@forumone/create-throughline 0.3.1 → 0.4.0

package/dist/templates/base/apps/web/src/app/api/inngest/route.ts.template

@@ -1,3 +1,4 @@
+import type { InngestFunction } from 'inngest'
 import { serve } from 'inngest/next'
 import { getPayload } from 'payload'
 import config from '@/payload.config'
@@ -42,7 +43,13 @@ async function publishScheduled({ collection, id, reasoning }: ScheduledPublishR
 
 const scheduledCollections = [{ slug: 'pages' }]
 
-const integrationRegistry = getIntegrationRegistry(payload)
+/*
+Typed with this app's own `InngestFunction.Any`. The registry is generic in what
+`createFunctions` returns and defaults to `unknown`, because the platform never
+touches those functions — and one `unknown` element leaves `serve()` unable to
+type the whole array below.
+*/
+const integrationRegistry = getIntegrationRegistry<InngestFunction.Any>(payload)
 const integrationContext = getIntegrationContext(payload)
 const integrationFunctions =
   integrationRegistry && integrationContext

package/dist/templates/base/apps/web/src/lib/database.ts

@@ -0,0 +1,158 @@
+/*
+Which connection string to connect with, and the name of the variable it came
+from.
+
+Three things make this more than `process.env.DATABASE_URI!`.
+
+**The Vercel–Neon integration does not set `DATABASE_URI`.** It injects
+`DATABASE_URL`, `DATABASE_URL_UNPOOLED`, `POSTGRES_URL`,
+`POSTGRES_URL_NON_POOLING` and friends. Left alone, the first deploy fails at
+page-data collection with a connection error that says nothing about a missing
+variable.
+
+**The app wants the pooler and a migration cannot use it.** Neon's pooled
+endpoint is PgBouncer in transaction mode: right for a serving function, whose
+connections are many and short, and unusable for DDL, where Drizzle relies on
+prepared statements and session state. `migrate` hangs or fails partway. The two
+hostnames differ only by a `-pooler` suffix on the endpoint id.
+
+**`DATABASE_URI` leads both lists, deliberately.** It is the variable you scope
+per environment — a Preview-scoped `DATABASE_URI` pointing at a preview branch —
+while the integration's variables are project-wide and resolve to production. A
+preview build that fell through to one of those while migrating would migrate
+production.
+
+If you deploy somewhere other than Vercel + Neon, set `DATABASE_URI` and the
+rest of the list is never consulted.
+*/
+const RUNTIME_CANDIDATES = [
+  'DATABASE_URI',
+  // Neon via the Vercel integration, pooled. Correct for a serving instance.
+  'DATABASE_URL',
+  'POSTGRES_URL',
+  // Direct, as a fallback: a project with no pooler still boots.
+  'DATABASE_URL_UNPOOLED',
+  'POSTGRES_URL_NON_POOLING',
+] as const
+
+/*
+The DDL path: an optional migration-only credential first, then direct endpoints
+ahead of pooled ones. The pooled pair is kept at the end rather than dropped, so
+a migration whose only reachable string is pooled meets the explanation in
+`describeProblem` instead of "no connection string".
+
+`MIGRATION_DATABASE_URL` lets the app run as a role that can read and write rows
+and no more, while migrations run as the schema owner. It is consulted only by
+the process that migrates — see `isMigrationProcess` — because a platform with
+no build-only variables would otherwise hand the DDL role straight back to the
+running app.
+*/
+const MIGRATION_CANDIDATES = [
+  'MIGRATION_DATABASE_URL',
+  'DATABASE_URI',
+  'DATABASE_URL_UNPOOLED',
+  'POSTGRES_URL_NON_POOLING',
+  'DATABASE_URL',
+  'POSTGRES_URL',
+] as const
+
+/**
+ * Whether this process is `payload migrate` rather than a server or a build.
+ *
+ * `PAYLOAD_MIGRATING=1` is set by the `migrate` script in package.json and by
