@forumone/create-throughline 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @forumone/create-throughline
 
+## 0.4.0
+
+### Minor Changes
+
+- 8b7d698: A scaffolded project ships a two-tier CI workflow:
+
+  - `fast` runs on every pull request with no database. It installs from the lockfile, then runs typecheck, lint, the workspace and migration gates, manifest validation, a generated-files check and tests, with a non-blocking audit.
+  - `verify` runs on pushes to main. It migrates a fresh Postgres and runs a production build.
+
+  `check-generated.sh` regenerates `payload-types.ts` and the admin import map and fails on any difference, including an uncommitted file. `apps/web` gains `generate:types` and `generate:importmap`.
+
+- 8b7d698: A scaffolded project manages its schema through migrations from the first table on:
+
+  - **Config.** `payload.config.ts` sets `push: false` and an explicit `migrationDir`. It connects through a resolver that knows the Vercel–Neon integration's variables, keeps a migration off Neon's pooled endpoint, and accepts an optional migration-only credential.
+  - **Scripts.** `apps/web` gains `migrate`, `migrate:create`, `migrate:status`, `migrate:snapshot` and `check:migrations`. The check asserts that every migration has its schema snapshot, that no snapshot is orphaned, and that no drop follows a `CASCADE` that has already carried it out.
+  - **Write guard.** `scripts/lib/target.ts` gives scripts that write to a database a `requireTarget` guard.
+
+- 8b7d698: A scaffolded project ships three workspace gates as root scripts:
+
+  - `check:instances`: `payload`, `@payloadcms/ui`, `react` and `react-dom` each resolve to exactly one copy
+  - `check:tested`: every package that ships code has at least one test
+  - `check:audit`: production advisories are checked against an allowlist that carries a reason for each entry and fails when an entry goes stale
+
+### Patch Changes
+
+- e9077b3: The reference design system's manifest build and validation, which every scaffolded project vendors, now:
+
+  - refuse a component directory with no contract, instead of silently leaving it out of the manifest
+  - read the directories that hold components from a `CONTRACT_LAYERS` list
+  - name the manifest from the project's own `package.json`, instead of claiming to be `@forumone/throughline-reference-ds`
+  - treat `antiExamples.empty` and `intent.brevity` as errors
+
+- 6800052: The scaffold compiles against the current Throughline releases, and serves its tools over MCP:
+
+  - `payload.config.ts` no longer imports `createApiKeysCollection`, which core removed.
+  - One `createMcpToolCollector()` is passed to every tool-bearing plugin, and `@payloadcms/plugin-mcp` is registered after them, with its key collection narrowed to admins.
+  - The Inngest route types the integration registry, so `serve()` can type its function list.
+  - `@payloadcms/plugin-form-builder` is a caret range like the rest of `@payloadcms/*`, so it no longer installs a second `@payloadcms/ui`.
+  - `.env.example` and the printed next steps drop the per-server MCP keys that no longer exist.
+
 ## 0.3.1
 
 ### Patch Changes

package/dist/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAa,MAAM,kBAAkB,CAAA;AAK5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC7F;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;;;;;;GASG;AACH,iBAAe,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF;AAiBD,iBAAS,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3C;AAUD,iBAAS,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AA6BD,eAAO,MAAM,SAAS;;;;;;;CAAsE,CAAA"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAa,MAAM,kBAAkB,CAAA;AAK5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC7F;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;;;;;;GASG;AACH,iBAAe,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF;AAiBD,iBAAS,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3C;AAcD,iBAAS,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AA6BD,eAAO,MAAM,SAAS;;;;;;;CAAsE,CAAA"}

package/dist/generator.js

@@ -117,9 +117,13 @@ function isBinary(filename) {
 /**
  * npm strips files literally named `.gitignore` from a published tarball, so
  * we author them as `gitignore` in templates and restore the dot on output.
+ * `.github` goes the same way: a dot-directory in a tarball is at the mercy of
+ * whichever ignore rules the publishing npm applies, and the scaffold's CI is
+ * not something to lose silently.
  */
 const DOTFILE_RENAMES = {
     gitignore: '.gitignore',
+    github: '.github',
 };
 function applyDotfileRename(name) {
     return DOTFILE_RENAMES[name] ?? name;

