create-volt 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,69 @@
+# Changelog
+
+All notable changes to `create-volt` are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/), and this project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [0.5.0] - 2026-06-28
+
+### Added
+- Multiple starter templates via `--template <name>`. The default stays the
+  Counter + Todos demo; `--template guestbook` scaffolds a full real-world app:
+  magic-link auth, Socket.io real-time, and pluggable **MongoDB / MySQL /
+  Postgres** storage (with an in-memory dev fallback so it runs with no setup).
+
+### Changed
+- Templates now live under `templates/<name>/` (was a single `template/`).
+- The "files created" summary is derived from the chosen template.
+
+## [0.4.0] - 2026-06-28
+
+### Added
+- `create-volt update` command: refresh `public/volt.js` in an existing app to
+  the library version bundled with create-volt. Run `npx create-volt@latest
+  update` inside an app. Only touches the library file — never your `app.js`,
+  `server.js`, or chosen port. Supports `--dry-run` to check without writing.
+
+## [0.3.2] - 2026-06-28
+
+### Changed
+- Scaffolded apps' `README.md` now has a **Dev port** section explaining the
+  date-derived port and how to override it (`PORT` env / `--port`).
+- Package README shows `--port` directly in the Usage block.
+
+## [0.3.1] - 2026-06-28
+
+### Changed
+- Internal: releases now publish from GitHub Actions via npm **Trusted
+  Publishing** (OIDC, with provenance) — no functional changes to scaffolded apps.
+
+## [0.3.0] - 2026-06-28
+
+### Added
+- `--port <number>` flag to set the new app's dev port.
+- The dev port now **defaults to the creation date** (two-digit year + month +
+  two-digit day, e.g. `2026-06-28` → `26628`), so apps scaffolded on different
+  days don't collide. The chosen port is stamped into the generated `server.js`.
+
+## [0.2.0] - 2026-06-28
+
+### Added
+- Git auto-init: scaffolded apps start as a git repository with an initial
+  commit (`--no-git` to skip).
+- `--dry-run` flag: preview the files and actions without writing anything.
+
+## [0.1.0] - 2026-06-28
+
+### Added
+- Initial release. Scaffolds a no-build, signals-based Volt app: the `volt.js`
+  library, a Counter + Todos demo, an Express + Socket.io dev server with file
+  watching and full-page hot reload. Supports `--skip-install` and `--force`,
+  and auto-detects npm / pnpm / yarn / bun for the install step.
+
+[0.5.0]: https://github.com/MIR-2025/volt/releases/tag/v0.5.0
+[0.4.0]: https://github.com/MIR-2025/volt/releases/tag/v0.4.0
+[0.3.2]: https://github.com/MIR-2025/volt/releases/tag/v0.3.2
+[0.3.1]: https://github.com/MIR-2025/volt/releases/tag/v0.3.1
+[0.3.0]: https://github.com/MIR-2025/volt/releases/tag/v0.3.0
+[0.2.0]: https://github.com/MIR-2025/volt/releases/tag/v0.2.0
+[0.1.0]: https://github.com/MIR-2025/volt/releases/tag/v0.1.0

package/README.md

@@ -14,8 +14,23 @@ npx create-volt my-app
 pnpm create volt my-app
 yarn create volt my-app
 bun create volt my-app
+
+# choose the dev port (default: derived from today's date)
+npm create volt@latest my-app -- --port 26630
+
+# pick a starter template
+npm create volt@latest my-app -- --template guestbook
 ```
 
+## Templates
+
+Pick one with `--template` (default: `default`):
+
+| Template    | What you get                                                          |
+| ----------- | -------------------------------------------------------------------- |
+| `default`   | The Counter + Todos demo on the Volt signal engine. Minimal.        |
+| `guestbook` | A real app: magic-link auth, Socket.io real-time message board, and pluggable **MongoDB / MySQL / Postgres** storage (in-memory by default, so it runs with zero setup). |
+
 Then:
 
 ```bash
@@ -25,6 +40,19 @@ npm run dev        # → http://localhost:26628
 
 Edit `public/app.js` and save — the page hot-reloads itself.
 