+ * nothing else. `NEXT_RUNTIME` is defined in every server bundle Next emits, so
+ * no route or page can satisfy both conditions even if the first were set.
+ */
+export function isMigrationProcess(): boolean {
+  return process.env.PAYLOAD_MIGRATING === '1' && !process.env.NEXT_RUNTIME
+}
+
+let announced = false
+
+/*
+One line in the deploy log saying which variable a migration connected through.
+Without it, a migration that quietly fell through to the app's credential looks
+exactly like one that worked. The name, never the value: a build log is not a
+secret store.
+*/
+function announceMigrationCredential(name: string): void {
+  if (announced) return
+  announced = true
+  process.stderr.write(`payload migrate: connecting via ${name}\n`)
+}
+
+/*
+What is wrong with a connection string, in words, before Postgres says
+"password authentication failed" and leaves you guessing. A string wrapped in
+quotes or prefixed with `psql` fails as `getaddrinfo ENOTFOUND`; a masked or
+truncated password fails as an auth error. The checks below catch the shapes
+that can be seen without connecting. Nothing here ever prints the value.
+*/
+function describeProblem(name: string, value: string, migrating: boolean): string | undefined {
+  const raw = value.trim()
+
+  if (/^psql\s/i.test(raw)) {
+    return `${name} starts with "psql". Copy the connection string itself, not the command that uses it.`
+  }
+  if (/^["']|["']$/.test(raw)) {
+    return `${name} is wrapped in quotes. Most hosts store the value literally — paste it without them.`
+  }
+  if (!/^postgres(ql)?:\/\//i.test(raw)) {
+    return `${name} does not start with postgres:// or postgresql://.`
+  }
+
+  let url: URL
+  try {
+    url = new URL(raw)
+  } catch {
+    return `${name} is not a valid URL.`
+  }
+
+  if (!url.password) {
+    return `${name} has no password. Neon's console masks it until you reveal or copy it.`
+  }
+  if (/^[•*·]+$/.test(decodeURIComponent(url.password))) {
+    return `${name}'s password is a row of bullets — it was copied while the console still had it masked.`
+  }
+  if (migrating && url.hostname.includes('-pooler')) {
+    return (
+      `${name} points at Neon's pooled endpoint. Migrations need the direct one: PgBouncer in ` +
+      `transaction mode does not support the prepared statements Drizzle's DDL relies on. Use ` +
+      `the host without "-pooler".`
+    )
+  }
+
+  return undefined
+}
+
+/**
+ * The connection string, and the name of the variable it came from.
+ *
+ * The name matters: `DATABASE_URI` leads both lists, so one left in a shell or a
+ * pulled `.env` file wins without saying so, and every Neon branch's database is
+ * called `neondb` — the host and database name alone may not tell you which
+ * environment you are about to write to. See `scripts/lib/target.ts`.
+ */
+export function resolveDatabaseConnection(): { name: string; value: string } {
+  const migrating = isMigrationProcess()
+  const candidates: readonly string[] = migrating ? MIGRATION_CANDIDATES : RUNTIME_CANDIDATES
+
+  for (const name of candidates) {
+    const value = process.env[name]
+    if (value && value.trim() !== '') {
+      const problem = describeProblem(name, value, migrating)
+      if (problem) throw new Error(problem)
+      if (migrating) announceMigrationCredential(name)
+      return { name, value: value.trim() }
+    }
+  }
+
+  throw new Error(
+    `No database connection string. Set DATABASE_URI, or connect a Neon database in Vercel — ` +
+      `the integration provides ${candidates.slice(1).join(', ')}, and every one was empty.`,
+  )
+}
+
+export function databaseConnectionString(): string {
+  return resolveDatabaseConnection().value
+}