package/dist/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAW7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,UAA2B,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;QAC3C,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,gBAAgB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,gBAAgB,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAwC,CAAA;IAEhG,UAAU,CAAC,4BAA4B,CAAC,CAAA;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAA;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrF,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,UAAU,CAAC,kBAAkB,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,UAAU,CAAC,kDAAkD,CAAC,CAAA;QAC9D,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAc;IACjE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAE7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAE7B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAA;QACd,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAA;AAEF,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,SAAS,EAAE,YAAY;CACxB,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,CACd,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC1D,GAAG,CACJ,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAA;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAW7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,UAA2B,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;QAC3C,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,gBAAgB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,gBAAgB,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAwC,CAAA;IAEhG,UAAU,CAAC,4BAA4B,CAAC,CAAA;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAA;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrF,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,UAAU,CAAC,kBAAkB,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,UAAU,CAAC,kDAAkD,CAAC,CAAA;QAC9D,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAc;IACjE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAE7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAE7B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAA;QACd,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAA;AAEF,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAA2B;IAC9C,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,SAAS;CAClB,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,CACd,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC1D,GAAG,CACJ,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAA;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA"}

package/dist/post-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-install.d.ts","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkFrD"}
+{"version":3,"file":"post-install.d.ts","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwFrD"}

package/dist/post-install.js

@@ -28,11 +28,18 @@ export function printNextSteps(answers) {
     lines.push(`       ${pc.dim('openssl rand -base64 48  # PAYLOAD_SECRET')}`);
     lines.push(`       ${pc.dim('openssl rand -base64 48  # APPROVAL_TOKEN_SECRET')}`);
     lines.push(`       ${pc.dim('openssl rand -base64 48  # FORMS_IP_HASH_SECRET')}`);
+    // `push: false`: the schema exists only once a migration has created it.
+    lines.push(formatStep(step++, 'Create and apply the first migration:'));
+    lines.push(`       ${pc.dim('pnpm --dir apps/web migrate:create initial')}`);
+    lines.push(`       ${pc.dim('pnpm --dir apps/web migrate')}`);
+    // Committed and checked by CI, so the first push is green only with them.
+    lines.push(formatStep(step++, 'Generate the Payload types and import map, and commit them:'));
+    lines.push(`       ${pc.dim('pnpm --dir apps/web generate:types')}`);
+    lines.push(`       ${pc.dim('pnpm --dir apps/web generate:importmap')}`);
     lines.push(formatStep(step++, `${pc.bold('pnpm dev')} to run locally`));
     lines.push(formatStep(step++, 'Open http://localhost:3000/admin and create your first admin user'));
-    lines.push(formatStep(step++, 'In the admin, go to API Keys and create one key per MCP server'));
-    lines.push(formatStep(step++, 'Paste those keys into .env.local'));
-    lines.push(formatStep(step, 'Wire Claude (or your MCP client) to your MCP endpoints — see the generated README.md'));
+    lines.push(formatStep(step++, 'In the admin, create one key under MCP → Payload MCP API Keys'));
+    lines.push(formatStep(step, 'Give that key to Claude (or your MCP client) for /api/mcp — see the generated README.md'));
     // eslint-disable-next-line no-console
     console.log();
     // eslint-disable-next-line no-console

package/dist/post-install.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-install.js","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAA;IAE7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CACjF,CACF,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAA;IACvG,CAAC;SAAM,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAA;IAClH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,EAAE,CAAC,CAAA;IACjH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAA;IAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAA;IAC3E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAA;IAClF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAA;IAEjF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,mEAAmE,CACpE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,gEAAgE,CACjE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAC,CAAA;IAClE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EACJ,sFAAsF,CACvF,CACF,CAAA;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;IACnC,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG;QACrB,8DAA8D;QAC9D,qEAAqE;QACrE,oDAAoD;KACrD,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,IAAY;IACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"post-install.js","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAA;IAE7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CACjF,CACF,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAA;IACvG,CAAC;SAAM,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAA;IAClH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,EAAE,CAAC,CAAA;IACjH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAA;IAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAA;IAC3E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAA;IAClF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAA;IAEjF,yEAAyE;IACzE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,4CAA4C,CAAC,EAAE,CAAC,CAAA;IAC5E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAE7D,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,6DAA6D,CAAC,CAAC,CAAA;IAC7F,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;IACpE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAA;IAExE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,mEAAmE,CACpE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,IAAI,EAAE,EAAE,+DAA+D,CAAC,CACpF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EACJ,yFAAyF,CAC1F,CACF,CAAA;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;IACnC,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG;QACrB,8DAA8D;QAC9D,qEAAqE;QACrE,oDAAoD;KACrD,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,IAAY;IACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;AACxC,CAAC"}

