rimecms 0.31.3 → 0.31.5

package/dist/panel/components/ui/tabs/tabs.css

@@ -4,7 +4,6 @@
 }
 
 /**************************************/
-
 /* Trigger
 /**************************************/
 
@@ -33,11 +32,9 @@
 .rz-tabs-trigger[data-state='active']:not([data-error='true']) {
   color: hsl(var(--rz-color-fg));
 }
-
 .rz-tabs-trigger[data-error='true'] {
   color: hsl(var(--rz-color-alert) / 1);
 }
-
 .rz-tabs-trigger[data-state='inactive'] {
   opacity: 0.8;
 }
@@ -49,21 +46,18 @@
     0 0 0 calc(var(--rz-ring-offset, 0px) + 1px) hsl(var(--rz-color-ring) / var(--rz-ring-opacity, 1));
   outline: none;
 }
-
 .rz-tabs-trigger:disabled {
   pointer-events: none;
   opacity: 0.5;
 }
 
 /**************************************/
-
 /* Content
 /**************************************/
 
 .rz-tabs-content {
   margin-top: var(--rz-size-2);
 }
-
 .rz-tabs-content:focus-visible {
   outline: none;
   border-radius: var(--rz-radius-sm);
@@ -75,7 +69,6 @@
 }
 
 /**************************************/
-
 /* List
 /**************************************/
 

package/dist/panel/context/documentForm.svelte.js

@@ -4,6 +4,7 @@ import { PARAMS, VERSIONS_STATUS } from '../../core/constant.js';
 import { getFieldAtPath } from '../../core/fields/util.js';
 import { buildConfigMap } from '../../core/operations/configMap/index.js';
 import { isJSONContent, richTextJSONToText } from '../../fields/rich-text/index.js';
+import { panelUrl } from '../util/url.js';
 import { normalizeFieldPath } from '../../util/doc.js';
 import { apiUrl, random } from '../../util/index.js';
 import { isObjectLiteral, omit } from '../../util/object.js';
@@ -590,12 +591,10 @@ function createDocumentFormState({ initial, config, readOnly, key, onNestedDocum
      * This function constructs the appropriate URL to which the form data will be submitted.
      */
     const buildPanelActionUrl = () => {
-        // Start with the base URI for the panel
-        let panelUri = `/panel/${config.kebab}`;
-        // Add the item ID to the URI if we're updating a collection doc
-        if (operation === 'update' && initial._prototype === 'collection' && initial.id) {
-            panelUri += `/${initial.id}`;
-        }
+        // Start with the base URI for the panel, adding the item ID if we're updating a collection doc
+        const panelUri = operation === 'update' && initial._prototype === 'collection' && initial.id
+            ? panelUrl(config.kebab, initial.id)
+            : panelUrl(config.kebab);
         // Determine the appropriate action based on whether we're creating or updating
         const actionSuffix = operation === 'create' ? '/create?/create' : '?/update';
         // Add a redirect parameter if we're in a nested form ex: relation creation

package/dist/panel/navigation.d.ts

@@ -3,11 +3,16 @@ import type { BuildConfig } from '../core/config/server/index.server.js';
 import type { Config } from '../types.js';
 import type { Dic } from '../util/types.js';
 /**
- * Builds navigation structure based on config and user permissions
+ * Builds navigation structure based on config and user permissions. Called
+ * directly from the routes handle hook, before resolve() — page.params isn't
+ * populated yet at that point, so the panel segment is passed in explicitly
+ * (from the same event.params.panel the caller already has) rather than
+ * relying on panelUrl()'s page-based default.
  * @param config - Compiled configuration object
  * @param user - Current user object (optional)
+ * @param panelSegment - The resolved [panel=panel] segment for this request
  * @returns Dictionary of navigation groups
  */
-declare const buildNavigation: <C extends Config>(config: BuildConfig<C>, user: User | undefined) => Dic;
+declare const buildNavigation: <C extends Config>(config: BuildConfig<C>, user: User | undefined, panelSegment: string | undefined) => Dic;
 export default buildNavigation;
 export type Navigation = ReturnType<typeof buildNavigation>;

