rimecms 0.31.3 → 0.31.5

package/dist/core/dev/generate/routes/common.server.js

@@ -1,5 +1,8 @@
 import { PACKAGE_NAME } from '../../../constant.server.js';
+import path from 'node:path';
 import { configImportPaths } from '../../constants.js';
+const PANEL_LAYOUT_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/[panel=panel]');
+const LIVE_PAGE_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/[panel=panel]/live-edit');
 /**
  * Main base layout
  * /+layout.server.ts
@@ -79,7 +82,7 @@ export const load = async ({ locals }: ServerLoadEvent) => {
 };`;
 /**
  * Login page template
- * (rime)/panel/sign-in/+page.svelte
+ * (rime)/[panel=panel]/sign-in/+page.svelte
  */
 const signInPage = () => `
 <script>
@@ -102,7 +105,7 @@ export const actions = {
 `;
 /**
  * Forgot password page template
- * (rime)/forgot-password/+page.svelte
+ * (rime)/[panel=panel]/forgot-password/+page.svelte
  */
 const forgotPasswordPage = () => `
 <script>
@@ -112,7 +115,7 @@ const forgotPasswordPage = () => `
 <ForgotPassword {data} />`;
 /**
  * Forgot password page server template
- * (rime)/forgot-password/+page.server.ts
+ * (rime)/[panel=panel]/forgot-password/+page.server.ts
  */
 const forgotPasswordPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -121,7 +124,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.f
 `;
 /**
  * Reset password page template
- * (rime)/reset-password/+page.svelte
+ * (rime)/[panel=panel]/reset-password/+page.svelte
  */
 const resetPasswordPage = () => `
 <script>
@@ -132,7 +135,7 @@ const resetPasswordPage = () => `
 <ResetPassword {data} />`;
 /**
  * Reset password page server template
- * (rime)/reset-password/+page.server.ts
+ * (rime)/[panel=panel]/reset-password/+page.server.ts
  */
 const resetPasswordPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -141,12 +144,12 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.r
 `;
 /**
  * Panel layout template
- * (rime)/panel/+layout.svelte
+ * (rime)/[panel=panel]/+layout.svelte
  */
 const panelLayout = () => `
 <script>
   import { Panel } from '${PACKAGE_NAME}/panel';
-	import config from '${configImportPaths().client}';
+	import config from '${configImportPaths(PANEL_LAYOUT_DIR).client}';
 
 	const { children, data } = $props();
 	
@@ -161,7 +164,7 @@ const panelLayout = () => `
 </Panel>`;
 /**
  * Panel layout server template
- * (rime)/panel/+layout.server.ts
+ * (rime)/[panel=panel]/+layout.server.ts
  */
 const panelLayoutServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -172,7 +175,7 @@ export const load = async ({ locals }: ServerLoadEvent) => {
 };`;
 /**
  * Panel page template
- * (rime)/panel/+page.svelte
+ * (rime)/[panel=panel]/+page.svelte
  */
 const panelPage = () => `
 <script>
@@ -183,7 +186,7 @@ const panelPage = () => `
 <Dashboard entries={data.entries} user={data.user} />`;
 /**
  * Panel page load template
- * (rime)/panel/+page.server.ts
+ * (rime)/[panel=panel]/+page.server.ts
  */
 const panelPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -196,7 +199,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.d
 const livePage = () => `
 <script>
   import { Live } from '${PACKAGE_NAME}/panel';
-  import config from '${configImportPaths().client}';
+  import config from '${configImportPaths(LIVE_PAGE_DIR).client}';
 
   const { data } = $props();
 </script>
@@ -226,7 +229,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.l
 /****************************************************/
 /**
  * Collection list page
- * (rime)/panel/[slug=collection]/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/+page.svelte
  */
 const collectionListPage = () => `
 <script>
@@ -236,7 +239,7 @@ const collectionListPage = () => `
 
