rimecms 0.31.4 → 0.31.5

package/README.md

@@ -1,7 +1,7 @@
 ![rime logo](https://github.com/bienbiendev/rime/blob/main/assets/logo-white.png#gh-dark-mode-only)
 ![rime logo](https://github.com/bienbiendev/rime/blob/main/assets/logo-black.png#gh-light-mode-only)
 
-Headless CMS powered by SvelteKit. [Read the doc](https://github.com/bienbiendev/rime-doc/tree/master/docs)
+Headless CMS powered by SvelteKit. [Read the doc](https://github.com/bienbiendev/rime-doc/blob/develop/docs/02-installation.md)
 
 ![NPM Version](https://img.shields.io/npm/v/rimecms)
 ![NPM Downloads](https://img.shields.io/npm/dm/rimecms)

package/dist/adapter-sqlite/transform.server.js

@@ -24,7 +24,7 @@ export const transformerFacade = (args) => {
         const tableName = isVersioned ? withVersionsSuffix(slug) : slug;
         const tableNameRelationFields = `${tableName}Rels`;
         const tableNameLocales = withLocalesSuffix(tableName);
-        const isPanel = event.url.pathname.startsWith('/panel');
+        const isPanel = event.params.panel !== undefined;
         let docAPI;
         if (configCtx.isCollection(slug)) {
             docAPI = rime.collection(slug);

package/dist/core/collections/upload/util/path.d.ts

@@ -46,9 +46,10 @@ export declare function getParentPath(path: UploadPath): string | null;
  * buildUploadAria('root:foo:bar')
  * // return [{ title: 'foo', path: '/panel/{slug}?=root:foo' }, { title: 'bar' }]
  */
-export declare function buildUploadAria({ path, slug }: {
+export declare function buildUploadAria({ path, slug, panelSegment }: {
     path: UploadPath;
     slug: CollectionSlug;
+    panelSegment: string | undefined;
 }): Partial<Route>[];
 export declare function removePathFromLastAria(aria: Partial<Route>[]): Partial<Route>[];
 /**

package/dist/core/collections/upload/util/path.js

@@ -1,6 +1,6 @@
 import { PARAMS, UPLOAD_PATH } from '../../../constant.js';
 import { RimeError } from '../../../errors/index.js';
-import { panelUrl } from '../../../../panel/util/url.js';
+import { panelUrlFor } from '../../../../panel/util/url.js';
 import { toKebabCase } from '../../../../util/string.js';
 /**
  * Validates that a path string follows the required format:
@@ -75,7 +75,7 @@ export function getParentPath(path) {
  * buildUploadAria('root:foo:bar')
  * // return [{ title: 'foo', path: '/panel/{slug}?=root:foo' }, { title: 'bar' }]
  */
-export function buildUploadAria({ path, slug }) {
+export function buildUploadAria({ path, slug, panelSegment }) {
     const segments = path.split(':');
     const result = [];
     let currentPath = '';
@@ -86,7 +86,7 @@ export function buildUploadAria({ path, slug }) {
         if (currentPath !== segments[0]) {
             result.push({
                 title: segment,
-                url: `${panelUrl(toKebabCase(slug))}?${PARAMS.UPLOAD_PATH}=${currentPath}`
+                url: `${panelUrlFor(panelSegment, toKebabCase(slug))}?${PARAMS.UPLOAD_PATH}=${currentPath}`
             });
         }
     }

package/dist/core/constant.d.ts

@@ -1,3 +1,13 @@
+/** The generated panel route always lives at this fixed matcher-folder id — the literal
+ * folder name never changes, only which segment value src/params/panel.ts's matcher
+ * accepts (see PANEL_ROUTE in core/dev/constants.ts). Route ids never carry the resolved
+ * param value, so these are safe to compare against event.route.id without leaking the
+ * configured secret. */
+export declare const PANEL_ROUTE_ID = "/(rime)/[panel=panel]";
+export declare const PANEL_SIGN_IN_ROUTE_ID = "/(rime)/[panel=panel]/sign-in";
+export declare const PANEL_FORGOT_PASSWORD_ROUTE_ID = "/(rime)/[panel=panel]/forgot-password";
+export declare const PANEL_RESET_PASSWORD_ROUTE_ID = "/(rime)/[panel=panel]/reset-password";
+export declare function isPublicPanelAuthRoute(routeId: string | null): boolean;
 export declare const VERSIONS_STATUS: {
     readonly DRAFT: "draft";
     readonly PUBLISHED: "published";