+## Updating Volt
+
+Volt is vendored as a single file (`public/volt.js`), not an npm dependency.
+To pull the latest library into an existing app, run from its directory:
+
+```bash
+npx create-volt@latest update         # refresh public/volt.js
+npx create-volt@latest update --dry-run   # just check if an update is available
+```
+
+It only rewrites `public/volt.js` — your `app.js`, `server.js`, and dev port are
+left untouched. Review the change with `git diff public/volt.js`.
+
 ## Options
 
 | Flag              | Effect                                                  |

package/index.js

@@ -34,9 +34,11 @@ ${bold("⚡ create-volt")} — scaffold a new Volt app
 ${bold("Usage")}
   npm create volt@latest <project-directory> [options]
   npx create-volt <project-directory> [options]
+  npx create-volt@latest update              # refresh public/volt.js in an existing app
 
 ${bold("Options")}
-  --port <number>  Dev port for the app (default: derived from today's date)
+  --template <name>  Starter template: default | guestbook  (default: default)
+  --port <number>    Dev port for the app (default: derived from today's date)
   --skip-install   Don't run the package manager install step
   --no-git         Don't initialize a git repository
   --dry-run        Show what would be created without writing anything
@@ -54,10 +56,13 @@ const argv = process.argv.slice(2);
 const flags = new Set();
 const positionals = [];
 let portArg = null;
+let templateArg = null;
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
   if (a === "--port") portArg = argv[++i];
   else if (a.startsWith("--port=")) portArg = a.slice("--port=".length);
+  else if (a === "--template") templateArg = argv[++i];
+  else if (a.startsWith("--template=")) templateArg = a.slice("--template=".length);
   else if (a.startsWith("-")) flags.add(a);
   else positionals.push(a);
 }
@@ -76,6 +81,32 @@ const force = flags.has("--force");
 const dryRun = flags.has("--dry-run");
 const noGit = flags.has("--no-git");
 
+// --- `update` subcommand: refresh public/volt.js in the current app to the
+// version bundled with this create-volt (so `npx create-volt@latest update`
+// pulls the latest library). Only touches the library file — never the user's
+// app.js, server.js, or port. ---
+if (positionals[0] === "update") {
+  const target = path.join(process.cwd(), "public", "volt.js");
+  if (!fs.existsSync(target)) {
+    die(`No ${cyan("public/volt.js")} here — run ${cyan("create-volt update")} from inside a Volt app.`);
+  }
+  const latest = fs.readFileSync(path.join(__dirname, "templates", "default", "public", "volt.js"), "utf8");
+  const current = fs.readFileSync(target, "utf8");
+  if (current === latest) {
+    console.log(`\n${green("✔")} ${bold("public/volt.js")} is already current (create-volt ${pkg.version}).\n`);
+    process.exit(0);
+  }
+  if (dryRun) {
+    console.log(`\n${yellow("!")} An update is available for ${bold("public/volt.js")} (create-volt ${pkg.version}).`);
+    console.log(`  Re-run without ${cyan("--dry-run")} to apply.\n`);
+    process.exit(0);
+  }
+  fs.writeFileSync(target, latest);
+  console.log(`\n${green("✔")} Updated ${bold("public/volt.js")} to the version in create-volt ${pkg.version}.`);
+  console.log(`  Review the change with ${cyan("git diff public/volt.js")}.\n`);
+  process.exit(0);
+}
+
 // Resolve the dev port: --port wins, else derive it from today's date as
 // two-digit-year + month (no leading zero) + two-digit-day (house convention),
 // so apps scaffolded on different days don't collide on the same port.
@@ -112,7 +143,19 @@ if (!/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(path.basena
 
 const targetDir = path.resolve(process.cwd(), projectName);
 const appName = path.basename(targetDir);
-const templateDir = path.join(__dirname, "template");
+
+// Resolve the starter template (default | guestbook | …).
+const templatesDir = path.join(__dirname, "templates");
+const templateName = templateArg || "default";
+const templateDir = path.join(templatesDir, templateName);
+if (!fs.existsSync(templateDir) || !fs.statSync(templateDir).isDirectory()) {
+  const available = fs
+    .readdirSync(templatesDir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .join(", ");
+  die(`Unknown template "${templateName}". Available: ${available}.`);
+}
 