 <Collection {data} slug={data.slug} />`;
 /**
- * (rime)/panel/[slug=collection]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/+page.server.ts
  */
 const collectionListPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -247,7 +250,7 @@ export const load = async (event: ServerLoadEvent) => {
 };`;
 /**
  * Area document page
- * (rime)/panel/[slug=area]/+page.svelte
+ * (rime)/[panel=panel]/[slug=area]/+page.svelte
  */
 const areaDocPage = () => `
 <script>
@@ -257,7 +260,7 @@ const areaDocPage = () => `
 
 <Area {data} />`;
 /**
- * (rime)/panel/[slug=area]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=area]/+page.server.ts
  */
 const areaDocPageServer = () => `
 import type { RequestEvent, ServerLoadEvent } from '@sveltejs/kit';
@@ -269,7 +272,7 @@ export const actions = {
 };`;
 /**
  * Collection document page
- * (rime)/panel/[slug=collection]/[id]/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/[id]/+page.svelte
  */
 const collectionDocPage = () => `
 <script>
@@ -279,7 +282,7 @@ const collectionDocPage = () => `
 
 <CollectionDoc {data} />`;
 /**
- * (rime)/panel/[slug=collection]/[id]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/[id]/+page.server.ts
  */
 const collectionDocPageServer = () => `
 import type { RequestEvent, ServerLoadEvent } from '@sveltejs/kit';
@@ -292,7 +295,7 @@ export const actions = {
 };`;
 /**
  * Collection document versions page
- * (rime)/panel/[slug=collection]/[id]/versions/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/[id]/versions/+page.svelte
  */
 const collectionDocVersionsPage = () => `
 <script>
@@ -302,7 +305,7 @@ const collectionDocVersionsPage = () => `
 
 <CollectionDocVersions data={data} />`;
 /**
- * (rime)/panel/[slug=collection]/[id]/versions/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/[id]/versions/+page.server.ts
  */
 const collectionDocVersionsPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -311,7 +314,7 @@ export const load = (event: ServerLoadEvent) =>
   event.locals.routes.panel.load.documentVersions(event);`;
 /**
  * Area document versions page
- * (rime)/panel/[slug=area]/versions/+page.svelte
+ * (rime)/[panel=panel]/[slug=area]/versions/+page.svelte
  */
 const areaVersionsPage = () => `
 <script>
@@ -321,7 +324,7 @@ const areaVersionsPage = () => `
 
 <AreaVersionsDoc data={data} />`;
 /**
- * (rime)/panel/[slug=area]/versions/+page.server.ts
+ * (rime)/[panel=panel]/[slug=area]/versions/+page.server.ts
  */
 const areaVersionsPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -436,45 +439,45 @@ export const commonRoutes = {
         layoutServer: rootLayoutServer,
         error: error
     },
-    '(rime)/panel/sign-in': {
+    '(rime)/[panel=panel]/sign-in': {
         'page@(rime)': signInPage,
         pageServer: signInPageServer
     },
-    '(rime)/forgot-password': {
-        page: forgotPasswordPage,
+    '(rime)/[panel=panel]/forgot-password': {
+        'page@(rime)': forgotPasswordPage,
         pageServer: forgotPasswordPageServer
     },
-    '(rime)/reset-password': {
-        page: resetPasswordPage,
+    '(rime)/[panel=panel]/reset-password': {
+        'page@(rime)': resetPasswordPage,
         pageServer: resetPasswordPageServer
     },
-    '(rime)/panel': {
+    '(rime)/[panel=panel]': {
         layout: panelLayout,
         layoutServer: panelLayoutServer,
         page: panelPage,
         pageServer: panelPageServer
     },
-    '(rime)/panel/live-edit': {
+    '(rime)/[panel=panel]/live-edit': {
         'page@(rime)': livePage,
         pageServer: livePageServer
     },
-    '(rime)/panel/[slug=collection]': {
+    '(rime)/[panel=panel]/[slug=collection]': {
         page: collectionListPage,
         pageServer: collectionListPageServer
     },
-    '(rime)/panel/[slug=collection]/[id]': {
+    '(rime)/[panel=panel]/[slug=collection]/[id]': {
         page: collectionDocPage,
         pageServer: collectionDocPageServer
     },
-    '(rime)/panel/[slug=collection]/[id]/versions': {
+    '(rime)/[panel=panel]/[slug=collection]/[id]/versions': {
         page: collectionDocVersionsPage,
         pageServer: collectionDocVersionsPageServer
     },
-    '(rime)/panel/[slug=area]': {
+    '(rime)/[panel=panel]/[slug=area]': {
         page: areaDocPage,
         pageServer: areaDocPageServer
     },
-    '(rime)/panel/[slug=area]/versions': {
+    '(rime)/[panel=panel]/[slug=area]/versions': {
         page: areaVersionsPage,
         pageServer: areaVersionsPageServer
     },

