@forumone/create-throughline 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # @forumone/create-throughline
 
+## 0.5.0
+
+### Minor Changes
+
+- 006ae30: A missing environment variable is reported together with every other one, in a
+  single error, instead of one plugin at a time.
+
+  The plugins that read the environment at init now declare what they cannot
+  start without, as data: `approvalsEnv` (`APPROVAL_TOKEN_SECRET`, 32+
+  characters), `emailEnv` (`RESEND_API_KEY`, `EMAIL_FROM_ADDRESS`) and `formsEnv`
+  (`FORMS_IP_HASH_SECRET`, 32+ characters). Each is a list of `EnvRequirement`
+  (`{ name, minLength?, why }`), a new type in `plugin-contract`, and each
+  plugin's own init check now reads the same entries, so the two cannot drift.
+  An empty or whitespace-only value now counts as missing in those checks.
+
+  Core exports `assertEnvironment(...checks)`. Call it first in
+  `payload.config.ts` with the plugins' lists and your own variables; it throws
+  one `EnvironmentError` whose first line reads "Configuration problem: N
+  environment variables are missing or invalid", followed by every missing or
+  too-short variable and why it is needed. Values are never printed. An argument
+  can also be a function, for a rule that is not "this name, this long", such as
+  a database URL accepted under several names. `checkEnvValue` is the one-value
+  check behind it, for a plugin's own backstop.
+
+  New projects call `assertEnvironment` at the top of `payload.config.ts` with
+  `approvalsEnv`, `emailEnv`, `formsEnv`, `PAYLOAD_SECRET` (32+ characters),
+  `NEXT_PUBLIC_SERVER_URL` and the database resolver, and `.env.example` marks
+  which variables are checked. An existing site can do the same and delete any
+  hand-kept copy of the plugins' requirements.
+
+- 833c1bd: A scaffolded project ships the rules an agent, or a new developer, needs:
+
+  - **`CLAUDE.md`** covers the layout, the gate in CI's own order, which files are generated and committed, how migrations and snapshots work, and the contract rule for the design system.
+  - **A Stop hook** (`.claude/hooks/gate.sh`) runs typecheck and lint when a session ends with pending changes. It reports, never blocks, and is silenced by `THROUGHLINE_SKIP_GATE=1`.
+
+  The README's project layout now matches what the scaffold generates.
+
+- 549d292: A scaffolded project runs every Payload CLI script — `payload`, `generate:types`, `generate:importmap`, `migrate`, `migrate:create`, `migrate:status` — through core's `throughline-payload`, so a hung run is killed rather than left spinning after its shell dies. It adds `payload:reap` to `apps/web` and the root, and ignores `.payload-cli-pids`.
+- 70385c4: A scaffolded project reports its failures. `apps/web/src/instrumentation.ts` sends unhandled request errors to `ERROR_WEBHOOK_URL` through core's reporter, and warns at boot when that variable is unset. The Inngest route passes `createTerminalFailureHandler` to every framework workflow and `createHealthcheckFailureHandler` to the healthcheck. `payload.config.ts` registers `jobFailuresPlugin`. `.env.example` lists `ERROR_WEBHOOK_URL` as optional.
+
+  A new project's first migration includes the `job-failures` table. An existing project that copies these changes needs `payload migrate:create`.
+
+- c8a86bf: A scaffolded project now starts with tests in `apps/web`:
+
+  - **Vitest.** `vitest.config.ts` loads `payload.config.ts` with placeholder variables and no database. `src/access/anonymousAccess.test.ts` uses `describeAnonymousAccess` to put every collection the project has into an access bucket. `pnpm test` runs it in CI's `fast` job. `check:tested` drops its exception for `apps/web`.
+  - **Playwright smoke pack.** `e2e/` runs against `next start`, or against `E2E_BASE_URL`. It checks the front door, a 404, the admin sign-in screen, and anonymous REST reads. The paths are in `e2e/site.ts`, along with the checks a new project cannot pass yet because it does not serve the routes they test. It runs in CI's `verify` job after the build. The new scripts are `test`, `test:smoke` and `test:smoke:install`.
+  - **`pages` read rule.** The example `pages` collection gains a published-or-signed-in `read` rule. Before, Payload's default refused every anonymous read, so the public site could never read a page.
+
+### Patch Changes
+
+- c8a86bf: The `Divider` contract now declares `decorative` with `defaultValue: true`, matching the component. Before, the default was written only in prose, so a divider added in the CMS started unticked and screen readers announced it.
+- ab623e1: The scaffolded `payload.config.ts` uses core's `mcpApiKeyAccess(isAdmin)` to make the MCP key collection admin-only, replacing the inline override. It now also covers `unlock` and refuses a key principal outright. The scaffold depends on `payload` and `@payloadcms/*` `^3.89.0`.