package/dist/core/constant.js

@@ -1,3 +1,25 @@
+/** The generated panel route always lives at this fixed matcher-folder id — the literal
+ * folder name never changes, only which segment value src/params/panel.ts's matcher
+ * accepts (see PANEL_ROUTE in core/dev/constants.ts). Route ids never carry the resolved
+ * param value, so these are safe to compare against event.route.id without leaking the
+ * configured secret. */
+export const PANEL_ROUTE_ID = '/(rime)/[panel=panel]';
+export const PANEL_SIGN_IN_ROUTE_ID = `${PANEL_ROUTE_ID}/sign-in`;
+export const PANEL_FORGOT_PASSWORD_ROUTE_ID = `${PANEL_ROUTE_ID}/forgot-password`;
+export const PANEL_RESET_PASSWORD_ROUTE_ID = `${PANEL_ROUTE_ID}/reset-password`;
+/** sign-in, forgot-password and reset-password all have to stay reachable by an
+ * unauthenticated visitor (someone locked out, or clicking a reset link from email) even
+ * though they now live under the same hidden [panel=panel] segment as the rest of the
+ * panel — this is the auth-gate's "public, no-session-required" exception, broadened from
+ * sign-in alone to cover all three. */
+const PANEL_PUBLIC_AUTH_ROUTE_IDS = new Set([
+    PANEL_SIGN_IN_ROUTE_ID,
+    PANEL_FORGOT_PASSWORD_ROUTE_ID,
+    PANEL_RESET_PASSWORD_ROUTE_ID
+]);
+export function isPublicPanelAuthRoute(routeId) {
+    return !!routeId && PANEL_PUBLIC_AUTH_ROUTE_IDS.has(routeId);
+}
 export const VERSIONS_STATUS = {
     DRAFT: 'draft',
     PUBLISHED: 'published'

package/dist/core/dev/cli/build/templates.js

@@ -1,9 +1,11 @@
+import { PANEL_ROUTE } from '../../constants.js';
 import { randomId } from '../../../../util/random.js';
 export const envProduction = () => `# BETTER-AUTH
 BETTER_AUTH_SECRET=${randomId(32)}
 
 # RIME
 PUBLIC_RIME_URL=http://localhost:3000
+RIME_PANEL_ROUTE=${PANEL_ROUTE}
 RIME_LOG_LEVEL=ERROR
 RIME_LOG_TO_FILE=true
 RIME_CACHE_ENABLED=true

package/dist/core/dev/cli/init/index.server.js

@@ -9,7 +9,7 @@ import { cp, mkdir } from 'fs/promises';
 import fs from 'node:fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { CONFIG_DIR, OUTPUT_DIR } from '../../constants.js';
+import { CONFIG_DIR, OUTPUT_DIR, PANEL_ROUTE } from '../../constants.js';
 import { generate } from '../generate/index.server.js';
 import { installDependencies } from '../util/package-manager.server.js';
 import { getPackageInfoByKey } from '../util/package.server.js';
@@ -26,6 +26,7 @@ export const init = async ({ force, name: incomingName, skipInstall }) => {
             BETTER_AUTH_SECRET: randomId(32),
             PUBLIC_RIME_URL: 'http://localhost:5173',
             RIME_CONFIG_DIR: CONFIG_DIR,
+            RIME_PANEL_ROUTE: PANEL_ROUTE,
             '# RIME_SMTP_USER': 'user@mail.com',
             '# RIME_SMTP_PASSWORD': 'supersecret',
             '# RIME_SMTP_PORT': '465',