package/dist/core/dev/generate/routes/index.server.d.ts

@@ -2,11 +2,14 @@ import type { Config } from '../../../../types.js';
 /**
  * Main function to generate browser routes based on configuration.
  * commonRoutes is a fixed set of files (layout, sign-in, dashboard, the
- * matcher-disambiguated /panel/[slug=collection|area]/... and
+ * matcher-disambiguated [panel=panel]/[slug=collection|area]/... and
  * /api/[slug=collection|area]/... dynamic routes) — it no longer varies with
  * how many collections/areas are configured, so there's no per-collection/area
- * loop here anymore. The src/params/collection.ts and area.ts matchers backing
- * those routes DO bake in the actual slug list, so they're rewritten here too.
+ * loop here anymore. The folder is always the literal `[panel=panel]` segment;
+ * only src/params/panel.ts's matcher content varies with RIME_PANEL_ROUTE, so
+ * the URL itself can be hidden from admin-path scanners without ever renaming
+ * a directory. Same idea backs src/params/collection.ts and area.ts, which
+ * bake in the actual slug list — all three are rewritten here.
  */
 declare function generateRoutes<T extends Config>(config: T): void;
 export default generateRoutes;

package/dist/core/dev/generate/routes/index.server.js

@@ -1,3 +1,4 @@
+import { PANEL_ROUTE } from '../../constants.js';
 import { logger } from '../../../logger/index.server.js';
 import fs from 'fs';
 import path from 'path';
@@ -8,11 +9,14 @@ const projectRoot = process.cwd();
 /**
  * Main function to generate browser routes based on configuration.
  * commonRoutes is a fixed set of files (layout, sign-in, dashboard, the
- * matcher-disambiguated /panel/[slug=collection|area]/... and
+ * matcher-disambiguated [panel=panel]/[slug=collection|area]/... and
  * /api/[slug=collection|area]/... dynamic routes) — it no longer varies with
  * how many collections/areas are configured, so there's no per-collection/area
- * loop here anymore. The src/params/collection.ts and area.ts matchers backing
- * those routes DO bake in the actual slug list, so they're rewritten here too.
+ * loop here anymore. The folder is always the literal `[panel=panel]` segment;
+ * only src/params/panel.ts's matcher content varies with RIME_PANEL_ROUTE, so
+ * the URL itself can be hidden from admin-path scanners without ever renaming
+ * a directory. Same idea backs src/params/collection.ts and area.ts, which
+ * bake in the actual slug list — all three are rewritten here.
  */
 function generateRoutes(config) {
     logger.info('Routes generation...');
@@ -23,7 +27,7 @@ function generateRoutes(config) {
     // 2. Ensure base directories exist
     const rootRoutes = path.resolve(projectRoot, 'src', 'routes');
     const rimeRoutes = path.join(rootRoutes, '(rime)');
-    const panelRoute = path.join(rimeRoutes, 'panel');
+    const panelRoute = path.join(rimeRoutes, '[panel=panel]');
     const paramsDir = path.resolve(projectRoot, 'src', 'params');
     fs.rmSync(rimeRoutes, { recursive: true, force: true });
     ensureDir(rootRoutes);
@@ -44,8 +48,10 @@ function generateRoutes(config) {
             writeRouteFile(rootRoutes, pattern, fileType, templateFn());
         }
     }
-    // 4. Write the [slug=collection]/[slug=area] param matchers, only when needed — and remove any
-    // stale matcher left over from a previous config that did have collections/areas.
+    // 4. Write the [panel=panel] param matcher — always present, unlike collection/area — plus
+    // the [slug=collection]/[slug=area] matchers, only when needed, removing any stale matcher
+    // left over from a previous config that did have collections/areas.
+    fs.writeFileSync(path.join(paramsDir, 'panel.ts'), paramMatcher([PANEL_ROUTE]));
     const collectionMatcherPath = path.join(paramsDir, 'collection.ts');
     if (hasCollections) {
         fs.writeFileSync(collectionMatcherPath, paramMatcher((config.collections || []).map((c) => c.kebab)));
@@ -64,7 +70,7 @@ function generateRoutes(config) {
     const customRoutes = config.panel?.routes;
     if (customRoutes) {
         for (const [route, routeConfig] of Object.entries(customRoutes)) {
-            const routePath = path.join('(rime)', 'panel', route);
+            const routePath = path.join('(rime)', '[panel=panel]', route);
             writeRouteFile(rootRoutes, routePath, 'page', customRoute(routeConfig));
         }
     }

