create-volt 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to `create-volt` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.15.0] - 2026-06-28
+
+### Added
+- **`pages` add-on** — markdown pages, no database and no admin. Drop `.md`
+  files in `pages/` and each is served as HTML at `/<slug>`; front-matter
+  `title:` sets the page title. Author them in your editor or with AI. Pulls in
+  `marked` (added on enable, tracked by the dependency auto-updater); the
+  `pages/` directory is auto-created with a sample on first run. Mounted last,
+  so your own app routes always win.
+
+## [0.14.0] - 2026-06-28
+
+### Changed
+- **Adopted the most-secure admin model: ephemeral, shell-only.** Removed the
+  persistent role-gated `admin` add-on (from 0.13.0). There is now **no web
+  admin** anywhere — the data browser is the ephemeral, localhost-only
+  `--studio`, and config is `--edit`; both are shell/SSH-gated. SECURITY.md
+  updated to state this as a core property.
+
+### Added
+- Dependency auto-update: `scripts/update-deps.mjs` + a weekly GitHub Action
+  bump create-volt's pinned dependency floors to the latest **within the current
+  major** (never a breaking major). Repo-only — scaffolded apps are untouched.
+- Refreshed floors: express ^4.22.2, socket.io ^4.8.3, mongodb ^6.21.0,
+  mysql2 ^3.22.5, pg ^8.22.0, nodemailer ^6.10.1.
+
 ## [0.13.0] - 2026-06-28
 
 ### Added
@@ -187,6 +213,8 @@ All notable changes to `create-volt` are documented here. The format follows
   watching and full-page hot reload. Supports `--skip-install` and `--force`,
   and auto-detects npm / pnpm / yarn / bun for the install step.
 
+[0.15.0]: https://github.com/MIR-2025/volt/releases/tag/v0.15.0
+[0.14.0]: https://github.com/MIR-2025/volt/releases/tag/v0.14.0
 [0.13.0]: https://github.com/MIR-2025/volt/releases/tag/v0.13.0
 [0.12.0]: https://github.com/MIR-2025/volt/releases/tag/v0.12.0
 [0.11.0]: https://github.com/MIR-2025/volt/releases/tag/v0.11.0

package/README.md

@@ -82,14 +82,12 @@ MySQL / Postgres) to show data; the memory driver is per-process.
 
 ## Security & admin model
 
-Volt is secure by default, and deliberately has **no standing admin route** —
-the config wizard (`--edit`) and data browser (`--studio`) are ephemeral,
-localhost-only processes; **shell/SSH access is the auth**. Several admins? Give
-each an SSH key — stronger than a shared web panel, with nothing public to
-attack. A persistent, role-gated web admin exists only as an **opt-in** add-on
-(`admin`, gated by auth + an `ADMIN_EMAILS` allowlist) for when you truly need
-browser-only admins. Plus: escaping by default (no XSS), server-side validation
-+ caps, security headers, and `HttpOnly`+`SameSite` cookies. See
+Volt is secure by default, and deliberately has **no web admin** — nothing like
+`/wp-admin` anywhere. The config wizard (`--edit`) and data browser (`--studio`)
+are ephemeral, localhost-only processes; **shell/SSH access is the auth**.
+Several admins? Give each an SSH key — stronger than a shared web panel, with
+nothing public to attack. Plus: escaping by default (no XSS), server-side
+validation + caps, security headers, and `HttpOnly`+`SameSite` cookies. See
 [SECURITY.md](https://github.com/MIR-2025/volt/blob/main/SECURITY.md).
 