package/dist/panel/navigation.js

@@ -1,11 +1,16 @@
-import { panelUrl } from './util/url.js';
+import { panelUrlFor } from './util/url.js';
 /**
- * Builds navigation structure based on config and user permissions
+ * Builds navigation structure based on config and user permissions. Called
+ * directly from the routes handle hook, before resolve() — page.params isn't
+ * populated yet at that point, so the panel segment is passed in explicitly
+ * (from the same event.params.panel the caller already has) rather than
+ * relying on panelUrl()'s page-based default.
  * @param config - Compiled configuration object
  * @param user - Current user object (optional)
+ * @param panelSegment - The resolved [panel=panel] segment for this request
  * @returns Dictionary of navigation groups
  */
-const buildNavigation = (config, user) => {
+const buildNavigation = (config, user, panelSegment) => {
     const groups = {};
     /**
      * Adds a route to the appropriate navigation group
@@ -29,7 +34,7 @@ const buildNavigation = (config, user) => {
             const route = {
                 title: collection.label.plural,
                 icon: collection.slug,
-                url: panelUrl(collection.kebab)
+                url: panelUrlFor(panelSegment, collection.kebab)
             };
             addRouteToGroup(route, (collection.panel && collection.panel?.group) || 'collections');
         }
@@ -40,7 +45,7 @@ const buildNavigation = (config, user) => {
             const route = {
                 title: area.label,
                 icon: area.slug,
-                url: panelUrl(area.kebab)
+                url: panelUrlFor(panelSegment, area.kebab)
             };
             addRouteToGroup(route, (area.panel && area.panel?.group) || 'areas');
         }
@@ -50,7 +55,7 @@ const buildNavigation = (config, user) => {
         const route = {
             title: routeConfig.label,
             icon: `custom-${routePath}`,
-            url: panelUrl(routePath)
+            url: panelUrlFor(panelSegment, routePath)
         };
         addRouteToGroup(route, routeConfig.group);
     });

package/dist/panel/pages/area/actions.server.js

@@ -1,7 +1,7 @@
 import { PARAMS } from '../../../core/constant.js';
 import { ERROR_CONTEXT, handleError } from '../../../core/errors/handler.server.js';
 import { extractData } from '../../../core/operations/extract-data.server.js';
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { trycatch } from '../../../util/function.js';
 import { toKebabCase } from '../../../util/string.js';
 import { redirect } from '@sveltejs/kit';
@@ -10,6 +10,7 @@ export const areaFormActions = {
     update: async (event) => {
         const { rime, locale } = event.locals;
         const slug = (event.params.slug || '');
+        const panelSegment = event.params.panel;
         const versionId = event.url.searchParams.get(PARAMS.VERSION_ID) || undefined;
         const draft = event.url.searchParams.get(PARAMS.DRAFT) === 'true';
         const [extractError, data] = await trycatch(() => extractData(event.request));
@@ -28,10 +29,10 @@ export const areaFormActions = {
         if (draft && 'versionId' in document) {
             const referer = event.request.headers.get('referer');
             if (referer && referer.includes('/versions')) {
-                return redirect(303, `${panelUrl(toKebabCase(slug))}/versions?versionId=${document.versionId}`);
+                return redirect(303, `${panelUrlFor(panelSegment, toKebabCase(slug))}/versions?versionId=${document.versionId}`);
             }
             else {
-                return redirect(303, `${panelUrl(toKebabCase(slug))}?versionId=${document.versionId}`);
+                return redirect(303, `${panelUrlFor(panelSegment, toKebabCase(slug))}?versionId=${document.versionId}`);
             }
         }
         return { document, message: t__('common.doc_updated') };