package/dist/core/dev/generate/routes/util.server.d.ts

@@ -8,10 +8,18 @@ export type Routes = Record<string, RouteDefinition>;
 /**
  * Check if routes need to be regenerated based on config changes.
  * Panel/API routes are a fixed set of dynamic-segment files (file count never
- * grows with schema size), but the [slug=collection]/[slug=area] param
- * matchers under src/params/ bake in the actual slug lists, so adding,
- * removing, or renaming a collection/area still needs a regen to keep those
- * matchers in sync — same trigger as custom routes and panel CSS.
+ * grows with schema size), but the [panel=panel]/[slug=collection]/[slug=area]
+ * param matchers under src/params/ bake in the actual accepted value(s), so
+ * changing RIME_PANEL_ROUTE or RIME_CONFIG_DIR, or adding/removing/renaming a
+ * collection/area, still needs a regen to keep those matchers in sync — same
+ * trigger as custom routes and panel CSS. Both PANEL_ROUTE and CONFIG_DIR must
+ * stay in this memo: they're read once at process start, so a changed value
+ * only takes effect after a restart, and only if the restart's regen actually
+ * notices the change. CONFIG_DIR specifically is baked into the panel/live
+ * layout's config import path (see configImportPaths() calls in
+ * common.server.ts) — leaving it out would silently keep that import stale
+ * instead of erroring, the same failure mode RIME_CONFIG_DIR hit once for
+ * hooks.server.ts (see regenerateHooks() in cli/init/templates.ts).
  * @returns true if routes should be regenerated, false otherwise
  */
 export declare function shouldRegenerateRoutes<T extends Config>(config: T): boolean;
@@ -33,10 +41,10 @@ export declare function ensureDir(dirPath: string): void;
  * @example
  * // Write a page file for a collection
  * const basePath = '/path/to/src/routes';
- * const routePath = '(rime)/panel/news';
+ * const routePath = '(rime)/[panel=panel]/news';
  * const fileType = 'page';
  * const content = '<script>\n  import { Collection } from "rime/panel"\n</script>...';
  * writeRouteFile(basePath, routePath, fileType, content);
- * // Creates /path/to/src/routes/(rime)/panel/news/+page.svelte with the provided content
+ * // Creates /path/to/src/routes/(rime)/[panel=panel]/news/+page.svelte with the provided content
  */
 export declare function writeRouteFile(basePath: string, routePath: string, fileType: string, content: string): void;