package/dist/templates/base/apps/web/src/payload.config.ts.template

@@ -1,14 +1,15 @@
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { buildConfig } from 'payload'
-import type { CollectionConfig } from 'payload'
+import type { Access, CollectionConfig } from 'payload'
 import { postgresAdapter } from '@payloadcms/db-postgres'
 import { lexicalEditor } from '@payloadcms/richtext-lexical'
 import {
   auditPlugin,
-  createApiKeysCollection,
   createInngestClient,
+  createMcpToolCollector,
 } from '@forumone/throughline-core'
+import { mcpPlugin } from '@payloadcms/plugin-mcp'
 import { componentsPlugin } from '@forumone/throughline-components'
 import { publishingPlugin } from '@forumone/throughline-publishing'
 import {
@@ -20,6 +21,7 @@ import { auditQueryPlugin } from '@forumone/throughline-audit'
 import { integrationsPlugin } from '@forumone/throughline-integrations'
 import { emailPlugin } from '@forumone/throughline-email'
 import { formsPlugin } from '@forumone/throughline-forms'
+import { databaseConnectionString } from './lib/database'
 {{#if useReferenceDs}}import type { Manifest } from '@forumone/throughline-design-contract'
 import designSystemManifest from '{{designSystemName}}/manifest' with { type: 'json' }
 {{/if}}
@@ -29,6 +31,23 @@ const __dirname = path.dirname(__filename)
 
 const inngest = createInngestClient({ id: '{{projectName}}' })
 
+/*
+Where every Throughline server puts its tools for `mcpPlugin`, which serves them
+all on one `/api/mcp`. Each plugin declares its tools as the config is built and
+binds the handlers at `onInit`; `mcpPlugin` reads this array at both moments.
+Hand over `mcpTools.tools` itself — a spread or `.slice()` would hand over
+something nobody fills.
+*/
+const mcpTools = createMcpToolCollector()
+
+// A person in `users` with the admin role. `req.user` can also be an MCP key
+// document, which has no roles and is never an admin, so the collection is
+// checked first — once payload-types.ts exists, TypeScript insists on it.
+const isAdmin: Access = ({ req: { user } }) =>
+  user?.collection === 'users' &&
+  Array.isArray(user.roles) &&
+  (user.roles as unknown[]).includes('admin')
+
 // Users collection — extend with your own fields and SSO/auth provider.
 const Users: CollectionConfig = {
   slug: 'users',
@@ -93,16 +112,30 @@ export default buildConfig({
   admin: { user: 'users' },
   editor: lexicalEditor(),
   db: postgresAdapter({
-    pool: { connectionString: process.env.DATABASE_URI! },
+    // See lib/database.ts: which variable wins, and why a migration refuses
+    // Neon's pooled endpoint.
+    pool: { connectionString: databaseConnectionString() },
+    migrationDir: path.resolve(__dirname, 'migrations'),
+    // Never push schema: migrations are the only way this database changes.
+    // The adapter pushes whenever NODE_ENV !== 'production', which is true of
+    // every script and dev server. One pointed at a shared database silently
+    // syncs its schema and records a `dev` migration, and the next
+    // `payload migrate` in CI then stops to ask about it — with no terminal to
+    // answer — and skips the migration it was meant to apply.
+    push: false,
   }),
-  collections: [Users, Pages, createApiKeysCollection()],
+  // MCP keys live in `payload-mcp-api-keys`, which `mcpPlugin` below brings.
+  collections: [Users, Pages],
   secret: process.env.PAYLOAD_SECRET!,
   typescript: {
     outputFile: path.resolve(__dirname, 'payload-types.ts'),
   },
   plugins: [
-    // Order matters: audit first (so other plugins can write to it),
-    // then content plugins, then notification/forms/integrations.
+    // Order matters twice. `auditPlugin` first: every other Throughline plugin
+    // requires the audit log at init. And every tool-bearing plugin before
+    // `mcpPlugin`, which reads the declared tools when the config is built — a
+    // plugin registered after it gets no per-key checkbox, and its tools are
+    // denied to every key with no error anywhere.
     auditPlugin({ inngest }),
 
     componentsPlugin({
@@ -110,6 +143,7 @@ export default buildConfig({
       {{else}}// TODO: point at your design system manifest
       manifest: { type: 'url', url: 'https://your-design-system.example.com/manifest.json' },
       {{/if}}matching: { strategy: 'tfidf' },
+      mcpTools,
     }),
 
     publishingPlugin({
@@ -119,6 +153,7 @@ export default buildConfig({
       approvalResolver: {
         getActiveApproval: async () => null, // TODO: wire to approvals plugin
       },
+      mcpTools,
     }),
 
     approvalsPlugin({
@@ -135,9 +170,10 @@ export default buildConfig({
           return []
         },
       },
+      mcpTools,
     }),
 