 // List every file in the template, relative to its root (for dry-run preview).
 function listTemplateFiles(dir, base = dir) {
@@ -135,7 +178,7 @@ if (fs.existsSync(targetDir)) {
 
 // --- dry run: print the plan and exit without writing anything ---
 if (dryRun) {
-  console.log(`\n${bold("⚡ Dry run")} — would create a Volt app in ${cyan(targetDir)}\n`);
+  console.log(`\n${bold("⚡ Dry run")} — would create a ${cyan(templateName)} Volt app in ${cyan(targetDir)}\n`);
   console.log("Would write:");
   for (const f of listTemplateFiles(templateDir).sort()) {
     // the shipped "gitignore" is renamed to ".gitignore" on scaffold
@@ -180,14 +223,10 @@ if (fs.existsSync(appReadme)) {
   fs.writeFileSync(appReadme, fs.readFileSync(appReadme, "utf8").replace(/localhost:\d+/g, `localhost:${port}`));
 }
 
-const created = [
-  "public/volt.js   — the Volt library (no build step)",
-  "public/app.js    — your app (Counter + Todos demo)",
-  "views/index.html — the HTML shell",
-  "server.js        — dev server with hot reload",
-];
-console.log(green("✔") + " Files created:");
-for (const line of created) console.log("  " + dim(line));
+console.log(green("✔") + ` Created a ${cyan(templateName)} app — files:`);
+for (const f of listTemplateFiles(templateDir).sort()) {
+  console.log("  " + dim(f === "gitignore" ? ".gitignore" : f));
+}
 console.log("");
 
 // --- detect the package manager that invoked us (npm / pnpm / yarn / bun) ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-volt",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Scaffold a new Volt app — no-build, signals-based UI with Socket.io hot reload.",
   "type": "module",
   "bin": {
@@ -8,7 +8,8 @@
   },
   "files": [
     "index.js",
-    "template"
+    "templates",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=16.7.0"

package/{template → templates/default}/README.md

@@ -4,6 +4,8 @@ A tiny, **no-build**, signals-based UI app with **Socket.io hot reload**.
 Not React: no JSX, no virtual DOM, no re-render-the-world. State lives in
 *signals*; only the exact text/attribute that changed updates.
 
+📖 **[How to build a Volt app →](https://github.com/MIR-2025/volt#readme)**
+
 ## Run
 
 ```bash
@@ -14,6 +16,33 @@ npm run dev        # → http://localhost:26628   (PORT env to override)
 Edit anything in `public/` or `views/` and save — the dev server pushes a
 reload over Socket.io and the page refreshes itself.
 
+## Dev port
+
+This app's dev port is set in `server.js` (chosen when the project was
+scaffolded). Override it at launch with the `PORT` env var:
+
+```bash
+PORT=4000 npm run dev
+```
+
+Scaffolding more apps? `create-volt` defaults each one's port to its creation
+date and takes `--port <number>` to avoid collisions on the same day:
+
+```bash
+npm create volt@latest api-app -- --port 26630
+```
+
+## Updating Volt
+
+`public/volt.js` is a vendored file, not an npm dependency. Pull the latest
+library version with:
+
+```bash
+npx create-volt@latest update
+```
+
+This rewrites only `public/volt.js` — your app code and port stay as-is.
+
 ## Project layout
 
 ```

package/{template → templates/default}/views/index.html

@@ -30,6 +30,9 @@
 
     <footer class="text-center text-muted mt-5">
       <small>Both cards run on the same signal engine — one uses <code>el()</code>, the other <code>html``</code>.</small>
+      <div class="mt-2">
+        <small><a href="https://github.com/MIR-2025/volt#readme" target="_blank" rel="noopener">📖 How to build a Volt app →</a></small>
+      </div>
     </footer>
   </main>
 