package/dist/core/dev/cli/init/templates.d.ts

@@ -2,10 +2,12 @@ export declare const env: () => string;
 export declare const defaultConfig: (name: string) => string;
 export declare const drizzleConfig: (name: string) => string;
 export declare const hooks: () => string;
-/** Writes src/hooks.server.ts if missing, or rewrites it if its content would differ from
- * what's expected now (e.g. after RIME_CONFIG_DIR changes the import path) — called both at
- * `rime init` and whenever the dev server detects a config change, so it never goes stale
- * between the two. Returns whether it wrote anything. */
+/** Writes src/hooks.server.ts if missing. If it already exists, patches only the config
+ * import line if it's stale (e.g. after RIME_CONFIG_DIR changes the import path) — the rest
+ * of the file may carry real customizations (e.g. an appended handler), so this never
+ * touches anything else. Called both at `rime init` and whenever the dev server detects a
+ * config change, so the import path never goes stale between the two. Returns whether it
+ * wrote anything. */
 export declare function regenerateHooks(root?: string): boolean;
 /** Patches drizzle.config.ts's schema path line if it's stale (e.g. after RIME_CONFIG_DIR
  * changes) — only that one line, since the rest of the file may carry real customizations

package/dist/core/dev/cli/init/templates.js

@@ -1,12 +1,19 @@
 import { randomId } from '../../../../util/random.js';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { CONFIG_DIR, GENERATED_DIR, configImportPaths } from '../../constants.js';
+import { CONFIG_DIR, GENERATED_DIR, PANEL_ROUTE, configImportPaths } from '../../constants.js';
 const PACKAGE = 'rimecms';
 export const env = () => `BETTER_AUTH_SECRET=${randomId(32)}
 PUBLIC_RIME_URL=http://localhost:5173
 RIME_CONFIG_DIR=${CONFIG_DIR}
 
+# Panel URL segment (e.g. /panel/...). Change it to hide the panel from
+# automated CMS-admin scanners — requests to the old segment 404 instead of
+# revealing a login page. Run 'rime generate' (or restart 'rime dev') after
+# changing this — the dev server only regenerates routes when it detects a
+# change under RIME_CONFIG_DIR, not on every restart.
+RIME_PANEL_ROUTE=${PANEL_ROUTE}
+
 # RIME_CACHE_ENABLED=false
 # RIME_SMTP_USER=user@mail.com
 # RIME_SMTP_PASSWORD=supersecret
@@ -63,23 +70,27 @@ import config from '${configImportPaths(HOOKS_DIR).server}';
 
 export const handle = sequence(...(await handlers(config)));
 `;
-/** Writes src/hooks.server.ts if missing, or rewrites it if its content would differ from
- * what's expected now (e.g. after RIME_CONFIG_DIR changes the import path) — called both at
- * `rime init` and whenever the dev server detects a config change, so it never goes stale
- * between the two. Returns whether it wrote anything. */
+const HOOKS_CONFIG_IMPORT_LINE_REGEX = /^import config from ['"][^'"]*['"];\s*$/m;
+/** Writes src/hooks.server.ts if missing. If it already exists, patches only the config
+ * import line if it's stale (e.g. after RIME_CONFIG_DIR changes the import path) — the rest
+ * of the file may carry real customizations (e.g. an appended handler), so this never
+ * touches anything else. Called both at `rime init` and whenever the dev server detects a
+ * config change, so the import path never goes stale between the two. Returns whether it
+ * wrote anything. */
 export function regenerateHooks(root = process.cwd()) {
     const hooksPath = path.join(root, 'src', 'hooks.server.ts');
     const srcDir = path.join(root, 'src');
-    const content = hooks();
     if (!existsSync(hooksPath)) {
         if (!existsSync(srcDir)) {
             mkdirSync(srcDir, { recursive: true });
         }
-        writeFileSync(hooksPath, content, 'utf-8');
+        writeFileSync(hooksPath, hooks(), 'utf-8');
         return true;
     }
-    if (readFileSync(hooksPath, 'utf-8') !== content) {
-        writeFileSync(hooksPath, content, 'utf-8');
+    const expectedImportLine = `import config from '${configImportPaths(HOOKS_DIR).server}';`;
+    const content = readFileSync(hooksPath, 'utf-8');
+    if (HOOKS_CONFIG_IMPORT_LINE_REGEX.test(content) && !content.includes(expectedImportLine)) {
+        writeFileSync(hooksPath, content.replace(HOOKS_CONFIG_IMPORT_LINE_REGEX, expectedImportLine));
         return true;
     }
     return false;