+- 653817e: Revalidation no longer guesses paths, and covers the changes a publish event never announces.
+
+  - **workflows (breaking)**: `createRevalidateOnPublishFunction` has no built-in URL
+    builders. They mapped `pages` to `/<slug>`, `posts` to `/blog/<slug>` and any other
+    collection to `/<slug>`, so a site whose routes differed revalidated the wrong path
+    without a word. `urlBuilders` is now required; a collection with no entry has its
+    tags dropped and no path revalidated, and the run logs a warning. To keep the old
+    behaviour, pass the old builders:
+
+    ```ts
+    urlBuilders: {
+      pages: (slug) => (slug === 'home' || slug === '' ? '/' : `/${slug}`),
+      posts: (slug) => `/blog/${slug}`,
+    }
+    ```
+
+    and then check them against your routes.
+
+  - **workflows**: `createTagRevalidationHooks` — collection `afterChange` and
+    `afterDelete`, and global `afterChange`, hooks that call
+    `revalidateTag(tag, { expire: 0 })`. Draft saves and autosave drop nothing (via
+    publishing's `isDraftWrite`); an unpublish still does. A hook never throws: outside a
+    Next request (seeds, migrations, the CLI) it logs at `debug`, and any other failure
+    at `error` with the tag and the cause.
+  - **workflows**: `createCacheTags` builds every tag string, so the hooks, the publish
+    workflow (new `cacheTags` option) and cached reads cannot name different tags.
+    Defaults: the bare slug for a collection, `global_<slug>` for a global. Also on the
+    dependency-free `@forumone/throughline-workflows/cache-tags` subpath for frontend code.
+    `@forumone/throughline-publishing` is now a dependency of this package.
+  - **create-throughline**: the scaffold adds `apps/web/src/lib/cache-tags.ts`, attaches
+    the tag hooks to `Pages`, and passes explicit `urlBuilders` and the shared
+    `cacheTags` to the publish workflow.
+
+## 0.4.0
+
+### Minor Changes
+
+- 8b7d698: A scaffolded project ships a two-tier CI workflow:
+
+  - `fast` runs on every pull request with no database. It installs from the lockfile, then runs typecheck, lint, the workspace and migration gates, manifest validation, a generated-files check and tests, with a non-blocking audit.
+  - `verify` runs on pushes to main. It migrates a fresh Postgres and runs a production build.
+
+  `check-generated.sh` regenerates `payload-types.ts` and the admin import map and fails on any difference, including an uncommitted file. `apps/web` gains `generate:types` and `generate:importmap`.
+
+- 8b7d698: A scaffolded project manages its schema through migrations from the first table on:
+
+  - **Config.** `payload.config.ts` sets `push: false` and an explicit `migrationDir`. It connects through a resolver that knows the Vercel–Neon integration's variables, keeps a migration off Neon's pooled endpoint, and accepts an optional migration-only credential.
+  - **Scripts.** `apps/web` gains `migrate`, `migrate:create`, `migrate:status`, `migrate:snapshot` and `check:migrations`. The check asserts that every migration has its schema snapshot, that no snapshot is orphaned, and that no drop follows a `CASCADE` that has already carried it out.
+  - **Write guard.** `scripts/lib/target.ts` gives scripts that write to a database a `requireTarget` guard.
+
+- 8b7d698: A scaffolded project ships three workspace gates as root scripts:
+
+  - `check:instances`: `payload`, `@payloadcms/ui`, `react` and `react-dom` each resolve to exactly one copy
+  - `check:tested`: every package that ships code has at least one test
+  - `check:audit`: production advisories are checked against an allowlist that carries a reason for each entry and fails when an entry goes stale
+
+### Patch Changes
+
+- e9077b3: The reference design system's manifest build and validation, which every scaffolded project vendors, now:
+
+  - refuse a component directory with no contract, instead of silently leaving it out of the manifest
+  - read the directories that hold components from a `CONTRACT_LAYERS` list
+  - name the manifest from the project's own `package.json`, instead of claiming to be `@forumone/throughline-reference-ds`
+  - treat `antiExamples.empty` and `intent.brevity` as errors
+
+- 6800052: The scaffold compiles against the current Throughline releases, and serves its tools over MCP:
+
+  - `payload.config.ts` no longer imports `createApiKeysCollection`, which core removed.
+  - One `createMcpToolCollector()` is passed to every tool-bearing plugin, and `@payloadcms/plugin-mcp` is registered after them, with its key collection narrowed to admins.
+  - The Inngest route types the integration registry, so `serve()` can type its function list.
+  - `@payloadcms/plugin-form-builder` is a caret range like the rest of `@payloadcms/*`, so it no longer installs a second `@payloadcms/ui`.
+  - `.env.example` and the printed next steps drop the per-server MCP keys that no longer exist.
+
 ## 0.3.1
 