-    auditQueryPlugin({}),
+    auditQueryPlugin({ mcpTools }),
 
     emailPlugin({
       inngest,
@@ -162,18 +198,39 @@ export default buildConfig({
     formsPlugin({
       inngest,
       ipHashSecret: process.env.FORMS_IP_HASH_SECRET!,
-      // TODO: list every place a form is allowed to send to. The plugin
-      // refuses to deliver to destinations that aren't in this list.
+      // TODO: list every place a form is allowed to send to, and delete the
+      // placeholder. The plugin refuses to start with an empty list — the
+      // allowlist is the security perimeter — and refuses to deliver anywhere
+      // not on it. example.com is reserved and accepts no mail, so the
+      // placeholder routes nothing anywhere while it stands.
       allowedDestinations: [
-        // {
-        //   type: 'email',
-        //   value: 'team@example.com',
-        //   label: 'Main inbox',
-        //   description: 'General contact form destination',
-        // },
+        {
+          type: 'email',
+          value: 'forms@example.com',
+          label: 'Placeholder',
+          description: 'Replace before launch: example.com accepts no mail.',
+        },
       ],
+      mcpTools,
     }),
 
-    integrationsPlugin({ inngest }),
+    integrationsPlugin({ inngest, mcpTools }),
+
+    // Last of the tool-bearing chain. An MCP key is a credential: the plugin
+    // ships its collection with no access rules — "anybody signed in" — so it
+    // is narrowed to admins here.
+    mcpPlugin({
+      mcp: { tools: mcpTools.tools },
+      overrideApiKeyCollection: (collection) => ({
+        ...collection,
+        access: {
+          ...collection.access,
+          read: isAdmin,
+          create: isAdmin,
+          update: isAdmin,
+          delete: isAdmin,
+        },
+      }),
+    }),
   ],
 })

package/dist/templates/base/github/scripts/check-generated.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+#
+# payload-types.ts and importMap.js are committed but generated from
+# payload.config.ts. Regenerating and diffing is what stops them drifting from
+# the config:
+#
+#   - a stale importMap.js is a 500 on any admin screen that renders a component
+#     the map has never heard of — a plugin upgrade that swaps in a custom
+#     Publish button is enough
+#   - stale types make everything downstream compile against a schema that no
+#     longer exists
+#
+# Run from the repository root, with the environment payload.config.ts demands.
+# **No database is needed** — the config parses a connection string and never
+# reaches it — which is what lets this run on every pull request.
+
+set -euo pipefail
+
+TYPES='apps/web/src/payload-types.ts'
+MAP='apps/web/src/app/(payload)/admin/importMap.js'
+
+# `git status --porcelain` rather than `git diff`: a file that was never
+# committed is untracked, and `git diff` says nothing about it.
+pnpm --dir apps/web run generate:types
+if [ -n "$(git status --porcelain -- "$TYPES")" ]; then
+  git --no-pager diff -- "$TYPES" || true
+  echo "::error::payload-types.ts is stale or uncommitted — run 'pnpm --dir apps/web generate:types' and commit it."
+  exit 1
+fi
+
+# importMap.js is compared as a *set* of lines. Payload emits plugin entries in
+# an order that differs between macOS and Linux, so a byte comparison fails on a
+# file whose content is identical. Order does not matter to correctness; a
+# missing entry does, and that is what this catches.
+sort "$MAP" > "${RUNNER_TEMP:-/tmp}/importmap-committed"
+pnpm --dir apps/web run generate:importmap
+sort "$MAP" > "${RUNNER_TEMP:-/tmp}/importmap-regenerated"
+
+if ! diff -u "${RUNNER_TEMP:-/tmp}/importmap-committed" "${RUNNER_TEMP:-/tmp}/importmap-regenerated"; then
+  echo "::error::importMap.js is stale — run 'pnpm --dir apps/web generate:importmap' and commit it."
+  exit 1
+fi
+
+git checkout -- "$MAP"