package/dist/core/dev/constants.d.ts

@@ -2,6 +2,11 @@ export declare const CONFIG_DIR: string;
 export declare const GENERATED_DIR: string;
 export declare const INPUT_DIR: string;
 export declare const OUTPUT_DIR: string;
+/** The panel's URL segment (e.g. "panel" -> /panel/...). Kept as a bare segment, never a
+ * PUBLIC_-prefixed env var: SvelteKit ships every PUBLIC_ value into the JS bundle of every
+ * page (including the public site), which would defeat the point of letting an operator hide
+ * this path from automated CMS-admin scanners. */
+export declare const PANEL_ROUTE: string;
 /** Turns an absolute path into an import specifier relative to `fromDir`, always prefixed
  * with `./` or `../` so it never gets mistaken for a bare package specifier. */
 export declare function relativeImportSpecifier(fromDir: string, toAbsolutePath: string): string;

package/dist/core/dev/constants.js

@@ -1,5 +1,6 @@
 import dotenv from 'dotenv';
 import path from 'node:path';
+import { isValidSlug } from '../../util/string.js';
 // Must run before RIME_CONFIG_DIR is read below. ES import hoisting evaluates this module's
 // top-level code before any *importing* file's own top-level statements — including a
 // dotenv.config() call there — so loading .env here, first, is the only way every entry point
@@ -14,6 +15,14 @@ export const CONFIG_DIR = process.env.RIME_CONFIG_DIR || 'src/+rime';
 export const GENERATED_DIR = `${CONFIG_DIR}.generated`;
 export const INPUT_DIR = path.basename(CONFIG_DIR);
 export const OUTPUT_DIR = `${INPUT_DIR}.generated`;
+/** The panel's URL segment (e.g. "panel" -> /panel/...). Kept as a bare segment, never a
+ * PUBLIC_-prefixed env var: SvelteKit ships every PUBLIC_ value into the JS bundle of every
+ * page (including the public site), which would defeat the point of letting an operator hide
+ * this path from automated CMS-admin scanners. */
+export const PANEL_ROUTE = (process.env.RIME_PANEL_ROUTE || 'panel').replace(/^\/+|\/+$/g, '');
+if (!isValidSlug(PANEL_ROUTE)) {
+    throw new Error(`RIME_PANEL_ROUTE must be a single URL segment (letters, numbers, "_"/"-", starting with a letter) — got "${PANEL_ROUTE}"`);
+}
 const RESERVED_DIRS = new Set(['lib', 'routes', 'static', 'params'].map((d) => path.resolve(SRC_ROOT, d)));
 for (const dir of [CONFIG_DIR, GENERATED_DIR]) {
     const resolved = path.resolve(root, dir);