 ### Patch Changes

package/dist/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAa,MAAM,kBAAkB,CAAA;AAK5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC7F;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;;;;;;GASG;AACH,iBAAe,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF;AAiBD,iBAAS,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3C;AAUD,iBAAS,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AA6BD,eAAO,MAAM,SAAS;;;;;;;CAAsE,CAAA"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAa,MAAM,kBAAkB,CAAA;AAK5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC7F;AAED,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;;;;;;GASG;AACH,iBAAe,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF;AAiBD,iBAAS,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3C;AAeD,iBAAS,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AA6BD,eAAO,MAAM,SAAS;;;;;;;CAAsE,CAAA"}

package/dist/generator.js

@@ -117,9 +117,14 @@ function isBinary(filename) {
 /**
  * npm strips files literally named `.gitignore` from a published tarball, so
  * we author them as `gitignore` in templates and restore the dot on output.
+ * `.github` and `.claude` go the same way: a dot-directory in a tarball is at
+ * the mercy of whichever ignore rules the publishing npm applies, and neither
+ * the scaffold's CI nor its agent setup is something to lose silently.
  */
 const DOTFILE_RENAMES = {
     gitignore: '.gitignore',
+    github: '.github',
+    claude: '.claude',
 };
 function applyDotfileRename(name) {
     return DOTFILE_RENAMES[name] ?? name;

package/dist/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAW7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,UAA2B,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;QAC3C,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,gBAAgB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,gBAAgB,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAwC,CAAA;IAEhG,UAAU,CAAC,4BAA4B,CAAC,CAAA;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAA;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrF,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,UAAU,CAAC,kBAAkB,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,UAAU,CAAC,kDAAkD,CAAC,CAAA;QAC9D,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAc;IACjE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAE7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAE7B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAA;QACd,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAA;AAEF,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,SAAS,EAAE,YAAY;CACxB,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,CACd,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC1D,GAAG,CACJ,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAA;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AAW7D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,UAA2B,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;QAC3C,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,gBAAgB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,gBAAgB,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAwC,CAAA;IAEhG,UAAU,CAAC,4BAA4B,CAAC,CAAA;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAA;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrF,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,IAAI;KACL,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACtD,UAAU,CAAC,kBAAkB,CAAC,CAAA;QAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,UAAU,CAAC,kDAAkD,CAAC,CAAA;QAC9D,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAc;IACjE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAM;QAC9D,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAE7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAE7B,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAA;QACd,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAA;AAEF,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAA2B;IAC9C,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;CAClB,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,UAAU,CACd,KAAK,EACL,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC1D,GAAG,CACJ,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAA;;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA"}