package/templates/guestbook/README.md

@@ -0,0 +1,71 @@
+# 📖 Guestbook — a real Volt app
+
+A live message board built with [Volt](https://github.com/MIR-2025/volt):
+fine-grained signals on the frontend, **Socket.io** for real-time updates,
+**magic-link** sign-in (no passwords), and **pluggable storage** —
+in-memory by default, or MongoDB / MySQL / Postgres for persistence.
+
+## Run
+
+```bash
+npm install        # if you scaffolded with --skip-install
+npm run dev        # → http://localhost:26629
+```
+
+Out of the box it uses an **in-memory store** and prints magic-link emails to
+the **server console** — so you can try the whole flow with zero setup:
+
+1. Enter your email, click **Send magic link**.
+2. Copy the link printed in the terminal, open it.
+3. Click **Confirm login** (must be the same browser).
+4. Post a message — open a second tab to watch it appear live.
+
+## Storage backends
+
+Pick a backend with `DB_DRIVER` (default `memory`). Real drivers are lazy-loaded,
+so install only the one you use.
+
+```bash
+# MongoDB
+DB_DRIVER=mongodb MONGODB_URI="mongodb://user:<password>@host:27017/guestbook?authSource=admin" \
+  MONGODB_DATABASE=guestbook npm start
+
+# MySQL  (npm install mysql2)
+DB_DRIVER=mysql DATABASE_URL="mysql://user:<password>@host:3306/guestbook" npm start
+
+# Postgres  (npm install pg)
+DB_DRIVER=postgres DATABASE_URL="postgres://user:<password>@host:5432/guestbook" npm start
+```
+
+Tables/collections are created automatically on first run. Never hard-code the
+credential — keep it in your environment / `.env`.
+
+## Email (magic links)
+
+In dev, links are printed to the console. For real email, set `SMTP_URL` (and
+`MAIL_FROM`) and `npm install nodemailer`:
+
+```bash
+SMTP_URL="smtp://user:pass@smtp.example.com:587" MAIL_FROM="Guestbook <no-reply@you.com>" npm start
+```
+
+## Layout
+
+```
+server.js          Express + Socket.io + storage/mailer wiring
+router.js          routes; composes views with a header include
+lib/store.js       backend selector (memory | mongodb | mysql | postgres)
+lib/stores/        the adapters (same interface each)
+lib/auth.js        magic-link tokens + sessions
+lib/mailer.js      console (dev) or SMTP (prod)
+public/volt.js     the Volt library (no build step)
+public/app.js      the frontend — signals + Socket.io
+views/             index, confirm page, header partial
+```
+
+## Production
+
+Runs anywhere Node does. Under PM2: `pm2 start server.js --name guestbook`.
+Set `PORT`, `DB_DRIVER`, the connection string, and `SMTP_URL` in the environment.
+
+Scaffolded with [`create-volt`](https://www.npmjs.com/package/create-volt) — `--template guestbook`.

package/templates/guestbook/gitignore

@@ -0,0 +1,5 @@
+node_modules
+npm-debug.log*
+.DS_Store
+.env
+*.local

package/templates/guestbook/lib/auth.js

@@ -0,0 +1,63 @@
+// auth.js — magic-link login (no passwords), per the house auth convention:
+//   1. user submits email → we store a one-time token + the requesting UA,
+//      and email a link containing the token
+//   2. opening the link shows a confirm page (must be the same browser/UA)
+//   3. clicking "Confirm" consumes the token and starts a session cookie
+//
+// Tokens expire after TOKEN_TTL and are single-use. Sessions are random ids
+// kept in the store and carried in an httpOnly cookie.
+
+import crypto from "node:crypto";
+
+const TOKEN_TTL = 15 * 60 * 1000; // 15 minutes
+const SESSION_TTL = 30 * 24 * 60 * 60 * 1000; // 30 days
+export const SESSION_COOKIE = "gb_sid";
+
+const token = () => crypto.randomBytes(32).toString("hex");
+const normalizeEmail = (e) => String(e || "").trim().toLowerCase();
+const validEmail = (e) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
+
+// Step 1: create + email a magic link. Returns { ok } or throws on bad input.
+export async function requestLogin(store, mailer, { email, ua, baseUrl }) {
+  const addr = normalizeEmail(email);
+  if (!validEmail(addr)) throw new Error("Please enter a valid email address.");
+  const tok = token();
+  await store.putToken({ token: tok, email: addr, ua: ua || "", expiresAt: Date.now() + TOKEN_TTL });
+  const link = `${baseUrl}/verify?token=${tok}`;
+  await mailer.sendMagicLink(addr, link);
+  return { ok: true };
+}
+
+// Step 3: confirm a token → start a session. Returns { sessionId, email }.
+export async function confirmLogin(store, { token: tok, ua }) {
+  const rec = await store.getToken(tok);
+  if (!rec) throw new Error("This login link is invalid.");
+  if (rec.used) throw new Error("This login link was already used.");
+  if (rec.expiresAt < Date.now()) throw new Error("This login link has expired.");
+  if (rec.ua && ua && rec.ua !== ua) throw new Error("Open the link in the same browser you requested it from.");
+
+  await store.useToken(tok);
+  const sessionId = token();
+  await store.putSession({ id: sessionId, email: rec.email, expiresAt: Date.now() + SESSION_TTL });
+  return { sessionId, email: rec.email };
+}
+
+// Parse a cookie header into a plain object.
+export function parseCookies(header = "") {
+  const out = {};
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i === -1) continue;
+    out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
+  }
+  return out;
+}
+
+// Resolve the current session from a request, or null.
+export async function sessionFromReq(store, req) {
+  const sid = parseCookies(req.headers.cookie)[SESSION_COOKIE];
+  if (!sid) return null;
+  return await store.getSession(sid);
+}
+
+export const cookieMaxAgeSeconds = SESSION_TTL / 1000;