package/dist/core/dev/generate/routes/common.server.js

@@ -1,8 +1,8 @@
 import { PACKAGE_NAME } from '../../../constant.server.js';
 import path from 'node:path';
 import { configImportPaths } from '../../constants.js';
-const PANEL_LAYOUT_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/panel');
-const LIVE_PAGE_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/panel/live-edit');
+const PANEL_LAYOUT_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/[panel=panel]');
+const LIVE_PAGE_DIR = path.resolve(process.cwd(), 'src/routes/(rime)/[panel=panel]/live-edit');
 /**
  * Main base layout
  * /+layout.server.ts
@@ -82,7 +82,7 @@ export const load = async ({ locals }: ServerLoadEvent) => {
 };`;
 /**
  * Login page template
- * (rime)/panel/sign-in/+page.svelte
+ * (rime)/[panel=panel]/sign-in/+page.svelte
  */
 const signInPage = () => `
 <script>
@@ -105,7 +105,7 @@ export const actions = {
 `;
 /**
  * Forgot password page template
- * (rime)/forgot-password/+page.svelte
+ * (rime)/[panel=panel]/forgot-password/+page.svelte
  */
 const forgotPasswordPage = () => `
 <script>
@@ -115,7 +115,7 @@ const forgotPasswordPage = () => `
 <ForgotPassword {data} />`;
 /**
  * Forgot password page server template
- * (rime)/forgot-password/+page.server.ts
+ * (rime)/[panel=panel]/forgot-password/+page.server.ts
  */
 const forgotPasswordPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -124,7 +124,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.f
 `;
 /**
  * Reset password page template
- * (rime)/reset-password/+page.svelte
+ * (rime)/[panel=panel]/reset-password/+page.svelte
  */
 const resetPasswordPage = () => `
 <script>
@@ -135,7 +135,7 @@ const resetPasswordPage = () => `
 <ResetPassword {data} />`;
 /**
  * Reset password page server template
- * (rime)/reset-password/+page.server.ts
+ * (rime)/[panel=panel]/reset-password/+page.server.ts
  */
 const resetPasswordPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -144,7 +144,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.r
 `;
 /**
  * Panel layout template
- * (rime)/panel/+layout.svelte
+ * (rime)/[panel=panel]/+layout.svelte
  */
 const panelLayout = () => `
 <script>
@@ -164,7 +164,7 @@ const panelLayout = () => `
 </Panel>`;
 /**
  * Panel layout server template
- * (rime)/panel/+layout.server.ts
+ * (rime)/[panel=panel]/+layout.server.ts
  */
 const panelLayoutServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -175,7 +175,7 @@ export const load = async ({ locals }: ServerLoadEvent) => {
 };`;
 /**
  * Panel page template
- * (rime)/panel/+page.svelte
+ * (rime)/[panel=panel]/+page.svelte
  */
 const panelPage = () => `
 <script>
@@ -186,7 +186,7 @@ const panelPage = () => `
 <Dashboard entries={data.entries} user={data.user} />`;
 /**
  * Panel page load template
- * (rime)/panel/+page.server.ts
+ * (rime)/[panel=panel]/+page.server.ts
  */
 const panelPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -229,7 +229,7 @@ export const load = (event: ServerLoadEvent) => event.locals.routes.panel.load.l
 /****************************************************/
 /**
  * Collection list page
- * (rime)/panel/[slug=collection]/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/+page.svelte
  */
 const collectionListPage = () => `
 <script>
@@ -239,7 +239,7 @@ const collectionListPage = () => `
 
 <Collection {data} slug={data.slug} />`;
 /**
- * (rime)/panel/[slug=collection]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/+page.server.ts
  */
 const collectionListPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -250,7 +250,7 @@ export const load = async (event: ServerLoadEvent) => {
 };`;
 /**
  * Area document page
- * (rime)/panel/[slug=area]/+page.svelte
+ * (rime)/[panel=panel]/[slug=area]/+page.svelte
  */
 const areaDocPage = () => `
 <script>
@@ -260,7 +260,7 @@ const areaDocPage = () => `
 
 <Area {data} />`;
 /**
- * (rime)/panel/[slug=area]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=area]/+page.server.ts
  */
 const areaDocPageServer = () => `
 import type { RequestEvent, ServerLoadEvent } from '@sveltejs/kit';
@@ -272,7 +272,7 @@ export const actions = {
 };`;
 /**
  * Collection document page
- * (rime)/panel/[slug=collection]/[id]/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/[id]/+page.svelte
  */
 const collectionDocPage = () => `
 <script>
@@ -282,7 +282,7 @@ const collectionDocPage = () => `
 
 <CollectionDoc {data} />`;
 /**
- * (rime)/panel/[slug=collection]/[id]/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/[id]/+page.server.ts
  */
 const collectionDocPageServer = () => `
 import type { RequestEvent, ServerLoadEvent } from '@sveltejs/kit';
@@ -295,7 +295,7 @@ export const actions = {
 };`;
 /**
  * Collection document versions page
- * (rime)/panel/[slug=collection]/[id]/versions/+page.svelte
+ * (rime)/[panel=panel]/[slug=collection]/[id]/versions/+page.svelte
  */
 const collectionDocVersionsPage = () => `
 <script>
@@ -305,7 +305,7 @@ const collectionDocVersionsPage = () => `
 
 <CollectionDocVersions data={data} />`;
 /**
- * (rime)/panel/[slug=collection]/[id]/versions/+page.server.ts
+ * (rime)/[panel=panel]/[slug=collection]/[id]/versions/+page.server.ts
  */
 const collectionDocVersionsPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -314,7 +314,7 @@ export const load = (event: ServerLoadEvent) =>
   event.locals.routes.panel.load.documentVersions(event);`;
 /**
  * Area document versions page
- * (rime)/panel/[slug=area]/versions/+page.svelte
+ * (rime)/[panel=panel]/[slug=area]/versions/+page.svelte
  */
 const areaVersionsPage = () => `
 <script>
@@ -324,7 +324,7 @@ const areaVersionsPage = () => `
 