package/dist/post-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-install.d.ts","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkFrD"}
+{"version":3,"file":"post-install.d.ts","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwFrD"}

package/dist/post-install.js

@@ -28,11 +28,18 @@ export function printNextSteps(answers) {
     lines.push(`       ${pc.dim('openssl rand -base64 48  # PAYLOAD_SECRET')}`);
     lines.push(`       ${pc.dim('openssl rand -base64 48  # APPROVAL_TOKEN_SECRET')}`);
     lines.push(`       ${pc.dim('openssl rand -base64 48  # FORMS_IP_HASH_SECRET')}`);
+    // `push: false`: the schema exists only once a migration has created it.
+    lines.push(formatStep(step++, 'Create and apply the first migration:'));
+    lines.push(`       ${pc.dim('pnpm --dir apps/web migrate:create initial')}`);
+    lines.push(`       ${pc.dim('pnpm --dir apps/web migrate')}`);
+    // Committed and checked by CI, so the first push is green only with them.
+    lines.push(formatStep(step++, 'Generate the Payload types and import map, and commit them:'));
+    lines.push(`       ${pc.dim('pnpm --dir apps/web generate:types')}`);
+    lines.push(`       ${pc.dim('pnpm --dir apps/web generate:importmap')}`);
     lines.push(formatStep(step++, `${pc.bold('pnpm dev')} to run locally`));
     lines.push(formatStep(step++, 'Open http://localhost:3000/admin and create your first admin user'));
-    lines.push(formatStep(step++, 'In the admin, go to API Keys and create one key per MCP server'));
-    lines.push(formatStep(step++, 'Paste those keys into .env.local'));
-    lines.push(formatStep(step, 'Wire Claude (or your MCP client) to your MCP endpoints — see the generated README.md'));
+    lines.push(formatStep(step++, 'In the admin, create one key under MCP → Payload MCP API Keys'));
+    lines.push(formatStep(step, 'Give that key to Claude (or your MCP client) for /api/mcp — see the generated README.md'));
     // eslint-disable-next-line no-console
     console.log();
     // eslint-disable-next-line no-console

package/dist/post-install.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-install.js","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAA;IAE7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CACjF,CACF,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAA;IACvG,CAAC;SAAM,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAA;IAClH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,EAAE,CAAC,CAAA;IACjH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAA;IAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAA;IAC3E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAA;IAClF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAA;IAEjF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,mEAAmE,CACpE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,gEAAgE,CACjE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAC,CAAA;IAClE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EACJ,sFAAsF,CACvF,CACF,CAAA;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;IACnC,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG;QACrB,8DAA8D;QAC9D,qEAAqE;QACrE,oDAAoD;KACrD,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,IAAY;IACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"post-install.js","sourceRoot":"","sources":["../src/post-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAA;IAE7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CACjF,CACF,CAAA;IAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAA;IACvG,CAAC;SAAM,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,gFAAgF,CAAC,EAAE,CAAC,CAAA;IAClH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,EAAE,CAAC,CAAA;IACjH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAA;IAC5D,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAA;IAC3E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAA;IAClF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAA;IAEjF,yEAAyE;IACzE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,4CAA4C,CAAC,EAAE,CAAC,CAAA;IAC5E,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAE7D,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,6DAA6D,CAAC,CAAC,CAAA;IAC7F,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;IACpE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAA;IAExE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;IACvE,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EAAE,EACN,mEAAmE,CACpE,CACF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,IAAI,EAAE,EAAE,+DAA+D,CAAC,CACpF,CAAA;IACD,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EACJ,yFAAyF,CAC1F,CACF,CAAA;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;IACnC,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAA;IACnE,MAAM,cAAc,GAAG;QACrB,8DAA8D;QAC9D,qEAAqE;QACrE,oDAAoD;KACrD,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,IAAY;IACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;AACxC,CAAC"}