package/dist/templates/base/.env.example

@@ -1,5 +1,9 @@
 # --- Required ---
 DATABASE_URI=postgres://user:pass@host/dbname
+# Optional: a schema-owner credential used only by `pnpm migrate`, so the app
+# itself can run as a role that reads and writes rows and no more. See
+# apps/web/src/lib/database.ts.
+# MIGRATION_DATABASE_URL=
 PAYLOAD_SECRET=generate-with-openssl-rand-base64-48
 NEXT_PUBLIC_SERVER_URL=http://localhost:3000
 
@@ -23,19 +27,11 @@ APPROVAL_TOKEN_SECRET=
 # Generate: openssl rand -base64 48
 FORMS_IP_HASH_SECRET=
 
-# --- MCP server keys ---
-# Each key is generated in the Payload admin (API Keys collection) after
-# first deploy and pasted back here for local dev.
-COMPONENT_SERVER_API_KEY=
-PUBLISHING_SERVER_API_KEY=
-APPROVALS_SERVER_API_KEY=
-AUDIT_SERVER_API_KEY=
-FORMS_SERVER_API_KEY=
-INTEGRATIONS_SERVER_API_KEY=
-
-# System API key used by scheduled workflows that talk back to the
-# Publishing MCP server (executes scheduled publishes).
-PUBLISHING_SYSTEM_API_KEY=
+# --- MCP ---
+# No keys here. Every Throughline tool is served on one /api/mcp by
+# @payloadcms/plugin-mcp; create a key in the admin under MCP -> Payload MCP
+# API Keys and give it to your MCP client, not to this file. Scheduled
+# publishes run in process and need no key either.
 
 # --- Optional: storage ---
 # Vercel Blob token if deploying to Vercel; remove this and the storage

package/dist/templates/base/README.md

@@ -32,10 +32,20 @@ openssl rand -base64 48
 #    - RESEND_API_KEY               — from Resend dashboard
 #    - INNGEST_EVENT_KEY/SIGNING    — from Inngest (optional in local dev)
 
-# 5. Start the dev server
+# 5. Create and apply the first migration. The config sets `push: false`, so
+#    migrations are the only way the schema changes, from the first table on.
+pnpm --dir apps/web migrate:create initial
+pnpm --dir apps/web migrate
+
+# 6. Generate the Payload types and admin import map, and commit both along
+#    with the migration. CI fails until they match the config.
+pnpm --dir apps/web generate:types
+pnpm --dir apps/web generate:importmap
+
+# 7. Start the dev server
 pnpm dev
 