package/dist/panel/pages/area/load.server.js

@@ -2,7 +2,7 @@ import { PARAMS } from '../../../core/constant.js';
 import { ERROR_CONTEXT, handleError } from '../../../core/errors/handler.server.js';
 import { RimeError } from '../../../core/errors/index.js';
 import { withVersionsSuffix } from '../../../core/naming.js';
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { trycatch } from '../../../util/function.js';
 import { apiUrl } from '../../../util/index.js';
 import { toKebabCase } from '../../../util/string.js';
@@ -11,6 +11,7 @@ export async function areaLoad(event, withVersions) {
     const { locals, url, fetch } = event;
     const { rime, locale } = locals;
     const slug = (event.params.slug || '');
+    const panelSegment = event.params.panel;
     const area = rime.area(slug);
     const authorizedRead = area.config.access.read(locals.user, {});
     const authorizedUpdate = area.config.access.update(locals.user, {});
@@ -18,7 +19,7 @@ export async function areaLoad(event, withVersions) {
         throw handleError(new RimeError(RimeError.UNAUTHORIZED), { context: ERROR_CONTEXT.LOAD });
     }
     const aria = [
-        { title: 'Dashboard', icon: 'dashboard', url: panelUrl() },
+        { title: 'Dashboard', icon: 'dashboard', url: panelUrlFor(panelSegment) },
         { title: area.config.label }
     ];
     const versionId = url.searchParams.get(PARAMS.VERSION_ID) || undefined;

package/dist/panel/pages/auth/forgot-password/ForgotPassword.svelte

@@ -6,6 +6,7 @@
   import { setFormContext } from '../../../context/form.svelte';
   import { emailField } from '../fields.js';
   import { authClient } from '../../../util/auth';
+  import { panelUrl } from '../../../util/url.js';
   import { toast } from 'svelte-sonner';
 
   type Props = {
@@ -29,7 +30,7 @@
   async function sendResetPasswordMail() {
     const { data, error } = await authClient.requestPasswordReset({
       email: context.values.email,
-      redirectTo: `/reset-password`
+      redirectTo: panelUrl('reset-password')
     });
     if (error && error.message) {
       toast.error(error.message);

package/dist/panel/pages/auth/reset-password/ResetPassword.svelte

@@ -6,6 +6,7 @@
   import { setFormContext } from '../../../context/form.svelte';
   import { confirmPasswordField, passwordField } from '../fields.js';
   import { authClient } from '../../../util/auth';
+  import { panelUrl } from '../../../util/url.js';
   import { toast } from 'svelte-sonner';
 
   let success = $state(false);
@@ -42,7 +43,7 @@
 <AuthForm image={data.image} title={t__('common.resetPassword')}>
   {#if success}
     <p>{t__('common.reset_password_success')}</p>
-    <Button size="xl" href="/panel/sign-in">{t__('common.signin')}</Button>
+    <Button size="xl" href={panelUrl('sign-in')}>{t__('common.signin')}</Button>
   {:else}
     <Text type="password" config={passwordConfig} {form} />
     <Text type="password" config={confirmPasswordConfig} {form} />

package/dist/panel/pages/auth/sign-in/SignIn.svelte

@@ -8,6 +8,7 @@
   import SpinLoader from '../../../components/ui/spin-loader/SpinLoader.svelte';
   import { setFormContext } from '../../../context/form.svelte';
   import { emailField, passwordField } from '../fields.js';
+  import { panelPath, panelUrl } from '../../../util/url.js';
   import type { FormErrors } from '../../../../types.js';
   import { KeyRound } from '@lucide/svelte';
   import { toast } from 'svelte-sonner';
@@ -34,7 +35,7 @@
 
 <AuthForm image={data.image} title={t__('common.signin')}>
   {#if context.status !== 429}
-    <form method="POST" action="/panel/sign-in" use:enhance={context.enhance}>
+    <form method="POST" action={panelPath('sign-in')} use:enhance={context.enhance}>
       <Email config={emailField} form={context} />
       <Text
         type="password"
@@ -50,7 +51,7 @@
       </Button>
 