package/dist/templates/base/.env.example

@@ -1,5 +1,17 @@
-# --- Required ---
+# Every variable marked "checked at startup" is listed in the assertEnvironment
+# call at the top of apps/web/src/payload.config.ts, which reports all the
+# missing or too-short ones in a single error before anything else runs. Add a
+# variable there when you add one here that the site cannot start without.
+
+# --- Required (checked at startup) ---
+# The database may come from DATABASE_URI or, on Vercel + Neon, the
+# integration's DATABASE_URL and friends — see apps/web/src/lib/database.ts.
 DATABASE_URI=postgres://user:pass@host/dbname
+# Optional: a schema-owner credential used only by `pnpm migrate`, so the app
+# itself can run as a role that reads and writes rows and no more. See
+# apps/web/src/lib/database.ts.
+# MIGRATION_DATABASE_URL=
+# 32+ characters. Generate: openssl rand -base64 48
 PAYLOAD_SECRET=generate-with-openssl-rand-base64-48
 NEXT_PUBLIC_SERVER_URL=http://localhost:3000
 
@@ -10,32 +22,34 @@ INNGEST_EVENT_KEY=
 INNGEST_SIGNING_KEY=
 
 # --- Resend (for approval + form notification emails) ---
+# RESEND_API_KEY and EMAIL_FROM_ADDRESS are checked at startup (emailEnv).
 RESEND_API_KEY=
 EMAIL_FROM_ADDRESS=notifications@example.com
+# Optional.
 EMAIL_FROM_NAME={{projectName}}
 EMAIL_REPLY_TO=
 
-# --- Approval tokens ---
-# Generate: openssl rand -base64 48
+# --- Approval tokens (checked at startup: approvalsEnv) ---
+# 32+ characters. Generate: openssl rand -base64 48
 APPROVAL_TOKEN_SECRET=
 
-# --- Forms ---
-# Generate: openssl rand -base64 48
+# --- Forms (checked at startup: formsEnv) ---
+# 32+ characters. Generate: openssl rand -base64 48
 FORMS_IP_HASH_SECRET=
 
-# --- MCP server keys ---
-# Each key is generated in the Payload admin (API Keys collection) after
-# first deploy and pasted back here for local dev.
-COMPONENT_SERVER_API_KEY=
-PUBLISHING_SERVER_API_KEY=
-APPROVALS_SERVER_API_KEY=
-AUDIT_SERVER_API_KEY=
-FORMS_SERVER_API_KEY=
-INTEGRATIONS_SERVER_API_KEY=
-
-# System API key used by scheduled workflows that talk back to the
-# Publishing MCP server (executes scheduled publishes).
-PUBLISHING_SYSTEM_API_KEY=
+# --- MCP ---
+# No keys here. Every Throughline tool is served on one /api/mcp by
+# @payloadcms/plugin-mcp; create a key in the admin under MCP -> Payload MCP
+# API Keys and give it to your MCP client, not to this file. Scheduled
+# publishes run in process and need no key either.
+
+# --- Optional: error reporting ---
+# Where unhandled request errors, workflows that ran out of retries and failing
+# healthchecks are POSTed as JSON (with a one-line `text`, so a Slack incoming
+# webhook works as-is). A log drain, an alerting endpoint or a proxy in front of
+# your error tracker. Unset: errors reach the log only, and the server says so
+# at boot. Job failures are also recorded in the admin under Job Failures.
+ERROR_WEBHOOK_URL=
 