 ## Updating Volt

package/addons/pages/files/lib/pages.js

@@ -0,0 +1,79 @@
+// pages.js — markdown pages. Drop *.md files in pages/ and each is served as
+// HTML at /<slug>. No database, no admin: author them in your editor or with AI.
+// Pages are code-owned files (trusted), so their markdown HTML is served as-is.
+import fs from "node:fs";
+import path from "node:path";
+import express from "express";
+import { marked } from "marked";
+
+const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+
+const SAMPLE = `---
+title: Welcome
+---
+
+# Your Volt pages
+
+This page is a markdown file at \`pages/welcome.md\`, served at \`/welcome\`.
+
+- Drop more \`.md\` files in \`pages/\` — each becomes a page at \`/<filename>\`.
+- Add front-matter to set the title:
+
+\`\`\`
+---
+title: About us
+---
+\`\`\`
+
+Author them in your editor, or ask an AI to write them. No database, no admin.
+`;
+
+function ensure(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, "welcome.md"), SAMPLE);
+  }
+}
+
+const FM = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/;
+function parse(src) {
+  const m = src.match(FM);
+  if (!m) return { meta: {}, body: src };
+  const meta = {};
+  for (const line of m[1].split(/\r?\n/)) {
+    const i = line.indexOf(":");
+    if (i > 0) meta[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+  }
+  return { meta, body: src.slice(m[0].length) };
+}
+
+function shell(title, inner) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${esc(title)}</title>
+<style>
+:root { color-scheme: light dark }
+body { max-width: 720px; margin: 2.5rem auto; padding: 0 1.1rem; font: 17px/1.7 system-ui, -apple-system, sans-serif; }
+h1, h2, h3 { line-height: 1.25; margin: 1.6rem 0 .6rem }
+pre { background: #0b0d11; color: #cfe3ff; padding: 1rem; border-radius: 10px; overflow: auto }
+code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .9em }
+:not(pre) > code { background: rgba(127,127,127,.18); padding: .1em .35em; border-radius: 5px }
+img { max-width: 100% } a { color: #0b67d6 }
+blockquote { border-left: 3px solid #ccc; margin: 1rem 0; padding: .2rem 1rem; opacity: .8 }
+table { border-collapse: collapse } td, th { border: 1px solid #ccc; padding: .4rem .7rem }
+</style></head><body>${inner}</body></html>`;
+}
+
+export function pagesRouter({ dir }) {
+  ensure(dir);
+  const r = express.Router();
+  r.get("/:slug", (req, res, next) => {
+    const slug = req.params.slug;
+    if (!/^[a-z0-9][a-z0-9-]*$/i.test(slug)) return next(); // safe slug only — no traversal
+    const file = path.join(dir, slug + ".md");
+    if (!fs.existsSync(file)) return next();
+    const { meta, body } = parse(fs.readFileSync(file, "utf8"));
+    res.type("html").send(shell(meta.title || slug, marked.parse(body)));
+  });
+  return r;
+}

package/addons/pages/meta.json

@@ -0,0 +1,8 @@
+{
+  "description": "Markdown pages: drop .md files in pages/ and each is served as HTML at /<slug>. No database, no admin — author them in your editor or with AI.",
+  "dependsOn": [],
+  "sentinel": "lib/pages.js",
+  "install": ["marked"],
+  "optional": {},
+  "wiring": "Add markdown files to the pages/ directory (created automatically on first run). pages/about.md is served at /about; front-matter `title:` sets the page title."
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-volt",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Scaffold a new Volt app — no-build, signals-based UI with Socket.io hot reload.",
   "type": "module",
   "bin": {

package/templates/default/package.json

@@ -10,7 +10,7 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   }
 }

package/templates/default/public/app.js

@@ -86,11 +86,4 @@ if (enabled.includes("realtime")) {
     /* realtime UI unavailable */
   }
 }
-if (enabled.includes("admin")) {
-  try {
-    nodes.push((await import("/admin-ui.js")).adminPanel());
-  } catch {
-    /* admin UI unavailable */
-  }
-}
 mount("#app", ...nodes);