package/templates/guestbook/lib/mailer.js

@@ -0,0 +1,39 @@
+// mailer.js — sends the magic-link email. In dev (no SMTP configured) it just
+// prints the link to the console so you can copy it; in production it uses
+// nodemailer if SMTP_URL is set and the package is installed.
+
+export async function createMailer() {
+  const smtp = process.env.SMTP_URL;
+  const from = process.env.MAIL_FROM || "Guestbook <no-reply@example.com>";
+
+  if (smtp) {
+    let nodemailer;
+    try {
+      nodemailer = (await import("nodemailer")).default;
+    } catch {
+      console.warn("[mailer] SMTP_URL set but 'nodemailer' isn't installed — falling back to console. Run: npm install nodemailer");
+    }
+    if (nodemailer) {
+      const transport = nodemailer.createTransport(smtp);
+      return {
+        name: "smtp",
+        async sendMagicLink(email, link) {
+          await transport.sendMail({
+            to: email,
+            from,
+            subject: "Your guestbook login link",
+            text: `Click to sign in: ${link}\n\nThis link expires shortly and can only be used once.`,
+            html: `<p>Click to sign in:</p><p><a href="${link}">${link}</a></p><p>This link expires shortly and can only be used once.</p>`,
+          });
+        },
+      };
+    }
+  }
+
+  return {
+    name: "console",
+    async sendMagicLink(email, link) {
+      console.log(`\n📨  Magic link for ${email}:\n    ${link}\n    (dev mode — paste this into your browser)\n`);
+    },
+  };
+}

package/templates/guestbook/lib/store.js

@@ -0,0 +1,43 @@
+// store.js — pick a storage backend from the environment. Defaults to the
+// in-memory store so the app runs with zero setup; point DB_DRIVER at a real
+// database (mongodb | mysql | postgres) for persistence.
+//
+//   DB_DRIVER=memory                       (default)
+//   DB_DRIVER=mongodb  MONGODB_URI=...  [MONGODB_DATABASE=...]
+//   DB_DRIVER=mysql    DATABASE_URL=mysql://user:pass@host:3306/db
+//   DB_DRIVER=postgres DATABASE_URL=postgres://user:pass@host:5432/db
+
+import { createMemoryStore } from "./stores/memory.js";
+import { createMongoStore } from "./stores/mongo.js";
+import { createSqlStore } from "./stores/sql.js";
+
+export async function createStore() {
+  const driver = (process.env.DB_DRIVER || "memory").toLowerCase();
+
+  let store;
+  switch (driver) {
+    case "memory":
+      store = createMemoryStore();
+      break;
+    case "mongodb":
+    case "mongo":
+      store = await createMongoStore({
+        uri: process.env.MONGODB_URI,
+        dbName: process.env.MONGODB_DATABASE,
+      });
+      break;
+    case "mysql":
+      store = await createSqlStore({ dialect: "mysql", uri: process.env.DATABASE_URL });
+      break;
+    case "postgres":
+    case "postgresql":
+    case "pg":
+      store = await createSqlStore({ dialect: "postgres", uri: process.env.DATABASE_URL });
+      break;
+    default:
+      throw new Error(`Unknown DB_DRIVER "${driver}" (use memory | mongodb | mysql | postgres)`);
+  }
+
+  await store.init();
+  return store;
+}