 # --- Optional: storage ---
 # Vercel Blob token if deploying to Vercel; remove this and the storage

package/dist/templates/base/CLAUDE.md

@@ -0,0 +1,112 @@
+# {{projectName}}
+
+A **Throughline** project: a Payload CMS application (`apps/web`) wired to the
+Throughline plugin suite, plus the design system that supplies its component
+vocabulary. Throughline docs: https://github.com/forumone/throughline
+
+```
+apps/web/          Next.js + Payload host
+design-system/     The design system and its Storybook
+scripts/           Workspace gates, each explained at the top of its file
+.github/           CI: `fast` on every pull request, `verify` on main
+```
+
+## The gate
+
+This is what CI's `fast` job runs, in its order. Run it before calling work
+done:
+
+```bash
+pnpm install --frozen-lockfile \
+  && pnpm typecheck && pnpm lint \
+  && pnpm check:instances && pnpm check:tested && pnpm check:migrations \
+  && pnpm validate \
+  && bash .github/scripts/check-generated.sh \
+  && pnpm test
+```
+
+`--frozen-lockfile` leads because a lockfile missing an entry passes every
+other gate locally and fails in CI. `check-generated.sh` needs the environment
+`payload.config.ts` validates; the placeholders at the top of
+`.github/workflows/ci.yml` are enough — it parses the connection string and
+never connects.
+
+`verify` adds a migrated Postgres and `pnpm build`; it runs on main.
+
+A Stop hook (`.claude/hooks/gate.sh`) runs typecheck and lint when a session
+ends with pending changes. It reports and never blocks. Set
+`THROUGHLINE_SKIP_GATE=1` to silence it.
+
+## Generated files are committed — never hand-edit them
+
+After any change to `payload.config.ts`, a collection or a plugin version:
+
+```bash
+pnpm --dir apps/web generate:types       # -> src/payload-types.ts
+pnpm --dir apps/web generate:importmap   # -> src/app/(payload)/admin/importMap.js
+```
+
+Commit both. CI regenerates them and fails on a difference. A stale import map
+is a 500 on any admin screen that renders a component it has never heard of;
+stale types make everything downstream compile against a schema that no longer
+exists.
+
+## Schema changes go through migrations
+
+`push` is off, in development too: `apps/web/src/migrations` is the only way the
+schema changes.
+
+```bash
+pnpm --dir apps/web migrate:create <name>   # diffs the config against the newest snapshot
+pnpm --dir apps/web migrate                 # apply
+pnpm --dir apps/web migrate:snapshot        # only after hand-writing a migration
+```
+
+`migrate:create` diffs against the `.json` snapshot beside the newest migration,
+**not the database**. A hand-written migration without its snapshot leaves the
+generator a step behind, re-proposing changes that already shipped.
+`check:migrations` fails on a missing or orphaned snapshot, and on a drop that a
+`CASCADE` has already carried out.
+
+The `payload` CLI loads `.env.local`; `tsx` scripts load nothing. For anything
+that writes to a database, pass the variables on the command line and use
+`requireTarget` from `apps/web/scripts/lib/target.ts`, which prints the target
+and demands `--confirm` before overwriting.
+
+## The design system reaches the CMS through its manifest
+
+`payload.config.ts` hands the design system's manifest to `componentsPlugin`,
+and that manifest is how the CMS knows which components exist and how they may
+be composed. It is built from a `<Name>.contract.ts` beside every component.
+{{#if useReferenceDs}}
+- **A new component needs a contract.** `build:manifest` refuses a component
+  directory without one; prefix a directory with `_` if it is not a component.
+- **`pnpm validate` must pass.** It catches an unknown token, a composition rule
+  naming a component that does not exist, and an example pointing at a story
+  that is not there.
+{{else}}
+The design system here is a placeholder. When you build it, give every
+component a contract, publish a manifest, and point `componentsPlugin` at it —
+see the design-contract package in the Throughline repository.
+{{/if}}
+## Tests
+
+`check:tested` requires at least one test in every package that ships code.
+
+`apps/web` starts with one: `src/access/anonymousAccess.test.ts`, which
+`pnpm test` runs through a vitest config that loads `payload.config.ts` without
+a database. It puts every collection in one of two buckets: read by the
+rendered site, so anonymous reads must be allowed, or private, so they must be
+refused. A new collection fails it until you add it to a bucket. Decide which,
+and don't open a collection to anonymous reads to make the test pass. More good
+first tests need no database: field validations, and hooks as functions.
+
+`pnpm test:smoke` runs the Playwright smoke pack in `e2e/` against
+`next start`, so build first, or against a deployed site when `E2E_BASE_URL`
+is set. Every check is a GET. CI runs it in `verify`, after the production
+build. Add routes to `e2e/site.ts` as the site gains them.
+
+## Conventions
+
+- pnpm only. The lockfile is at the root.
+- Open a pull request for review; do not merge your own.