 <AreaVersionsDoc data={data} />`;
 /**
- * (rime)/panel/[slug=area]/versions/+page.server.ts
+ * (rime)/[panel=panel]/[slug=area]/versions/+page.server.ts
  */
 const areaVersionsPageServer = () => `
 import { type ServerLoadEvent } from '@sveltejs/kit';
@@ -439,45 +439,45 @@ export const commonRoutes = {
         layoutServer: rootLayoutServer,
         error: error
     },
-    '(rime)/panel/sign-in': {
+    '(rime)/[panel=panel]/sign-in': {
         'page@(rime)': signInPage,
         pageServer: signInPageServer
     },
-    '(rime)/forgot-password': {
-        page: forgotPasswordPage,
+    '(rime)/[panel=panel]/forgot-password': {
+        'page@(rime)': forgotPasswordPage,
         pageServer: forgotPasswordPageServer
     },
-    '(rime)/reset-password': {
-        page: resetPasswordPage,
+    '(rime)/[panel=panel]/reset-password': {
+        'page@(rime)': resetPasswordPage,
         pageServer: resetPasswordPageServer
     },
-    '(rime)/panel': {
+    '(rime)/[panel=panel]': {
         layout: panelLayout,
         layoutServer: panelLayoutServer,
         page: panelPage,
         pageServer: panelPageServer
     },
-    '(rime)/panel/live-edit': {
+    '(rime)/[panel=panel]/live-edit': {
         'page@(rime)': livePage,
         pageServer: livePageServer
     },
-    '(rime)/panel/[slug=collection]': {
+    '(rime)/[panel=panel]/[slug=collection]': {
         page: collectionListPage,
         pageServer: collectionListPageServer
     },
-    '(rime)/panel/[slug=collection]/[id]': {
+    '(rime)/[panel=panel]/[slug=collection]/[id]': {
         page: collectionDocPage,
         pageServer: collectionDocPageServer
     },
-    '(rime)/panel/[slug=collection]/[id]/versions': {
+    '(rime)/[panel=panel]/[slug=collection]/[id]/versions': {
         page: collectionDocVersionsPage,
         pageServer: collectionDocVersionsPageServer
     },
-    '(rime)/panel/[slug=area]': {
+    '(rime)/[panel=panel]/[slug=area]': {
         page: areaDocPage,
         pageServer: areaDocPageServer
     },
-    '(rime)/panel/[slug=area]/versions': {
+    '(rime)/[panel=panel]/[slug=area]/versions': {
         page: areaVersionsPage,
         pageServer: areaVersionsPageServer
     },

package/dist/core/dev/generate/routes/index.server.d.ts

@@ -2,11 +2,14 @@ import type { Config } from '../../../../types.js';
 /**
  * Main function to generate browser routes based on configuration.
  * commonRoutes is a fixed set of files (layout, sign-in, dashboard, the
- * matcher-disambiguated /panel/[slug=collection|area]/... and
+ * matcher-disambiguated [panel=panel]/[slug=collection|area]/... and
  * /api/[slug=collection|area]/... dynamic routes) — it no longer varies with
  * how many collections/areas are configured, so there's no per-collection/area
- * loop here anymore. The src/params/collection.ts and area.ts matchers backing
- * those routes DO bake in the actual slug list, so they're rewritten here too.
+ * loop here anymore. The folder is always the literal `[panel=panel]` segment;
+ * only src/params/panel.ts's matcher content varies with RIME_PANEL_ROUTE, so
+ * the URL itself can be hidden from admin-path scanners without ever renaming
+ * a directory. Same idea backs src/params/collection.ts and area.ts, which
+ * bake in the actual slug list — all three are rewritten here.
  */
 declare function generateRoutes<T extends Config>(config: T): void;
 export default generateRoutes;