package/dist/core/dev/generate/routes/util.server.js

@@ -1,18 +1,29 @@
 import cache from '../../cache/index.server.js';
+import { CONFIG_DIR, PANEL_ROUTE } from '../../constants.js';
 import { slugify } from '../../../../util/string.js';
 import fs from 'fs';
 import path from 'path';
 /**
  * Check if routes need to be regenerated based on config changes.
  * Panel/API routes are a fixed set of dynamic-segment files (file count never
- * grows with schema size), but the [slug=collection]/[slug=area] param
- * matchers under src/params/ bake in the actual slug lists, so adding,
- * removing, or renaming a collection/area still needs a regen to keep those
- * matchers in sync — same trigger as custom routes and panel CSS.
+ * grows with schema size), but the [panel=panel]/[slug=collection]/[slug=area]
+ * param matchers under src/params/ bake in the actual accepted value(s), so
+ * changing RIME_PANEL_ROUTE or RIME_CONFIG_DIR, or adding/removing/renaming a
+ * collection/area, still needs a regen to keep those matchers in sync — same
+ * trigger as custom routes and panel CSS. Both PANEL_ROUTE and CONFIG_DIR must
+ * stay in this memo: they're read once at process start, so a changed value
+ * only takes effect after a restart, and only if the restart's regen actually
+ * notices the change. CONFIG_DIR specifically is baked into the panel/live
+ * layout's config import path (see configImportPaths() calls in
+ * common.server.ts) — leaving it out would silently keep that import stale
+ * instead of erroring, the same failure mode RIME_CONFIG_DIR hit once for
+ * hooks.server.ts (see regenerateHooks() in cli/init/templates.ts).
  * @returns true if routes should be regenerated, false otherwise
  */
 export function shouldRegenerateRoutes(config) {
     const memo = `
+    panel:${PANEL_ROUTE}
+    config:${CONFIG_DIR}
     custom:${config.panel?.routes
         ? Object.entries(config.panel.routes)
             .map(([k, v]) => `${k}-${slugify(v.component.toString())}`)
@@ -51,11 +62,11 @@ export function ensureDir(dirPath) {
  * @example
  * // Write a page file for a collection
  * const basePath = '/path/to/src/routes';
- * const routePath = '(rime)/panel/news';
+ * const routePath = '(rime)/[panel=panel]/news';
  * const fileType = 'page';
  * const content = '<script>\n  import { Collection } from "rime/panel"\n</script>...';
  * writeRouteFile(basePath, routePath, fileType, content);
- * // Creates /path/to/src/routes/(rime)/panel/news/+page.svelte with the provided content
+ * // Creates /path/to/src/routes/(rime)/[panel=panel]/news/+page.svelte with the provided content
  */
 export function writeRouteFile(basePath, routePath, fileType, content) {
     const dir = path.join(basePath, routePath);

package/dist/core/dev/generate/sanitize/index.server.js

@@ -5,7 +5,7 @@ import { babelParse } from 'ast-kit';
 import fs from 'node:fs';
 import path from 'node:path';
 import { logger } from '../../../logger/index.server.js';
-import { INPUT_DIR, OUTPUT_DIR } from '../../constants.js';
+import { CONFIG_DIR, GENERATED_DIR, OUTPUT_DIR } from '../../constants.js';
 
 /**
  * $ prefix-based sanitizer that rules:
@@ -22,8 +22,8 @@ const TOP_LEVEL_CONFIG = 'rime.config.server.ts';
 
 export async function sanitize() {
   const root = process.cwd();
-  const configDir = path.resolve(root, 'src/lib/', INPUT_DIR);
-  const outputDir = path.resolve(root, 'src/lib/', OUTPUT_DIR);
+  const configDir = path.resolve(root, CONFIG_DIR);
+  const outputDir = path.resolve(root, GENERATED_DIR);
 
   logger.info('Sanitizing config...');
 