-# 6. Visit http://localhost:3000/admin and create your first user.
+# 8. Visit http://localhost:3000/admin and create your first user.
 ```
 
 ## After admin signup
@@ -66,6 +76,49 @@ pnpm dev
 - `pnpm lint` — ESLint
 - `pnpm test` — run all package tests
 
+## Migrations
+
+The schema changes only through `apps/web/src/migrations` — `push` is off, in
+development too. From `apps/web`:
+
+- `pnpm migrate:create <name>` — generate a migration from the config. It diffs against the `.json` snapshot beside the newest migration, not against the database, and needs no database.
+- `pnpm migrate` — apply pending migrations. Connects through `MIGRATION_DATABASE_URL` when it is set.
+- `pnpm migrate:status` — what has been applied.
+- `pnpm migrate:snapshot` — after **hand-writing** a migration, write its snapshot, or the generator falls a step behind and re-proposes changes that already shipped.
+- `pnpm check:migrations` — every migration has a snapshot, no snapshot is orphaned, and no drop follows a `CASCADE` that already carried it out. Also runs from the root.
+
+Scripts that write to a database can call `requireTarget` from `apps/web/scripts/lib/target.ts`, which prints the database, host and variable it is about to write through, and demands `--confirm` before overwriting anything.
+
+## Generated files
+
+`apps/web/src/payload-types.ts` and `apps/web/src/app/(payload)/admin/importMap.js`
+are generated from `payload.config.ts` and **committed**. Regenerate both after
+any change to the config, a collection or a plugin version, and commit the
+result — CI regenerates them and fails on a difference:
+
+```bash
+pnpm --dir apps/web generate:types
+pnpm --dir apps/web generate:importmap
+```
+
+A stale import map is a 500 on any admin screen that renders a component the
+map has never heard of.
+
+## CI
+
+`.github/workflows/ci.yml` runs two tiers. `fast` runs on every pull request
+and needs no database: install from the lockfile, typecheck, lint, the gates
+below, manifest validation, the generated-files check and tests. `verify` runs
+on pushes to main: it migrates a fresh Postgres and runs a production build.
+
+## Workspace gates
+
+Each is explained at the top of its script in `scripts/`:
+
+- `pnpm check:instances` — `payload`, `@payloadcms/ui`, `react` and `react-dom` each resolve to exactly one copy. Two byte-identical copies are two React contexts, and a runtime failure nothing else can see.
+- `pnpm check:tested` — every workspace package that ships code has at least one test. Not a coverage number. `apps/web` starts on its exception list; delete the entry with your first test.
+- `pnpm check:audit` — high and critical production advisories against an allowlist that carries a reason for each entry, and that fails when an entry stops applying.
+
 ## Project layout
 
 ```

package/dist/templates/base/apps/web/package.json.template

@@ -9,7 +9,14 @@
     "start": "next start",
     "clean": "rm -rf .next .turbo",
     "typecheck": "tsc --noEmit",
-    "payload": "payload"
+    "payload": "payload",
+    "generate:types": "payload generate:types",
+    "generate:importmap": "payload generate:importmap",
+    "migrate": "PAYLOAD_MIGRATING=1 payload migrate",
+    "migrate:create": "payload migrate:create",
+    "migrate:status": "payload migrate:status",
+    "migrate:snapshot": "tsx scripts/write-migration-snapshot.ts",
+    "check:migrations": "tsx scripts/check-migrations.ts"
   },
   "dependencies": {
     "@forumone/throughline-approvals": "^{{version_approvals}}",
@@ -25,7 +32,8 @@
     "{{designSystemName}}": "workspace:*",
     {{/if}}"@payloadcms/db-postgres": "^3.83.0",
     "@payloadcms/next": "^3.83.0",
-    "@payloadcms/plugin-form-builder": "3.83.0",
+    "@payloadcms/plugin-form-builder": "^3.83.0",
+    "@payloadcms/plugin-mcp": "^3.83.0",
     "@payloadcms/richtext-lexical": "^3.83.0",
     "graphql": "^16.8.1",
     "inngest": "^4.2.0",
@@ -38,6 +46,7 @@
     "@types/node": "^20.17.0",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
+    "tsx": "^4.21.0",
     "typescript": "^5.6.0"
   }
 }

