED_DIRS = new Set(['lib', 'routes', 'static', 'params'].map((d) => path.resolve(SRC_ROOT, d)));
+for (const dir of [CONFIG_DIR, GENERATED_DIR]) {
+    const resolved = path.resolve(root, dir);
+    if (resolved === SRC_ROOT || !resolved.startsWith(SRC_ROOT + path.sep)) {
+        throw new Error(`RIME_CONFIG_DIR must resolve to a subdirectory of ${SRC_ROOT} (got "${dir}")`);
+    }
+    if (RESERVED_DIRS.has(resolved)) {
+        throw new Error(`RIME_CONFIG_DIR must not be src/lib, src/routes, src/static, or src/params (got "${dir}")`);
+    }
+}
+/** Turns an absolute path into an import specifier relative to `fromDir`, always prefixed
+ * with `./` or `../` so it never gets mistaken for a bare package specifier. */
+export function relativeImportSpecifier(fromDir, toAbsolutePath) {
+    const rel = path.relative(fromDir, toAbsolutePath).split(path.sep).join('/');
+    return rel.startsWith('.') ? rel : `./${rel}`;
+}
+/** Root-relative filesystem path (posix-style) to a file inside the generated config dir —
+ * for Vite's ssrLoadModule, which wants a real file path, not an import specifier. */
+function generatedFilePath(file) {
+    return path.relative(root, path.resolve(root, GENERATED_DIR, file)).split(path.sep).join('/');
+}
+export function generatedConfigServerPath() {
+    return generatedFilePath('rime.config.server.ts');
+}
+/** Where the panel/live route templates (common.server.ts) and the generated hooks.server.ts
+ * should import the client/server config from — a relative import specifier computed from
+ * `fromDir` (the absolute directory of the file doing the importing), so it resolves whether
+ * GENERATED_DIR lives under src/lib or elsewhere. One source of truth instead of hardcoding the
+ * path (or relying on the $lib alias, which only ever points at src/lib) at each call site. */
+export function configImportPaths(fromDir) {
     return {
-        client: `$lib/${OUTPUT_DIR}/rime.config.js`,
-        server: `$lib/${OUTPUT_DIR}/rime.config.server.js`
+        client: relativeImportSpecifier(fromDir, path.resolve(root, GENERATED_DIR, 'rime.config.js')),
+        server: relativeImportSpecifier(fromDir, path.resolve(root, GENERATED_DIR, 'rime.config.server.js'))
     };
 }
 /** Same idea as configImportPaths — one source of truth for where the generated schema
  * lives instead of hardcoding the path at each call site. */
-export function schemaPath(root = process.cwd()) {
-    return path.resolve(root, 'src/lib', OUTPUT_DIR, 'schema.server.ts');
+export function schemaPath(projectRoot = process.cwd()) {
+    return path.resolve(projectRoot, GENERATED_DIR, 'schema.server.ts');
 }
 /**
  * True when `metaUrl` (pass the caller's own `import.meta.url` — this can't be one shared