package/templates/default/server.js

@@ -21,8 +21,8 @@ const ENV_PATH = path.join(__dirname, ".env");
 const PKG_PATH = path.join(__dirname, "package.json");
 const ADDONS_DIR = path.join(__dirname, ".volt", "addons"); // bundled add-on sources
 const DEFAULT_PORT = 26628; // create-volt stamps this with the project's date-port
-const PKG_VERSIONS = { mongodb: "^6.8.0", mysql2: "^3.11.0", pg: "^8.12.0", nodemailer: "^6.9.0" };
-const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", admin: "admin.js" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5" };
+const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
 function readEnvFile() {
@@ -101,11 +101,6 @@ async function startApp() {
   if (enabled.has("db")) store = await (await addonMod("db")).createStore();
   if (enabled.has("mailer")) mailer = await (await addonMod("mailer")).createMailer();
   if (enabled.has("auth") && store && mailer) app.use((await addonMod("auth")).authRouter({ store, mailer }));
-  if (enabled.has("admin") && store && enabled.has("auth")) {
-    const adminEmails = String(process.env.ADMIN_EMAILS || "").split(",").map((s) => s.trim()).filter(Boolean);
-    const requireAuth = (await addonMod("auth")).requireAuth(store);
-    app.use((await addonMod("admin")).adminRouter({ store, requireAuth, adminEmails }));
-  }
 
   // expose which add-ons are on, and serve each enabled add-on's frontend assets
   app.get("/__volt/addons", (_req, res) => res.json([...enabled]));
@@ -116,6 +111,9 @@ async function startApp() {
 
   app.get("/", (_req, res) => res.sendFile(path.join(__dirname, "views", "index.html")));
 
+  // markdown pages (/<slug> ← pages/<slug>.md) — mounted last, so app routes win
+  if (enabled.has("pages")) app.use((await addonMod("pages")).pagesRouter({ dir: path.join(__dirname, "pages") }));
+
   const server = http.createServer(app);
   const io = new SocketServer(server);
   if (enabled.has("realtime") && store) (await addonMod("realtime")).attachRealtime(io, { store });
@@ -161,6 +159,7 @@ function neededPackages(env) {
   if (driver === "mysql") want.push("mysql2");
   if (driver === "postgres") want.push("pg");
   if (/^\s*SMTP_URL\s*=\s*\S/m.test(env)) want.push("nodemailer");
+  if (/^\s*VOLT_ADDONS\s*=.*\bpages\b/m.test(env)) want.push("marked");
   return want.filter((p) => !deps[p]);
 }
 

package/templates/default/setup/setup.js

@@ -17,7 +17,6 @@ const state = signal({
   dbUrl: current.DATABASE_URL || "",
   smtpUrl: current.SMTP_URL || "",
   mailFrom: current.MAIL_FROM || "",
-  adminEmails: current.ADMIN_EMAILS || "",
   port: current.PORT || String(defaultPort),
 });
 const set = (patch) => state({ ...state(), ...patch });
@@ -54,7 +53,6 @@ function genEnv(s) {
     else out.push("# SMTP_URL=        # unset → emails print to the console");
     if (s.mailFrom) out.push(`MAIL_FROM=${clean(s.mailFrom)}`);
   }
-  if (eff.includes("admin")) out.push(`ADMIN_EMAILS=${clean(s.adminEmails)}`);
   return out.join("\n") + "\n";
 }
 const env = computed(() => genEnv(state()));
@@ -150,7 +148,6 @@ mount(
     ${field("PORT", "port", String(defaultPort))}
     ${() => (eff().includes("db") ? dbSettings() : null)}
     ${() => (eff().includes("mailer") ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
-    ${() => (eff().includes("admin") ? field("ADMIN_EMAILS (comma-separated)", "adminEmails", "you@example.com") : null)}
   </div>`,
   html`<div class="card-x p-4 mb-3">
     <div class="d-flex justify-content-between align-items-center mb-2">

package/templates/guestbook/package.json

@@ -10,12 +10,12 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   },
   "optionalDependencies": {
-    "mongodb": "^6.8.0",
-    "mysql2": "^3.11.0",
-    "pg": "^8.12.0"
+    "mongodb": "^6.21.0",
+    "mysql2": "^3.22.5",
+    "pg": "^8.22.0"
   }
 }