       {#if data.forgotPasswordEnabled}
-        <Button variant="link" href="/forgot-password">
+        <Button variant="link" href={panelUrl('forgot-password')}>
           {t__('common.forgotPassword')}
         </Button>
       {/if}

package/dist/panel/pages/auth/sign-in/actions.server.js

@@ -3,7 +3,7 @@ import { handleError } from '../../../../core/errors/handler.server.js';
 import { RimeFormError } from '../../../../core/errors/index.js';
 import { redirect } from '@sveltejs/kit';
 export const signInActions = {
-    default: async ({ cookies, request, locals }) => {
+    default: async ({ cookies, request, locals, params }) => {
         const { rime } = locals;
         const data = await request.formData();
         const email = data.get('email')?.toString() || '';
@@ -36,6 +36,6 @@ export const signInActions = {
                 secure: !dev
             });
         }
-        throw redirect(302, '/panel');
+        throw redirect(302, `/${params.panel}`);
     }
 };

package/dist/panel/pages/auth/sign-in/load.server.d.ts

@@ -1,5 +1,5 @@
 import { type ServerLoadEvent } from '@sveltejs/kit';
-export declare const signInLoad: ({ locals }: ServerLoadEvent) => Promise<{
+export declare const signInLoad: ({ locals, params }: ServerLoadEvent) => Promise<{
     forgotPasswordEnabled: boolean;
     image: string | null;
     form: {};

package/dist/panel/pages/auth/sign-in/load.server.js

@@ -1,11 +1,11 @@
 import { redirect } from '@sveltejs/kit';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
-export const signInLoad = async ({ locals }) => {
+export const signInLoad = async ({ locals, params }) => {
     const { session, rime } = locals;
     const imageExist = existsSync(path.join(process.cwd(), 'static', 'panel', 'panel.jpg'));
     if (session) {
-        throw redirect(302, '/panel');
+        throw redirect(302, `/${params.panel}`);
     }
     else {
         return {

package/dist/panel/pages/collection/load.server.js

@@ -4,7 +4,7 @@ import { handleError } from '../../../core/errors/handler.server.js';
 import { RimeError } from '../../../core/errors/index.js';
 import { logger } from '../../../core/logger/index.server.js';
 import { withDirectoriesSuffix } from '../../../core/naming.js';
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { trycatch } from '../../../util/function.js';
 import { redirect } from '@sveltejs/kit';
 /**
@@ -13,6 +13,7 @@ import { redirect } from '@sveltejs/kit';
 export async function collectionLoad(event) {
     //
     const { rime, locale, user } = event.locals;
+    const panelSegment = event.params.panel;
     const slug = event.params.slug || '';
     if (!rime.config.isCollection(slug)) {
         throw handleError(new RimeError(RimeError.NOT_FOUND), { context: 'load' });
@@ -24,7 +25,7 @@ export async function collectionLoad(event) {
         draft: true
     });
     let aria = [
-        { title: 'Dashboard', url: panelUrl() },
+        { title: 'Dashboard', url: panelUrlFor(panelSegment) },
         { title: collection.config.label.plural }
     ];
     let data = {
@@ -68,10 +69,14 @@ export async function collectionLoad(event) {
             parentDirectory = result;
             const collectionAria = {
                 title: collection.config.label.plural,
-                url: panelUrl(collection.config.kebab)
+                url: panelUrlFor(panelSegment, collection.config.kebab)
             };
             aria = [...aria].slice(0, -1);
-            aria = [...aria, collectionAria, ...buildUploadAria({ path: currentDirectoryPath, slug })];
+            aria = [
+                ...aria,
+                collectionAria,
+                ...buildUploadAria({ path: currentDirectoryPath, slug, panelSegment })
+            ];
             data.aria = removePathFromLastAria(aria);
         }
         data = {