package/dist/templates/base/apps/web/scripts/check-migrations.ts

@@ -0,0 +1,147 @@
+import { readdir, readFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/*
+Three checks on `src/migrations`, each about a failure nobody sees until the
+moment it has to work.
+
+    pnpm check:migrations
+
+With `push: false` a migration is the only way this schema ever changes, so the
+migration chain has to stay usable.
+
+## 1. A migration with no schema snapshot
+
+`migrate:create` does not diff the config against the database. It diffs it
+against the `.json` snapshot beside the **most recent** migration, and writes one
+only when it generated the SQL itself. So a migration written by hand leaves the
+generator a step behind, and every run after it re-proposes a change that
+already shipped — often as drizzle's interactive rename prompt, which cannot be
+answered non-interactively, so the command exits having written nothing.
+
+Every migration is checked, not only the newest: a gap in the middle is inert
+today and was a blocked generator on the day it merged, which is the day this
+needs to fail. Write one with `pnpm migrate:snapshot`.
+
+## 2. An orphaned snapshot
+
+A `.json` with no `.ts` beside it. Delete a migration and leave its snapshot,
+and that snapshot sorts last and becomes what the generator diffs against — a
+schema no database will ever be in.
+
+## 3. A drop that a CASCADE has already carried out
+
+Payload's generator can emit, in this order:
+
+    DROP TABLE "posts" CASCADE;
+    ALTER TABLE "search_rels" DROP CONSTRAINT "search_rels_posts_fk";
+
+The CASCADE already removed that constraint, so the second statement errors,
+and because a migration runs in a transaction it takes the whole migration — or
+the whole rollback — with it. What is flagged is a bare `DROP CONSTRAINT` or
+`DROP INDEX` that follows a cascading `DROP` in the same function. A bare drop
+with no CASCADE above it is dropping something that is still there, and
+demanding `IF EXISTS` of it would be the kind of blanket rule people learn to
+suppress.
+*/
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const MIGRATIONS = path.resolve(here, '../src/migrations')
+
+const BARE_DROP = /\bDROP\s+(CONSTRAINT|INDEX)\s+"/gi
+
+// A `DROP` that cascaded, kept inside one statement by `[^;]*`. Not the word
+// on its own, which also matches the `ON DELETE cascade` of every foreign key.
+const CASCADE = /\bDROP\b[^;]*\bCASCADE\b/i
+
+const stem = (name: string) => name.replace(/\.(json|ts)$/, '')
+
+const entries = await readdir(MIGRATIONS).catch((error: NodeJS.ErrnoException) => {
+  if (error.code === 'ENOENT') return [] as string[]
+  throw error
+})
+
+const files = entries.filter((name) => name.endsWith('.ts') && name !== 'index.ts').sort()
+
+if (files.length === 0) {
+  console.log('No migrations yet. Create the first with:\n\n' + '    pnpm migrate:create initial\n')
+  process.exit(0)
+}
+
+// Basenames on both sides, because that is what `createMigration` sorts: it
+// reads the directory, keeps the `.json`, sorts, and takes the last.
+const snapshots = new Set(entries.filter((name) => name.endsWith('.json')).map(stem))
+
+const missing = files.filter((file) => !snapshots.has(stem(file)))
+
+if (missing.length > 0) {
+  console.error(
+    `${missing.length} migration(s) with no schema snapshot:\n\n` +
+      missing.map((file) => `  ${file}\n  ${stem(file)}.json   <- missing`).join('\n\n') +
+      '\n\nmigrate:create diffs the config against the snapshot beside the most\n' +
+      'recent migration. Without one it diffs against a schema that is a step\n' +
+      'behind, and re-proposes a change that has already shipped. Write it with:\n\n' +
+      '    pnpm migrate:snapshot\n\n' +
+      'Run it only once the migration is complete: the snapshot claims the\n' +
+      'database matches the config.\n',
+  )
+  process.exit(1)
+}
+
+const migrationNames = new Set(files.map(stem))
+const orphans = [...snapshots].filter((name) => !migrationNames.has(name)).sort()
+
+if (orphans.length > 0) {
+  console.error(
+    `${orphans.length} schema snapshot(s) with no migration beside them:\n\n` +
+      orphans.map((name) => `  ${name}.json`).join('\n') +
+      '\n\nA snapshot sorting last is what migrate:create diffs against, so one\n' +
+      'left behind by a deleted migration describes a schema no database will\n' +
+      'reach. Delete it, or restore the migration it belongs to.\n',
+  )
+  process.exit(1)
+}
+
+const problems: Array<{ file: string; statement: string }> = []
+
+for (const file of files) {
+  const source = await readFile(path.join(MIGRATIONS, file), 'utf8')
+
+  for (const name of ['up', 'down'] as const) {
+    const start = source.indexOf(`export async function ${name}`)
+    if (start === -1) continue
+    const other = source.indexOf('export async function', start + 1)
+    const body = source.slice(start, other === -1 ? undefined : other)
+
+    for (const match of body.matchAll(BARE_DROP)) {
+      const at = match.index ?? 0
+      if (!CASCADE.test(body.slice(0, at))) continue
+
+      const absolute = start + at
+      const lineStart = source.lastIndexOf('\n', absolute) + 1
+      const lineEnd = source.indexOf('\n', absolute)
+      problems.push({
+        file,
+        statement: source.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim(),
+      })
+    }
+  }
+}
+
+if (problems.length > 0) {
+  console.error(
+    `${problems.length} drop(s) after a CASCADE without IF EXISTS:\n\n` +
+      problems.map((p) => `  ${p.file}\n    ${p.statement}`).join('\n\n') +
+      '\n\nA preceding DROP ... CASCADE has already removed these, so the\n' +
+      'migration will abort. Add IF EXISTS:\n\n' +
+      '    DROP CONSTRAINT IF EXISTS "..."\n' +
+      '    DROP INDEX IF EXISTS "..."\n',
+  )
+  process.exit(1)
+}
+
+console.log(
+  `Checked ${files.length} migration(s): every drop is guarded, every migration has\n` +
+    `its schema snapshot, and the generator will diff against ${stem(files.at(-1)!)}.`,
+)