package/dist/templates/base/github/workflows/ci.yml

@@ -0,0 +1,131 @@
+name: CI
+
+# Two tiers.
+#
+#   fast    every pull request and every push to main. No database: every gate
+#           here needs the config to parse, not to connect.
+#   verify  pushes to main, and on demand. A Postgres service, the migrations,
+#           and a production build — `next build` boots Payload to collect page
+#           data, so it needs a migrated database.
+#
+# A green `fast` is what a pull request is reviewed on; `verify` is what says
+# main still builds and migrates. Add a path filter to run `verify` on pull
+# requests that touch the config, the migrations or the dependencies, once this
+# project has enough of all three to make it worth the minutes.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# What payload.config.ts and the plugins check at load, as placeholders. The
+# config parses the connection string and never connects in `fast`; secrets only
+# have to be long enough to pass the plugins' own checks. Never a real value.
+env:
+  DATABASE_URI: postgres://ci:ci@localhost:5432/ci
+  PAYLOAD_SECRET: ci-placeholder-not-a-secret-000000000000
+  APPROVAL_TOKEN_SECRET: ci-placeholder-not-a-secret-000000000000
+  FORMS_IP_HASH_SECRET: ci-placeholder-not-a-secret-000000000000
+  RESEND_API_KEY: re_ci_placeholder
+  EMAIL_FROM_ADDRESS: ci@example.com
+  NEXT_PUBLIC_SERVER_URL: http://localhost:3000
+
+jobs:
+  fast:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      # First, because a lockfile missing an entry passes every other gate
+      # locally and fails here.
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check singletons resolve once
+        run: pnpm check:instances
+
+      - name: Check every package that ships code has tests
+        run: pnpm check:tested
+
+      - name: Check the migration chain
+        run: pnpm check:migrations
+
+      # Builds the design system's manifest and lints it against the contract:
+      # an unknown token, a composition rule naming a missing component, an
+      # example pointing at a story that does not exist.
+      - name: Validate the design-system manifest
+        run: pnpm validate
+
+      - name: Check generated Payload artifacts are current
+        run: bash .github/scripts/check-generated.sh
+
+      - name: Test
+        run: pnpm test
+
+      # Non-blocking: a new advisory is news, not necessarily a defect, and
+      # blocking every open pull request the morning a CVE is published is how
+      # a gate gets removed rather than fixed. Read it.
+      - name: Audit production dependencies
+        run: pnpm check:audit
+        continue-on-error: true
+
+  verify:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: ci
+          POSTGRES_PASSWORD: ci
+          POSTGRES_DB: ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      # A fresh database, migrated exactly as a deploy would migrate it. A
+      # migration that does not apply cleanly from empty fails here rather than
+      # on the first environment somebody creates.
+      - name: Migrate
+        run: pnpm --dir apps/web migrate
+
+      - name: Build
+        run: pnpm build

package/dist/templates/base/package.json.template

@@ -7,14 +7,19 @@
     "dev": "{{#if useReferenceDs}}pnpm --filter \"./design-system\" build && {{/if}}turbo run dev",
     "storybook": "turbo run storybook",
     "build-storybook": "turbo run build-storybook",
-    "validate": "turbo run validate",
+    "validate": "turbo run validate --filter=./design-system",
     "lint": "turbo run lint",
     "typecheck": "turbo run typecheck",
     "test": "turbo run test",
+    "check:instances": "tsx scripts/check-single-instance.ts",
+    "check:tested": "tsx scripts/check-tested-packages.ts",
+    "check:audit": "tsx scripts/check-audit.ts",
+    "check:migrations": "pnpm --dir apps/web run check:migrations",
     "format": "prettier --write ."
   },
   "devDependencies": {
     "prettier": "^3.4.0",
+    "tsx": "^4.21.0",
     "turbo": "^2.3.0",
     "typescript": "^5.6.0"
   },