package/dist/core/dev/generate/types/index.server.js

@@ -12,7 +12,7 @@ import { trycatchSync } from '../../../../util/function.js';
 import { capitalize, toPascalCase } from '../../../../util/string.js';
 import fs from 'node:fs';
 import path from 'node:path';
-import { isInstalledDependency, OUTPUT_DIR } from '../../constants.js';
+import { GENERATED_DIR, isInstalledDependency, relativeImportSpecifier } from '../../constants.js';
 const IS_RIME_REPO = !isInstalledDependency(import.meta.url);
 // Relation  type
 const relationValueType = `
@@ -259,7 +259,8 @@ export async function generateTypesString(config) {
     const blocksTypeNames = `export type BlockTypes = ${registeredBlocks.map((name) => `'${name}'`).join('|')}\n`;
     const anyBlock = `export type AnyBlock = ${registeredBlocks.map((name) => `Block${toPascalCase(name)}`).join('|')}\n`;
     const typeImports = `import type { ${Array.from(imports).join(', ')} } from '${PACKAGE_NAME}/types'`;
-    const rimeConfigServerPath = `./lib/${OUTPUT_DIR}/rime.config.server.ts`;
+    // app.generated.d.ts always sits at src/app.generated.d.ts (see generateTypes() below).
+    const rimeConfigServerPath = relativeImportSpecifier(path.resolve(process.cwd(), 'src'), path.resolve(process.cwd(), GENERATED_DIR, 'rime.config.server.ts'));
     const locals = `declare global {
   namespace App {
     interface Locals {

package/dist/core/dev/vite/index.server.js

@@ -1,15 +1,13 @@
-import dotenv from 'dotenv';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { RIME_DEV_CACHE_DIR } from '../../constant.server.js';
 import { ensureHasInit } from '../../ensure.server.js';
 import { logger } from '../../logger/index.server.js';
 import { getPackageInfoByKey } from '../cli/util/package.server.js';
-import { INPUT_DIR, isInstalledDependency, OUTPUT_DIR, schemaPath } from '../constants.js';
+import { CONFIG_DIR, GENERATED_DIR, generatedConfigServerPath, isInstalledDependency, schemaPath } from '../constants.js';
 import { findInstalledPackageRoot, findModulePair, scanModulePairs } from '../generate/runtime/index.server.js';
 import { parseExportNames } from '../generate/runtime/parse-exports.server.js';
 import { sanitize } from '../generate/sanitize/index.server.js';
-dotenv.config({ override: true });
 const dev = process.env.NODE_ENV === 'development';
 /** Picks the client or server side of a module.(server.)ts pair. When the requested side
  *  wasn't authored (e.g. a collection's $url/$hooks, real only server-side, imported anyway by
@@ -132,9 +130,8 @@ export function rime() {
                     try {
                         // ssrLoadModule wants the real .ts file path, not a $lib/*.js-style import
                         // specifier — different consumer than configImportPaths() (used for generated
-                        // source code), so computed directly here.
-                        const serverConfigPath = `src/lib/${OUTPUT_DIR}/rime.config.server.ts`;
-                        const mod = await server.ssrLoadModule(serverConfigPath);
+                        // source code).
+                        const mod = await server.ssrLoadModule(generatedConfigServerPath());
                         // The config's default export is the createRime() promise; ssrLoadModule
                         // only awaits the module's synchronous evaluation, so we must await it
                         // directly to observe init errors (e.g. invalid config) here instead of
@@ -153,8 +150,7 @@ export function rime() {
                 }
             }
             server.watcher.on('change', (modulePath) => {
-                const isConfigChange = modulePath.includes(`src/lib/${INPUT_DIR}`) &&
-                    !modulePath.includes(`src/lib/${OUTPUT_DIR}`);
+                const isConfigChange = modulePath.includes(CONFIG_DIR) && !modulePath.includes(GENERATED_DIR);
                 if (!isConfigChange)
                     return;
                 if (reloadTimer)

package/dist/core/ensure.server.d.ts

@@ -1,10 +1,10 @@
 import type { BuiltCollection } from '../types.js';
 /**
- * Ensure sanitize config exists — the generated server config inside rime.generated/.
+ * Ensure sanitize config exists — the generated server config inside the generated config dir.
  */
 export declare function ensureGeneratedConfig(): string;
 /**
- * Ensure user config exists — the src/lib/+rime/ folder convention.
+ * Ensure user config exists — the CONFIG_DIR folder convention.
  */
 export declare function ensureUserConfigExist(): void;
 /**