package/dist/templates/base/apps/web/scripts/lib/target.ts

@@ -0,0 +1,95 @@
+import { resolveDatabaseConnection } from '../../src/lib/database'
+
+/*
+Which database a script is about to write to, and an explicit confirmation of
+it. For seed, import and repair scripts:
+
+    const where = requireTarget(process.argv, overwriting, 'Replaces every page')
+
+A script reads its connection string from the environment like everything else,
+so a shell that happens to have production's connection string loaded points it
+at production and nothing asks. This prints the target before anything is
+written, and demands `--confirm <database>@<host>` when the run would overwrite.
+
+It is not authentication — anyone who can run the script can type the token. It
+is the difference between a mistake and a decision, and the print alone is worth
+it: a run aimed at the wrong host is visible before it writes rather than after.
+
+Sized to the risk: creating what is missing is recoverable by deleting it;
+replacing what an editor has worked on is not.
+*/
+
+export interface Target {
+  host: string
+  database: string
+  /** The environment variable the connection string came from, or `(none)`. */
+  source: string
+}
+
+/**
+ * The database the config will actually connect to — through the same resolver
+ * `payload.config.ts` uses, not by reading `DATABASE_URI` directly. A guard that
+ * reports a different database than the code connects to is not a weaker guard;
+ * it is a false one.
+ */
+export function target(): Target {
+  let connection = ''
+  let source = '(none)'
+  try {
+    const resolved = resolveDatabaseConnection()
+    connection = resolved.value
+    source = resolved.name
+  } catch {
+    // Nothing set at all: a target of "none", which every destructive run refuses.
+  }
+
+  try {
+    const parsed = new URL(connection)
+    return { host: parsed.hostname, database: parsed.pathname.replace(/^\//, ''), source }
+  } catch {
+    return { host: '(unparseable)', database: '', source }
+  }
+}
+
+/*
+The token that has to be typed back. Not the database name on its own: Neon
+names every branch's database `neondb`, so `--confirm neondb` would match
+production and a preview alike. The host distinguishes them, so the host is in
+the token — long enough that it cannot be typed from memory while thinking about
+a different environment.
+*/
+export const confirmToken = (where: Target): string => `${where.database}@${where.host}`
+
+/**
+ * Print the target, and exit unless a destructive run has named it back.
+ *
+ * @param argv        The script's arguments, for `--confirm <database>@<host>`.
+ * @param destructive Whether this run would overwrite existing documents.
+ * @param consequence One line naming what would be overwritten, shown in the refusal.
+ */
+export function requireTarget(argv: string[], destructive: boolean, consequence: string): Target {
+  const where = target()
+  console.log(
+    `\n  target   ${where.database || '(none)'} on ${where.host}\n  from     ${where.source}`,
+  )
+
+  if (!destructive) return where
+
+  const index = argv.indexOf('--confirm')
+  const confirmed = index === -1 ? undefined : argv[index + 1]
+  const expected = confirmToken(where)
+
+  if (where.database === '' || confirmed !== expected) {
+    console.error(
+      `\n  Refusing to write.\n\n` +
+        `  ${consequence}\n` +
+        `  in the database "${where.database}" on ${where.host},\n` +
+        `  read from ${where.source}.\n\n` +
+        `  Re-run with --confirm ${where.database ? expected : '<database>@<host>'}\n` +
+        `  if that is what you meant.\n`,
+    )
+    process.exit(2)
+  }
+
+  return where
+}