package/dist/core/dev/generate/routes/index.server.js

@@ -1,3 +1,4 @@
+import { PANEL_ROUTE } from '../../constants.js';
 import { logger } from '../../../logger/index.server.js';
 import fs from 'fs';
 import path from 'path';
@@ -8,11 +9,14 @@ const projectRoot = process.cwd();
 /**
  * Main function to generate browser routes based on configuration.
  * commonRoutes is a fixed set of files (layout, sign-in, dashboard, the
- * matcher-disambiguated /panel/[slug=collection|area]/... and
+ * matcher-disambiguated [panel=panel]/[slug=collection|area]/... and
  * /api/[slug=collection|area]/... dynamic routes) — it no longer varies with
  * how many collections/areas are configured, so there's no per-collection/area
- * loop here anymore. The src/params/collection.ts and area.ts matchers backing
- * those routes DO bake in the actual slug list, so they're rewritten here too.
+ * loop here anymore. The folder is always the literal `[panel=panel]` segment;
+ * only src/params/panel.ts's matcher content varies with RIME_PANEL_ROUTE, so
+ * the URL itself can be hidden from admin-path scanners without ever renaming
+ * a directory. Same idea backs src/params/collection.ts and area.ts, which
+ * bake in the actual slug list — all three are rewritten here.
  */
 function generateRoutes(config) {
     logger.info('Routes generation...');
@@ -23,7 +27,7 @@ function generateRoutes(config) {
     // 2. Ensure base directories exist
     const rootRoutes = path.resolve(projectRoot, 'src', 'routes');
     const rimeRoutes = path.join(rootRoutes, '(rime)');
-    const panelRoute = path.join(rimeRoutes, 'panel');
+    const panelRoute = path.join(rimeRoutes, '[panel=panel]');
     const paramsDir = path.resolve(projectRoot, 'src', 'params');
     fs.rmSync(rimeRoutes, { recursive: true, force: true });
     ensureDir(rootRoutes);
@@ -44,8 +48,10 @@ function generateRoutes(config) {
             writeRouteFile(rootRoutes, pattern, fileType, templateFn());
         }
     }
-    // 4. Write the [slug=collection]/[slug=area] param matchers, only when needed — and remove any
-    // stale matcher left over from a previous config that did have collections/areas.
+    // 4. Write the [panel=panel] param matcher — always present, unlike collection/area — plus
+    // the [slug=collection]/[slug=area] matchers, only when needed, removing any stale matcher
+    // left over from a previous config that did have collections/areas.
+    fs.writeFileSync(path.join(paramsDir, 'panel.ts'), paramMatcher([PANEL_ROUTE]));
     const collectionMatcherPath = path.join(paramsDir, 'collection.ts');
     if (hasCollections) {
         fs.writeFileSync(collectionMatcherPath, paramMatcher((config.collections || []).map((c) => c.kebab)));
@@ -64,7 +70,7 @@ function generateRoutes(config) {
     const customRoutes = config.panel?.routes;
     if (customRoutes) {
         for (const [route, routeConfig] of Object.entries(customRoutes)) {
-            const routePath = path.join('(rime)', 'panel', route);
+            const routePath = path.join('(rime)', '[panel=panel]', route);
             writeRouteFile(rootRoutes, routePath, 'page', customRoute(routeConfig));
         }
     }