package/dist/core/ensure.server.js

@@ -1,25 +1,34 @@
 import { existsSync, mkdirSync } from 'node:fs';
 import path from 'node:path';
-import { INPUT_DIR, OUTPUT_DIR, schemaPath } from './dev/constants.js';
+import { CONFIG_DIR, GENERATED_DIR, generatedConfigServerPath, schemaPath } from './dev/constants.js';
 const projectRoot = process.cwd();
 /**
- * Ensure sanitize config exists — the generated server config inside rime.generated/.
+ * Ensure sanitize config exists — the generated server config inside the generated config dir.
  */
 export function ensureGeneratedConfig() {
-    const configGeneratedPath = path.resolve(projectRoot, 'src/lib', OUTPUT_DIR, 'rime.config.server.ts');
+    const configGeneratedPath = path.resolve(projectRoot, GENERATED_DIR, 'rime.config.server.ts');
     if (!existsSync(configGeneratedPath)) {
         throw new Error('Unable to find generated config');
     }
-    return path.join('$lib', OUTPUT_DIR, 'rime.config.server.js');
+    return generatedConfigServerPath();
 }
 /**
- * Ensure user config exists — the src/lib/+rime/ folder convention.
+ * Ensure user config exists — the CONFIG_DIR folder convention.
  */
 export function ensureUserConfigExist() {
-    const folderConfig = path.resolve(projectRoot, 'src/lib', INPUT_DIR, 'rime.config.server.ts');
-    if (!existsSync(folderConfig)) {
-        throw new Error('Unable to find config, did you run rime init');
+    const folderConfig = path.resolve(projectRoot, CONFIG_DIR, 'rime.config.server.ts');
+    if (existsSync(folderConfig))
+        return;
+    // Every project set up before RIME_CONFIG_DIR existed has its config here — if it's there
+    // but not at CONFIG_DIR, this is almost certainly an upgrade whose .env predates the env
+    // var, not a missing init, so say that instead of the generic message.
+    const LEGACY_DEFAULT = 'src/lib/+rime';
+    if (CONFIG_DIR !== LEGACY_DEFAULT &&
+        existsSync(path.resolve(projectRoot, LEGACY_DEFAULT, 'rime.config.server.ts'))) {
+        throw new Error(`Unable to find config at ${CONFIG_DIR} — found one at ${LEGACY_DEFAULT} instead. ` +
+            `Set RIME_CONFIG_DIR=${LEGACY_DEFAULT} in your .env to keep using it there, or move it to ${CONFIG_DIR} to match the current default.`);
     }
+    throw new Error('Unable to find config, did you run rime init');
 }
 /**
  * Ensure schema exists (see adapter-sqlite/generate-schema/write.server.ts, which writes to

