Admin panel

Soft-delete packages without touching SQLite. Disabled rows disappear from the public catalog but stay in the DB — re-enable any time. Token is your registry's PUBLISH_TOKEN; kept in localStorage, never sent off-device.