package/dist/core/dev/generate/routes/util.server.d.ts

@@ -8,10 +8,18 @@ export type Routes = Record<string, RouteDefinition>;
 /**
  * Check if routes need to be regenerated based on config changes.
  * Panel/API routes are a fixed set of dynamic-segment files (file count never
- * grows with schema size), but the [slug=collection]/[slug=area] param
- * matchers under src/params/ bake in the actual slug lists, so adding,
- * removing, or renaming a collection/area still needs a regen to keep those
- * matchers in sync — same trigger as custom routes and panel CSS.
+ * grows with schema size), but the [panel=panel]/[slug=collection]/[slug=area]
+ * param matchers under src/params/ bake in the actual accepted value(s), so
+ * changing RIME_PANEL_ROUTE or RIME_CONFIG_DIR, or adding/removing/renaming a
+ * collection/area, still needs a regen to keep those matchers in sync — same
+ * trigger as custom routes and panel CSS. Both PANEL_ROUTE and CONFIG_DIR must
+ * stay in this memo: they're read once at process start, so a changed value
+ * only takes effect after a restart, and only if the restart's regen actually
+ * notices the change. CONFIG_DIR specifically is baked into the panel/live
+ * layout's config import path (see configImportPaths() calls in
+ * common.server.ts) — leaving it out would silently keep that import stale
+ * instead of erroring, the same failure mode RIME_CONFIG_DIR hit once for
+ * hooks.server.ts (see regenerateHooks() in cli/init/templates.ts).
  * @returns true if routes should be regenerated, false otherwise
  */
 export declare function shouldRegenerateRoutes<T extends Config>(config: T): boolean;
@@ -33,10 +41,10 @@ export declare function ensureDir(dirPath: string): void;
  * @example
  * // Write a page file for a collection
  * const basePath = '/path/to/src/routes';
- * const routePath = '(rime)/panel/news';
+ * const routePath = '(rime)/[panel=panel]/news';
  * const fileType = 'page';
  * const content = '<script>\n  import { Collection } from "rime/panel"\n</script>...';
  * writeRouteFile(basePath, routePath, fileType, content);
- * // Creates /path/to/src/routes/(rime)/panel/news/+page.svelte with the provided content
+ * // Creates /path/to/src/routes/(rime)/[panel=panel]/news/+page.svelte with the provided content
  */
 export declare function writeRouteFile(basePath: string, routePath: string, fileType: string, content: string): void;

package/dist/core/dev/generate/routes/util.server.js

@@ -1,18 +1,29 @@
 import cache from '../../cache/index.server.js';
+import { CONFIG_DIR, PANEL_ROUTE } from '../../constants.js';
 import { slugify } from '../../../../util/string.js';
 import fs from 'fs';
 import path from 'path';
 /**
  * Check if routes need to be regenerated based on config changes.
  * Panel/API routes are a fixed set of dynamic-segment files (file count never
- * grows with schema size), but the [slug=collection]/[slug=area] param
- * matchers under src/params/ bake in the actual slug lists, so adding,
- * removing, or renaming a collection/area still needs a regen to keep those
- * matchers in sync — same trigger as custom routes and panel CSS.
+ * grows with schema size), but the [panel=panel]/[slug=collection]/[slug=area]
+ * param matchers under src/params/ bake in the actual accepted value(s), so
+ * changing RIME_PANEL_ROUTE or RIME_CONFIG_DIR, or adding/removing/renaming a
+ * collection/area, still needs a regen to keep those matchers in sync — same
+ * trigger as custom routes and panel CSS. Both PANEL_ROUTE and CONFIG_DIR must
+ * stay in this memo: they're read once at process start, so a changed value
+ * only takes effect after a restart, and only if the restart's regen actually
+ * notices the change. CONFIG_DIR specifically is baked into the panel/live
+ * layout's config import path (see configImportPaths() calls in
+ * common.server.ts) — leaving it out would silently keep that import stale
+ * instead of erroring, the same failure mode RIME_CONFIG_DIR hit once for
+ * hooks.server.ts (see regenerateHooks() in cli/init/templates.ts).
  * @returns true if routes should be regenerated, false otherwise
  */
 export function shouldRegenerateRoutes(config) {
     const memo = `
+    panel:${PANEL_ROUTE}
+    config:${CONFIG_DIR}
     custom:${config.panel?.routes
         ? Object.entries(config.panel.routes)
             .map(([k, v]) => `${k}-${slugify(v.component.toString())}`)
@@ -51,11 +62,11 @@ export function ensureDir(dirPath) {
  * @example
  * // Write a page file for a collection
  * const basePath = '/path/to/src/routes';
- * const routePath = '(rime)/panel/news';
+ * const routePath = '(rime)/[panel=panel]/news';
  * const fileType = 'page';
  * const content = '<script>\n  import { Collection } from "rime/panel"\n</script>...';
  * writeRouteFile(basePath, routePath, fileType, content);
- * // Creates /path/to/src/routes/(rime)/panel/news/+page.svelte with the provided content
+ * // Creates /path/to/src/routes/(rime)/[panel=panel]/news/+page.svelte with the provided content
  */
 export function writeRouteFile(basePath, routePath, fileType, content) {
     const dir = path.join(basePath, routePath);