package/dist/panel/pages/collection-document/actions.server.js

@@ -2,7 +2,7 @@ import { PARAMS, UPLOAD_PATH } from '../../../core/constant.js';
 import { ERROR_CONTEXT, handleError } from '../../../core/errors/handler.server.js';
 import { RimeError } from '../../../core/errors/index.js';
 import { extractData } from '../../../core/operations/extract-data.server.js';
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { trycatch } from '../../../util/function.js';
 import { toKebabCase } from '../../../util/string.js';
 import {} from '@sveltejs/kit';
@@ -15,6 +15,7 @@ export const collectionFormActions = {
      */
     create: async (event) => {
         const { rime, locale } = event.locals;
+        const panelSegment = event.params.panel;
         const slug = event.params.slug;
         if (!rime.config.isCollection(slug)) {
             throw handleError(new RimeError(RimeError.NOT_FOUND), { context: ERROR_CONTEXT.ACTION });
@@ -44,7 +45,7 @@ export const collectionFormActions = {
         const params = collection.config.upload
             ? `?${PARAMS.UPLOAD_PATH}=${data._path || UPLOAD_PATH.ROOT_NAME}`
             : '';
-        const redirectUrl = `${panelUrl(toKebabCase(slug), document.id)}${params}`;
+        const redirectUrl = `${panelUrlFor(panelSegment, toKebabCase(slug), document.id)}${params}`;
         return {
             redirectUrl,
             document,
@@ -58,6 +59,7 @@ export const collectionFormActions = {
      */
     update: async (event) => {
         const { rime, locale } = event.locals;
+        const panelSegment = event.params.panel;
         const slug = event.params.slug || '';
         const id = event.params.id || '';
         const versionId = event.url.searchParams.get(PARAMS.VERSION_ID) || undefined;
@@ -83,7 +85,7 @@ export const collectionFormActions = {
             return {
                 document,
                 message: t__('common.version_created'),
-                redirectUrl: `${panelUrl(toKebabCase(slug), document.id)}/versions?versionId=${document.versionId}`
+                redirectUrl: `${panelUrlFor(panelSegment, toKebabCase(slug), document.id)}/versions?versionId=${document.versionId}`
             };
         }
         return {

package/dist/panel/pages/collection-document/load.server.js

@@ -3,7 +3,7 @@ import { PARAMS, UPLOAD_PATH } from '../../../core/constant.js';
 import { ERROR_CONTEXT, handleError } from '../../../core/errors/handler.server.js';
 import { RimeError } from '../../../core/errors/index.js';
 import { withVersionsSuffix } from '../../../core/naming.js';
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { trycatch } from '../../../util/function.js';
 import { apiUrl } from '../../../util/index.js';
 import { toKebabCase } from '../../../util/string.js';
@@ -16,6 +16,7 @@ export async function documentLoad(event, withVersion) {
     const { locale, user, rime } = event.locals;
     const { id } = event.params;
     const slug = event.params.slug || '';
+    const panelSegment = event.params.panel;
     if (!id)
         throw error(404, 'Not found');
     let doc;
@@ -55,22 +56,25 @@ export async function documentLoad(event, withVersion) {
     let aria;
     const collectionAria = {
         title: collection.config.label.plural,
-        url: panelUrl(collection.config.kebab)
+        url: panelUrlFor(panelSegment, collection.config.kebab)
     };
     if (collection.config.upload) {
         const paramUploadPath = event.url.searchParams.get('uploadPath');
         const currentDirectoryPath = paramUploadPath || UPLOAD_PATH.ROOT_NAME;
         aria = [
-            { title: 'Dashboard', icon: 'dashboard', url: panelUrl() },
+            { title: 'Dashboard', icon: 'dashboard', url: panelUrlFor(panelSegment) },
             collectionAria,
-            ...buildUploadAria({ path: currentDirectoryPath, slug }),
+            ...buildUploadAria({ path: currentDirectoryPath, slug, panelSegment }),
             { title: undefined } // Will be populated by title context
         ];
     }
     else {
         aria = [
-            { title: 'Dashboard', icon: 'dashboard', url: panelUrl() },
-            { title: collection.config.label.plural, url: panelUrl(collection.config.kebab) },
+            { title: 'Dashboard', icon: 'dashboard', url: panelUrlFor(panelSegment) },
+            {
+                title: collection.config.label.plural,
+                url: panelUrlFor(panelSegment, collection.config.kebab)
+            },
             { title: undefined } // Will be populated by title context
         ];
     }