package/dist/core/handlers/auth.server.js

@@ -1,16 +1,24 @@
+import { isPublicPanelAuthRoute } from '../constant.js';
 import { RimeError } from '../errors/index.js';
 import { error, redirect } from '@sveltejs/kit';
 import { BETTER_AUTH_ROLES } from '../collections/auth/constant.server.js';
 import { logger } from '../logger/index.server.js';
 const dev = process.env.NODE_ENV === 'development';
 /**
- * Analyzes the current route to determine authentication requirements
+ * Analyzes the current route to determine authentication requirements.
+ * isPanel/isPublicAuthRoute are derived from the matched route, not the
+ * pathname — event.params.panel only resolves when the request matched the
+ * [panel=panel] matcher, and event.route.id's literal folder names never
+ * carry the configured RIME_PANEL_ROUTE value — so neither check needs to
+ * know the actual (hideable) panel segment. sign-in/forgot-password/reset-password
+ * all live under [panel=panel] too but must stay reachable without a session,
+ * hence the isPublicAuthRoute carve-out.
  */
-function analyzeRoute(pathname) {
-    const isSignIn = pathname === '/panel/sign-in';
-    const isPanel = pathname.startsWith('/panel') && !isSignIn;
-    const isAPI = pathname.startsWith('/api');
-    return { isSignIn, isPanel, isAPI };
+function analyzeRoute(event) {
+    const isPublicAuthRoute = isPublicPanelAuthRoute(event.route.id);
+    const isPanel = event.params.panel !== undefined && !isPublicAuthRoute;
+    const isAPI = event.url.pathname.startsWith('/api');
+    return { isPublicAuthRoute, isPanel, isAPI };
 }
 /**
  * Ensures panel is properly set up before allowing access
@@ -31,7 +39,7 @@ async function authenticateRequest(headers, auth) {
  */
 function handleUnauthenticated(event, resolve, routeInfo) {
     if (routeInfo.isPanel) {
-        throw redirect(303, '/panel/sign-in');
+        throw redirect(303, `/${event.params.panel}/sign-in`);
     }
     event.locals.user = undefined;
     event.locals.session = undefined;
@@ -70,12 +78,11 @@ async function handleApiKeyAuth(headers, user, auth) {
     const result = await auth.api.verifyApiKey({
         body: { key: apiKey }
     });
-    if (!result.valid || !result.key || typeof result.key.permissions !== 'string') {
+    if (!result.valid || !result.key || !result.key.permissions) {
         logger.error(RimeError.UNAUTHORIZED, 'Invalid api key');
         throw error(401, RimeError.UNAUTHORIZED);
     }
-    const permissions = JSON.parse(result.key.permissions);
-    user.roles = permissions.roles;
+    user.roles = result.key.permissions.roles;
 }
 /**
  * Builds complete user data by combining auth and CMS information
@@ -133,7 +140,7 @@ function cleanupUser(userData, routeInfo) {
  */
 export const handleAuth = async ({ event, resolve }) => {
     const rime = event.locals.rime;
-    const routeInfo = analyzeRoute(event.url.pathname);
+    const routeInfo = analyzeRoute(event);
     // Ensure auth is set up
     if (routeInfo.isPanel) {
         await ensureFirstAuthSetup(rime);

package/dist/core/handlers/routes.server.d.ts

@@ -31,7 +31,7 @@ export declare const routeHandlers: {
                 aria: import("../../types.js").Route[];
             }>;
             live: typeof liveLoad;
-            signIn: ({ locals }: ServerLoadEvent) => Promise<{
+            signIn: ({ locals, params }: ServerLoadEvent) => Promise<{
                 forgotPasswordEnabled: boolean;
                 image: string | null;
                 form: {};

package/dist/core/handlers/routes.server.js

@@ -1,3 +1,4 @@
+import { isPublicPanelAuthRoute } from '../constant.js';
 import { prototypeKebabToSlug } from '../naming.js';
 import buildNavigation from '../../panel/navigation.js';
 import { areaFormActions } from '../../panel/pages/area/actions.server.js';
@@ -56,9 +57,9 @@ export const routeHandlers = {
 };
 export const handleRoutes = async ({ event, resolve }) => {
     const { rime, user } = event.locals;
-    const IS_SIGN_IN_ROUTE = event.url.pathname === '/panel/sign-in';
+    const IS_PUBLIC_AUTH_ROUTE = isPublicPanelAuthRoute(event.route.id);
     const IS_API_ROUTE = event.url.pathname.startsWith('/api');
-    const IS_PANEL_ROUTE = event.url.pathname.startsWith('/panel') && !IS_SIGN_IN_ROUTE;
+    const IS_PANEL_ROUTE = event.params.panel !== undefined && !IS_PUBLIC_AUTH_ROUTE;
     // event.params.slug comes straight from the URL, always kebab-case (see
     // src/params/collection.ts, area.ts). Collection/area slugs themselves are
     // camelCase, so rewrite once here — every downstream handler (panel
@@ -72,7 +73,7 @@ export const handleRoutes = async ({ event, resolve }) => {
     }
     // build panel navigation
     if (IS_PANEL_ROUTE && event.request.method === 'GET') {
-        event.locals.navigation = buildNavigation(rime.config.raw, user);
+        event.locals.navigation = buildNavigation(rime.config.raw, user, event.params.panel);
     }
     event.locals.routes = routeHandlers;
     // Handle custom routes from config and plugins