package/templates/starter/package.json

@@ -10,7 +10,7 @@
     "dev": "node server.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
-    "socket.io": "^4.7.5"
+    "express": "^4.22.2",
+    "socket.io": "^4.8.3"
   }
 }

package/templates/starter/public/app.js

@@ -137,21 +137,10 @@ if (hasChat) {
     /* chat UI unavailable */
   }
 }
-// Admin tab appears only for users in the ADMIN_EMAILS allowlist.
-if (enabled.includes("admin")) {
-  try {
-    const r = await (await fetch("/admin/api/me")).json();
-    if (r.isAdmin) sections.admin = (await import("/admin-ui.js")).adminPanel();
-  } catch {
-    /* not signed in / not admin */
-  }
-}
-
 const TABS = [
   ["home", "Home"],
   ...(hasAuth ? [["notes", "Notes"]] : []),
   ...(sections.chat ? [["chat", "Chat"]] : []),
-  ...(sections.admin ? [["admin", "Admin"]] : []),
   ["account", "Account"],
 ];
 

package/templates/starter/server.js

@@ -22,8 +22,8 @@ const ENV_PATH = path.join(__dirname, ".env");
 const PKG_PATH = path.join(__dirname, "package.json");
 const ADDONS_DIR = path.join(__dirname, ".volt", "addons"); // bundled add-on sources
 const DEFAULT_PORT = 26628; // create-volt stamps this with the project's date-port
-const PKG_VERSIONS = { mongodb: "^6.8.0", mysql2: "^3.11.0", pg: "^8.12.0", nodemailer: "^6.9.0" };
-const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", admin: "admin.js" };
+const PKG_VERSIONS = { mongodb: "^6.21.0", mysql2: "^3.22.5", pg: "^8.22.0", nodemailer: "^6.10.1", marked: "^18.0.5" };
+const LIB_FILE = { db: "store.js", mailer: "mailer.js", auth: "auth.js", realtime: "realtime.js", pages: "pages.js" };
 
 // --- tiny .env loader (no dependency); never overrides an existing env var ---
 function readEnvFile() {
@@ -102,11 +102,6 @@ async function startApp() {
   if (enabled.has("db")) store = await (await addonMod("db")).createStore();
   if (enabled.has("mailer")) mailer = await (await addonMod("mailer")).createMailer();
   if (enabled.has("auth") && store && mailer) app.use((await addonMod("auth")).authRouter({ store, mailer }));
-  if (enabled.has("admin") && store && enabled.has("auth")) {
-    const adminEmails = String(process.env.ADMIN_EMAILS || "").split(",").map((s) => s.trim()).filter(Boolean);
-    const requireAuth = (await addonMod("auth")).requireAuth(store);
-    app.use((await addonMod("admin")).adminRouter({ store, requireAuth, adminEmails }));
-  }
 
   // notes — a per-user CRUD example (auth-gated, owner-scoped, db-backed)
   if (enabled.has("db") && enabled.has("auth") && store) {
@@ -142,6 +137,9 @@ async function startApp() {
 
   app.get("/", (_req, res) => res.sendFile(path.join(__dirname, "views", "index.html")));
 
+  // markdown pages (/<slug> ← pages/<slug>.md) — mounted last, so app routes win
+  if (enabled.has("pages")) app.use((await addonMod("pages")).pagesRouter({ dir: path.join(__dirname, "pages") }));
+
   const server = http.createServer(app);
   const io = new SocketServer(server);
   if (enabled.has("realtime") && store) (await addonMod("realtime")).attachRealtime(io, { store });
@@ -187,6 +185,7 @@ function neededPackages(env) {
   if (driver === "mysql") want.push("mysql2");
   if (driver === "postgres") want.push("pg");
   if (/^\s*SMTP_URL\s*=\s*\S/m.test(env)) want.push("nodemailer");
+  if (/^\s*VOLT_ADDONS\s*=.*\bpages\b/m.test(env)) want.push("marked");
   return want.filter((p) => !deps[p]);
 }
 