package/dist/templates/base/scripts/check-audit.ts

@@ -0,0 +1,117 @@
+import { execFileSync } from 'node:child_process'
+
+/*
+`pnpm audit` over the production tree, with an allowlist that cannot rot.
+
+    pnpm check:audit
+
+**Why not `pnpm audit --prod --audit-level=high` on its own.** A Payload + Next
+production tree is rarely clean: there are usually high advisories in it that no
+request the site serves can reach. A gate that is red on every run is a gate
+people stop reading.
+
+**Why not `pnpm.auditConfig.ignoreGhsas`.** It filters, and that is all it does.
+A list of ids in `package.json` carries no reason, and nothing notices when one
+stops applying — the dependency is dropped or patched, and the entry sits there
+suppressing a finding it no longer describes.
+
+So this asserts the allowlist in both directions. An advisory that is not on the
+list is reported. An entry that no longer appears in the audit is *also*
+reported, as something to delete. That second half is why this is a script.
+
+It is non-blocking in CI. A new advisory is news, not necessarily a defect, and
+blocking every open pull request the morning a CVE is published is how a gate
+gets removed rather than fixed.
+*/
+
+interface Allowed {
+  ghsa: string
+  module: string
+  /** Which path it is on, and why that path cannot reach a request. */
+  why: string
+}
+
+/**
+ * High and critical advisories in the production tree that are accepted.
+ *
+ * "Not exploitable" is not a reason. Say which dependency path it arrives on
+ * and what would have to be true for a request to reach it.
+ */
+const ALLOWED: Allowed[] = []
+
+interface Advisory {
+  severity: string
+  module_name: string
+  title: string
+  github_advisory_id?: string
+}
+
+function audit(): Advisory[] {
+  let stdout: string
+  try {
+    // Exits non-zero whenever it finds anything at or above the level, so the
+    // throw is the normal case and the output is on it.
+    stdout = execFileSync('pnpm', ['audit', '--prod', '--audit-level=high', '--json'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+  } catch (error) {
+    stdout = (error as { stdout?: string }).stdout ?? ''
+  }
+
+  if (stdout.trim() === '') return []
+  const parsed = JSON.parse(stdout) as { advisories?: Record<string, Advisory> }
+  // One advisory reached through several dependency paths is reported once
+  // per path; it is one finding.
+  const unique = new Map<string, Advisory>()
+  for (const advisory of Object.values(parsed.advisories ?? {})) {
+    if (advisory.severity !== 'high' && advisory.severity !== 'critical') continue
+    unique.set(advisory.github_advisory_id ?? `${advisory.module_name}:${advisory.title}`, advisory)
+  }
+  return [...unique.values()]
+}
+
+function main(): void {
+  const found = audit()
+  const seen = new Set(found.map((a) => a.github_advisory_id).filter(Boolean) as string[])
+  const allowed = new Map(ALLOWED.map((entry) => [entry.ghsa, entry]))
+
+  const unexpected = found.filter(
+    (a) => !a.github_advisory_id || !allowed.has(a.github_advisory_id),
+  )
+  const stale = ALLOWED.filter((entry) => !seen.has(entry.ghsa))
+
+  for (const advisory of found) {
+    if (advisory.github_advisory_id && allowed.has(advisory.github_advisory_id)) {
+      console.log(`  = ${advisory.module_name.padEnd(18)} ${advisory.github_advisory_id}  accepted`)
+    }
+  }
+
+  if (unexpected.length > 0) {
+    console.log(`\n${unexpected.length} advisory/advisories not on the allowlist:\n`)
+    for (const advisory of unexpected) {
+      console.log(`  ! ${advisory.severity.padEnd(8)} ${advisory.module_name}`)
+      console.log(`      ${advisory.github_advisory_id ?? '(no GHSA id)'} — ${advisory.title}`)
+    }
+    console.log(
+      '\nEither upgrade past it, or add it to ALLOWED in scripts/check-audit.ts with the\n' +
+        'dependency path it arrives on and why no request can reach it.',
+    )
+  }
+
+  if (stale.length > 0) {
+    console.log(
+      `\n${stale.length} allowlist entry/entries no longer apply and should be deleted:\n`,
+    )
+    for (const entry of stale) console.log(`  - ${entry.ghsa}  (${entry.module})`)
+  }
+
+  if (unexpected.length === 0 && stale.length === 0) {
+    console.log(`\nNothing new. ${found.length} known advisory/advisories, each with a reason.`)
+    return
+  }
+
+  process.exitCode = 1
+}
+
+main()