package/dist/panel/pages/dashboard/load.server.js

@@ -1,7 +1,8 @@
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { capitalize } from '../../../util/string.js';
 export const dashboardLoad = async (event) => {
     const { locale, user, rime } = event.locals;
+    const panelSegment = event.params.panel;
     const entries = [];
     const normalizedPanelConfig = (c) => {
         const incomingConfig = c.panel || {};
@@ -21,7 +22,7 @@ export const dashboardLoad = async (event) => {
             description: panelConfig.description || null,
             slug: c.slug,
             canCreate: user && c.access.create(user, {}),
-            link: panelUrl(c.kebab),
+            link: panelUrlFor(panelSegment, c.kebab),
             titleSingular: c.label.singular,
             title: c.label.plural,
             layout: panelConfig.dashboard.layout
@@ -72,11 +73,11 @@ export const dashboardLoad = async (event) => {
                 prototype: 'area',
                 description: (area.panel && area.panel?.description) || null,
                 slug: area.slug,
-                link: panelUrl(area.kebab),
+                link: panelUrlFor(panelSegment, area.kebab),
                 title: area.label || capitalize(area.slug)
             });
         }
     }
-    const aria = [{ title: 'Dashboard', icon: 'dashboard', url: panelUrl() }];
+    const aria = [{ title: 'Dashboard', icon: 'dashboard', url: panelUrlFor(panelSegment) }];
     return { entries, aria };
 };

package/dist/panel/pages/live/Live.svelte

@@ -14,6 +14,7 @@
   import { setLocaleContext } from '../../context/locale.svelte';
   import { setTitleContext } from '../../context/title';
   import { setUserContext } from '../../context/user.svelte';
+  import { panelPath } from '../../util/url.js';
   import type { GenericDoc, User } from '../../../types';
   import { trycatchFetch } from '../../../util/function';
   import { snapshot } from '../../../util/state';
@@ -240,13 +241,8 @@
     const slug = data.slug;
     const id = data.doc.id;
 
-    // Start with the base URI for the panel
-    let panelUri = `/panel/${toKebabCase(slug)}`;
-
-    // Add the item ID to the URI if we're updating a collection doc
-    if (id) {
-      panelUri += `/${id}`;
-    }
+    // Start with the base URI for the panel, adding the item ID if present
+    const panelUri = id ? panelPath(toKebabCase(slug), id) : panelPath(toKebabCase(slug));
     return goto(panelUri);
   }
 

package/dist/panel/style/index.css

@@ -312,7 +312,6 @@ menu {
 /*
 Reset default styling for dialogs.
 */
-
 dialog {
     padding: 0;
 }
@@ -353,7 +352,6 @@ button,
 /*
 Make sure disabled buttons don't get the pointer cursor.
 */
-
 :disabled {
     cursor: default;
 }
@@ -387,11 +385,9 @@ video {
 }
 
 /* Make elements with the HTML hidden attribute stay hidden by default */
-
 [hidden] {
     display: none;
 }
-
 :root{
     --ease-in-quad: cubic-bezier(.55, .085, .68, .53);
     --ease-in-cubic: cubic-bezier(.550, .055, .675, .19);
@@ -414,7 +410,6 @@ video {
     --ease-in-out-expo: cubic-bezier(1, 0, 0, 1);
     --ease-in-out-circ: cubic-bezier(.785, .135, .15, .86);
 }
-
 :root {
   --rz-size-0-5: 0.125rem;
   --rz-size-1: 0.25rem;
@@ -458,7 +453,6 @@ video {
   --rz-size-tablet: 48rem;
   --rz-size-laptop: 64rem;
 }
-
 @font-face {
   font-family: 'Lora';
   src: url('/assets/panel/fonts/Lora-Italic-VariableFont_wght.ttf') format('truetype');

package/dist/panel/util/auth.js

@@ -1,5 +1,5 @@
+import { apiKeyClient } from '@better-auth/api-key/client';
 import { env } from '$env/dynamic/public';
-import { apiKeyClient } from 'better-auth/client/plugins';
 import { createAuthClient } from 'better-auth/svelte';
 export const authClient = createAuthClient({
     baseURL: env.PUBLIC_RIME_URL,