package/templates/starter/setup/setup.js

@@ -17,7 +17,6 @@ const state = signal({
   dbUrl: current.DATABASE_URL || "",
   smtpUrl: current.SMTP_URL || "",
   mailFrom: current.MAIL_FROM || "",
-  adminEmails: current.ADMIN_EMAILS || "",
   port: current.PORT || String(defaultPort),
 });
 const set = (patch) => state({ ...state(), ...patch });
@@ -54,7 +53,6 @@ function genEnv(s) {
     else out.push("# SMTP_URL=        # unset → emails print to the console");
     if (s.mailFrom) out.push(`MAIL_FROM=${clean(s.mailFrom)}`);
   }
-  if (eff.includes("admin")) out.push(`ADMIN_EMAILS=${clean(s.adminEmails)}`);
   return out.join("\n") + "\n";
 }
 const env = computed(() => genEnv(state()));
@@ -150,7 +148,6 @@ mount(
     ${field("PORT", "port", String(defaultPort))}
     ${() => (eff().includes("db") ? dbSettings() : null)}
     ${() => (eff().includes("mailer") ? html`${field("SMTP_URL (optional)", "smtpUrl", "smtp://user:pass@smtp.host:587")}${field("MAIL_FROM", "mailFrom", "App <no-reply@you.com>")}` : null)}
-    ${() => (eff().includes("admin") ? field("ADMIN_EMAILS (comma-separated)", "adminEmails", "you@example.com") : null)}
   </div>`,
   html`<div class="card-x p-4 mb-3">
     <div class="d-flex justify-content-between align-items-center mb-2">

package/addons/admin/files/lib/admin.js

@@ -1,44 +0,0 @@
-// admin.js — opt-in, role-gated web admin (data browser) for the running app.
-// This is the ONE deliberately-persistent privileged surface in Volt, for
-// browser-only admins. Every route requires a session AND membership in the
-// ADMIN_EMAILS allowlist. Internal collections (auth tokens/sessions) are hidden.
-// Prefer `npm run dev -- --studio` (ephemeral) unless you truly need this.
-
-import express from "express";
-
-const HIDDEN = new Set(["auth_tokens", "auth_sessions", "__voltcheck"]);
-const visible = (n) => n && !HIDDEN.has(n);
-
-export function adminRouter({ store, requireAuth, adminEmails }) {
-  const allow = new Set((adminEmails || []).map((e) => String(e).trim().toLowerCase()).filter(Boolean));
-  const isAdmin = (email) => allow.has(String(email || "").toLowerCase());
-
-  const r = express.Router();
-  r.use(requireAuth); // must be signed in for anything under /admin/api
-
-  // any signed-in user may ask whether *they* are an admin (drives the UI)
-  r.get("/admin/api/me", (req, res) => res.json({ email: req.user.email, isAdmin: isAdmin(req.user.email) }));
-
-  // everything below is admins-only
-  r.use((req, res, next) => (isAdmin(req.user.email) ? next() : res.status(403).json({ ok: false, error: "Admins only." })));
-
-  r.get("/admin/api/collections", async (_req, res) => {
-    const all = (await store.collections()) || [];
-    res.json({ driver: store.name, collections: all.filter(visible) });
-  });
-  r.get("/admin/api/collection", async (req, res) => {
-    const name = String(req.query.name || "");
-    if (!visible(name)) return res.status(403).json({ ok: false, error: "hidden" });
-    res.json({ ok: true, name, docs: (await store.collection(name).all()).slice(0, 500) });
-  });
-  r.delete("/admin/api/doc", async (req, res) => {
-    const name = String(req.query.name || "");
-    const id = String(req.query.id || "");
-    if (!visible(name)) return res.status(403).json({ ok: false, error: "hidden" });
-    if (!id) return res.status(400).json({ ok: false, error: "missing id" });
-    await store.collection(name).delete(id);
-    res.json({ ok: true });
-  });
-
-  return r;
-}