package/dist/templates/base/apps/web/scripts/write-migration-snapshot.ts

@@ -0,0 +1,119 @@
+import { readdir, readFile, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import { getPayload } from 'payload'
+import config from '@payload-config'
+
+/*
+Writes the `.json` schema snapshot beside a hand-written migration.
+
+    pnpm migrate:snapshot                 # the newest migration
+    pnpm migrate:snapshot 20260812_154500_add_jobs
+    pnpm migrate:snapshot --force         # replace an existing snapshot
+
+`migrate:create` diffs the config against the snapshot beside the **most
+recent** migration, and writes a fresh one only when it generates the SQL
+itself. A migration written by hand therefore leaves the generator one step
+behind, and every run after it re-proposes a change that already shipped.
+
+This closes the gap the way `createMigration` does, minus the diff: it asks the
+adapter for the schema the config describes and serialises it. The adapter
+builds that schema from the config alone, so this needs **no database**.
+
+## When it would be a lie
+
+The snapshot says: *the database, once this migration has run, matches the
+config.* Run it only after the hand-written migration is complete. A snapshot
+claiming a config change the migration only half implements makes the next
+generated migration quietly omit the missing half.
+
+Overwriting needs `--force`, because the common mistake is running this instead
+of writing the migration: the snapshot is rewritten to match a config that moved
+on, and the change becomes invisible to the generator — the schema drifts with
+no migration anywhere that would apply it.
+
+The config is loaded, so the environment it validates must be present. Values
+that only need to parse — secrets, keys — can be placeholders on this run.
+*/
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const MIGRATIONS = path.resolve(here, '../src/migrations')
+
+// `pnpm run x -- --flag` forwards the `--` itself, which `parseArgs` would read
+// as "positionals from here".
+const argv = process.argv.slice(2).filter((arg) => arg !== '--')
+
+const { positionals, values } = parseArgs({
+  args: argv,
+  allowPositionals: true,
+  options: { force: { type: 'boolean', default: false } },
+})
+
+const migrations = (await readdir(MIGRATIONS).catch(() => [] as string[]))
+  .filter((name) => name.endsWith('.ts') && name !== 'index.ts')
+  .map((name) => name.slice(0, -'.ts'.length))
+  .sort()
+
+if (migrations.length === 0) {
+  console.error(`No migrations in ${MIGRATIONS}.`)
+  process.exit(1)
+}
+
+const target = positionals[0]?.replace(/\.(json|ts)$/, '') ?? migrations.at(-1)!
+
+if (!migrations.includes(target)) {
+  console.error(
+    `No migration named ${target}.\n\nMigrations in src/migrations:\n` +
+      migrations.map((name) => `  ${name}`).join('\n') +
+      '\n',
+  )
+  process.exit(1)
+}
+
+const destination = path.join(MIGRATIONS, `${target}.json`)
+const existing = await readFile(destination, 'utf8').then(
+  () => true,
+  () => false,
+)
+
+if (existing && !values.force) {
+  console.error(
+    `${target}.json already exists, and describes the schema as of that migration.\n` +
+      'Rewriting it to match a config that has since changed hides the change from\n' +
+      '`migrate:create`. If replacing it is genuinely what you want, pass --force.\n',
+  )
+  process.exit(1)
+}
+
+if (target !== migrations.at(-1)) {
+  console.warn(
+    `Warning: ${target} is not the newest migration. Only the newest snapshot is\n` +
+      'read by migrate:create, so this describes a state nothing will diff against.\n',
+  )
+}
+
+// No database, and nothing that runs on startup (seeds, syncs, cron
+// registration) from a script whose whole job is to serialise a schema.
+const payload = await getPayload({ config, disableDBConnect: true, disableOnInit: true })
+
+const db = payload.db as typeof payload.db & {
+  requireDrizzleKit: () => { generateDrizzleJson: (schema: unknown) => Promise<unknown> }
+  schema: unknown
+}
+
+const { generateDrizzleJson } = db.requireDrizzleKit()
+const snapshot = await generateDrizzleJson(db.schema)
+
+// Byte for byte what `createMigration` writes, with no trailing newline, so a
+// hand-written migration's snapshot is indistinguishable from a generated one.
+await writeFile(destination, JSON.stringify(snapshot, null, 2))
+
+console.log(
+  `Wrote src/migrations/${target}.json\n\n` +
+    'Commit it beside the migration. Confirm the generator is unblocked with:\n\n' +
+    '    pnpm migrate:create check --skip-empty\n\n' +
+    'which exits without writing anything when there is no diff.\n',
+)
+
+process.exit(0)