package/dist/panel/util/url.d.ts

@@ -1,6 +1,35 @@
 /**
- * Build a panel url for given segments
+ * Build a panel url for given segments. Reads the current panel segment off
+ * the live matched route (page.params.panel, resolved by the [panel=panel]
+ * matcher) rather than from a public env var — the segment can be configured
+ * via RIME_PANEL_ROUTE to hide the panel from admin-path scanners, and that
+ * would be defeated by shipping it into every page's public env bundle.
+ *
+ * Only call this from actual component rendering (.svelte files, or a
+ * .svelte.ts context set up during component init) — page.params is bound to
+ * the current request via component context and SvelteKit throws if it's read
+ * anywhere else, including a +page.server.ts/+layout.server.ts load function
+ * or a form action, even though those also run server-side. Every load/action
+ * function in this codebase already receives an `event` with `event.params.panel`
+ * populated the same way — use panelUrlFor(event.params.panel, ...) there instead.
  * @example
  * panelUrl('some-collection') // -> http://localhost:5713/panel/some-collection
  */
 export declare function panelUrl(...args: string[]): string;
+/**
+ * Same as panelUrl(), but takes the panel segment explicitly instead of
+ * reading it off page.params — for any caller that isn't component rendering:
+ * every +page.server.ts/+layout.server.ts load function and form action
+ * (pass event.params.panel), plus the one hook-level caller that runs before
+ * resolve() (buildNavigation(), which gets it forwarded from routes.server.ts).
+ */
+export declare function panelUrlFor(panelSegment: string | undefined, ...args: string[]): string;
+/**
+ * Same as panelUrl(), but returns a same-origin-relative path instead of an
+ * absolute URL — for goto()/form-action targets where PUBLIC_RIME_URL isn't
+ * guaranteed to match the actual origin the page was served from (a reverse
+ * proxy, differing dev host, etc). Everywhere else (real cross-page <a href>
+ * links, window.location.href, emailed reset links) stays absolute, matching
+ * apiUrl()'s existing convention.
+ */
+export declare function panelPath(...args: string[]): string;

package/dist/panel/util/url.js

@@ -1,9 +1,43 @@
+import { page } from '$app/state';
 import { env } from '$env/dynamic/public';
 /**
- * Build a panel url for given segments
+ * Build a panel url for given segments. Reads the current panel segment off
+ * the live matched route (page.params.panel, resolved by the [panel=panel]
+ * matcher) rather than from a public env var — the segment can be configured
+ * via RIME_PANEL_ROUTE to hide the panel from admin-path scanners, and that
+ * would be defeated by shipping it into every page's public env bundle.
+ *
+ * Only call this from actual component rendering (.svelte files, or a
+ * .svelte.ts context set up during component init) — page.params is bound to
+ * the current request via component context and SvelteKit throws if it's read
+ * anywhere else, including a +page.server.ts/+layout.server.ts load function
+ * or a form action, even though those also run server-side. Every load/action
+ * function in this codebase already receives an `event` with `event.params.panel`
+ * populated the same way — use panelUrlFor(event.params.panel, ...) there instead.
  * @example
  * panelUrl('some-collection') // -> http://localhost:5713/panel/some-collection
  */
 export function panelUrl(...args) {
-    return `${env.PUBLIC_RIME_URL}/panel/${args.join('/')}`;
+    return panelUrlFor(page.params.panel, ...args);
+}
+/**
+ * Same as panelUrl(), but takes the panel segment explicitly instead of
+ * reading it off page.params — for any caller that isn't component rendering:
+ * every +page.server.ts/+layout.server.ts load function and form action
+ * (pass event.params.panel), plus the one hook-level caller that runs before
+ * resolve() (buildNavigation(), which gets it forwarded from routes.server.ts).
+ */
+export function panelUrlFor(panelSegment, ...args) {
+    return `${env.PUBLIC_RIME_URL}/${panelSegment}/${args.join('/')}`;
+}
+/**
+ * Same as panelUrl(), but returns a same-origin-relative path instead of an
+ * absolute URL — for goto()/form-action targets where PUBLIC_RIME_URL isn't
+ * guaranteed to match the actual origin the page was served from (a reverse
+ * proxy, differing dev host, etc). Everywhere else (real cross-page <a href>
+ * links, window.location.href, emailed reset links) stays absolute, matching
+ * apiUrl()'s existing convention.
+ */
+export function panelPath(...args) {
+    return `/${page.params.panel}/${args.join('/')}`;
 }