package/addons/admin/files/public/admin-ui.js

@@ -1,62 +0,0 @@
-// admin-ui.js — the role-gated admin panel (frontend for the admin add-on).
-// Renders nothing for non-admins; for admins, a data browser over /admin/api/*.
-// Mounted by the app when the admin add-on is enabled.
-import { signal, html } from "/volt.js";
-
-const j = async (url, opts) => {
-  const res = await fetch(url, opts);
-  return { status: res.status, body: await res.json().catch(() => ({})) };
-};
-
-export function adminPanel() {
-  const ready = signal(false);
-  const isAdmin = signal(false);
-  const driver = signal("");
-  const collections = signal([]);
-  const current = signal("");
-  const docs = signal([]);
-  const note = signal("");
-
-  async function init() {
-    const { status, body } = await j("/admin/api/me");
-    if (status === 200) isAdmin(!!body.isAdmin);
-    ready(true);
-    if (isAdmin()) load();
-  }
-  async function load() {
-    const { body } = await j("/admin/api/collections");
-    driver(body.driver || "");
-    collections(body.collections || []);
-    if (!current() && collections().length) open(collections()[0]);
-  }
-  async function open(name) {
-    current(name);
-    const { body } = await j(`/admin/api/collection?name=${encodeURIComponent(name)}`);
-    docs(body.ok ? body.docs : []);
-  }
-  async function del(id) {
-    await j(`/admin/api/doc?name=${encodeURIComponent(current())}&id=${encodeURIComponent(id)}`, { method: "DELETE" });
-    docs(docs().filter((d) => d.id !== id));
-    note("Deleted.");
-  }
-  init();
-
-  const tab = (name) =>
-    html`<button class=${() => "btn btn-sm " + (current() === name ? "btn-primary" : "btn-outline-secondary")} onclick=${() => open(name)}>${name}</button>`;
-  const row = (d) =>
-    html`<div class="d-flex justify-content-between align-items-start gap-2 py-1" style="border-top:1px solid #232a36">
-      <pre class="mb-0 small flex-grow-1" style="white-space:pre-wrap;color:#cfe3ff">${JSON.stringify(d, null, 2)}</pre>
-      <button class="btn btn-sm btn-outline-danger" onclick=${() => del(d.id)}>✕</button>
-    </div>`;
-
-  // hidden entirely for non-admins (and until we know)
-  return html`${() =>
-    !ready() || !isAdmin()
-      ? null
-      : html`<div class="card-x p-4 mb-4">
-          <h2 class="h6 mb-3">Admin <span class="text-muted small">— data ${() => (driver() ? "· " + driver() : "")}</span></h2>
-          <div class="d-flex flex-wrap gap-1 mb-2">${() => (collections().length ? collections().map(tab) : html`<span class="text-muted small">No collections yet.</span>`)}</div>
-          <div style="max-height:260px;overflow:auto">${() => (docs().length ? docs().map(row) : html`<span class="text-muted small">Empty.</span>`)}</div>
-          ${() => (note() ? html`<p class="small text-muted mb-0 mt-2">${note}</p>` : null)}
-        </div>`}`;
-}

package/addons/admin/meta.json

@@ -1,8 +0,0 @@
-{
-  "description": "Opt-in role-gated web admin: a persistent /admin data browser for browser-only admins (auth + ADMIN_EMAILS allowlist). Adds a standing surface — prefer `--studio` unless you need non-shell admins.",
-  "dependsOn": ["db", "auth"],
-  "sentinel": "lib/admin.js",
-  "install": ["express"],
-  "optional": {},
-  "wiring": "Set ADMIN_EMAILS in .env to a comma-separated allowlist of admin emails. Only those signed-in users see the admin panel and can reach /admin/api/*."
-}