package/templates/guestbook/lib/stores/memory.js

@@ -0,0 +1,49 @@
+// memory.js — in-memory store. The zero-dependency dev fallback so the app
+// runs out of the box; data is lost on restart. Same interface as the real
+// MongoDB / MySQL / Postgres adapters.
+
+export function createMemoryStore() {
+  const tokens = new Map(); // token -> { token, email, ua, expiresAt, used }
+  const sessions = new Map(); // id -> { id, email, expiresAt }
+  const messages = []; // { id, email, body, createdAt }
+
+  return {
+    name: "memory",
+    async init() {},
+
+    async putToken(t) {
+      tokens.set(t.token, { ...t, used: false });
+    },
+    async getToken(token) {
+      return tokens.get(token) || null;
+    },
+    async useToken(token) {
+      const t = tokens.get(token);
+      if (t) t.used = true;
+    },
+
+    async putSession(s) {
+      sessions.set(s.id, s);
+    },
+    async getSession(id) {
+      const s = sessions.get(id);
+      if (!s) return null;
+      if (s.expiresAt < Date.now()) {
+        sessions.delete(id);
+        return null;
+      }
+      return s;
+    },
+    async delSession(id) {
+      sessions.delete(id);
+    },
+
+    async addMessage(m) {
+      messages.push(m);
+      return m;
+    },
+    async listMessages(limit = 100) {
+      return messages.slice(-limit);
+    },
+  };
+}

package/templates/guestbook/lib/stores/mongo.js

@@ -0,0 +1,68 @@
+// mongo.js — MongoDB adapter. Lazy-loads the `mongodb` driver so the app only
+// needs it when DB_DRIVER=mongodb. Connection string per instructions.md:
+//   MONGODB_URI=mongodb://user:<password>@host:port/{dbname}?authSource=admin...
+
+export async function createMongoStore({ uri, dbName }) {
+  let MongoClient;
+  try {
+    ({ MongoClient } = await import("mongodb"));
+  } catch {
+    throw new Error("DB_DRIVER=mongodb but the 'mongodb' package isn't installed. Run: npm install mongodb");
+  }
+  if (!uri) throw new Error("DB_DRIVER=mongodb requires MONGODB_URI");
+
+  const client = new MongoClient(uri);
+  await client.connect();
+  const db = client.db(dbName || undefined);
+  const tokens = db.collection("login_tokens");
+  const sessions = db.collection("sessions");
+  const messages = db.collection("messages");
+
+  return {
+    name: "mongodb",
+    async init() {
+      await tokens.createIndex({ token: 1 }, { unique: true });
+      await sessions.createIndex({ id: 1 }, { unique: true });
+      await messages.createIndex({ createdAt: 1 });
+    },
+
+    async putToken(t) {
+      await tokens.insertOne({ ...t, used: false });
+    },
+    async getToken(token) {
+      return await tokens.findOne({ token }, { projection: { _id: 0 } });
+    },
+    async useToken(token) {
+      await tokens.updateOne({ token }, { $set: { used: true } });
+    },
+
+    async putSession(s) {
+      await sessions.insertOne(s);
+    },
+    async getSession(id) {
+      const s = await sessions.findOne({ id }, { projection: { _id: 0 } });
+      if (!s) return null;
+      if (s.expiresAt < Date.now()) {
+        await sessions.deleteOne({ id });
+        return null;
+      }
+      return s;
+    },
+    async delSession(id) {
+      await sessions.deleteOne({ id });
+    },
+
+    async addMessage(m) {
+      await messages.insertOne({ ...m });
+      return m;
+    },
+    async listMessages(limit = 100) {
+      const rows = await messages
+        .find({}, { projection: { _id: 0 } })
+        .sort({ createdAt: 1 })
+        .limit(limit)
+        .toArray();
+      return rows;
+    },
+  };
+}