package/dist/templates/base/README.md

@@ -30,12 +30,28 @@ openssl rand -base64 48
 #    - APPROVAL_TOKEN_SECRET        — generated above
 #    - FORMS_IP_HASH_SECRET         — generated above
 #    - RESEND_API_KEY               — from Resend dashboard
+#    - EMAIL_FROM_ADDRESS           — a verified sender on your Resend domain
 #    - INNGEST_EVENT_KEY/SIGNING    — from Inngest (optional in local dev)
-
-# 5. Start the dev server
+#
+#    Anything missing or too short is reported all at once, in one error that
+#    starts "Configuration problem", by the assertEnvironment call at the top
+#    of apps/web/src/payload.config.ts — the first command that loads the
+#    config (step 5) tells you everything left to fill in.
+
+# 5. Create and apply the first migration. The config sets `push: false`, so
+#    migrations are the only way the schema changes, from the first table on.
+pnpm --dir apps/web migrate:create initial
+pnpm --dir apps/web migrate
+
+# 6. Generate the Payload types and admin import map, and commit both along
+#    with the migration. CI fails until they match the config.
+pnpm --dir apps/web generate:types
+pnpm --dir apps/web generate:importmap
+
+# 7. Start the dev server
 pnpm dev
 
-# 6. Visit http://localhost:3000/admin and create your first user.
+# 8. Visit http://localhost:3000/admin and create your first user.
 ```
 
 ## After admin signup
@@ -65,6 +81,71 @@ pnpm dev
 - `pnpm typecheck` — TypeScript check across the monorepo
 - `pnpm lint` — ESLint
 - `pnpm test` — run all package tests
+- `pnpm payload:reap` — kill any Payload CLI run a killed shell left behind (the next Payload command does this too)
+
+Every script that runs the Payload CLI — `payload`, `generate:*`, `migrate*` —
+goes through `throughline-payload` from `@forumone/throughline-core`. pnpm does
+not forward signals to the node process it starts, so a bare `payload` whose
+shell is killed keeps running, and a hung one spins on a core indefinitely. The
+runner gives Payload its own process group, forwards Ctrl-C and friends to it,
+and kills it after five minutes (`PAYLOAD_CLI_TIMEOUT_MS`, `0` to disable;
+`migrate*` has no limit unless you set one). Run the Payload CLI through these
+scripts rather than `npx payload`.
+
+- `pnpm --dir apps/web test:smoke` — the Playwright smoke pack, against a local `next start` (run `pnpm build` first) or `E2E_BASE_URL`
+
+## Tests
+
+`apps/web` has two kinds of test.
+
+- **`pnpm test`** runs vitest in Node with no database and no browser, so it runs in CI's `fast` job on every pull request. `vitest.config.ts` gives `payload.config.ts` placeholder environment variables, so the config loads without connecting to anything. The first test, `src/access/anonymousAccess.test.ts`, puts every collection into one of two buckets: collections the public site reads with nobody signed in (`renderPath`), and collections it must not read (`private`). It then checks each collection's `read` rule against its bucket. **Adding a collection, or a plugin that brings collections, fails this test until you put each new collection in a bucket.** See the Throughline guide _Adding a collection_.
+- **`pnpm --dir apps/web test:smoke`** is a Playwright smoke pack (`e2e/`) that sends real requests to `next start` on an empty, migrated database. It checks that the front door answers, that an unknown path returns 404, that the admin shows its sign-in screen, and that the REST API refuses anonymous reads of private collections while allowing reads of public ones. It runs in CI's `verify` job, which has a database. Set `E2E_BASE_URL` to run it against a deployed site. Every check is a GET request. The paths it checks are configured in `e2e/site.ts`. That file also lists checks a new project cannot pass yet because it does not serve the route: security headers, `robots.txt`, the sitemap, `llms.txt` and a draft-mode route. Add each check when you add its route.
+
+Run `pnpm --dir apps/web test:smoke:install` once to download Chromium.
+
+## Migrations
+
+The schema changes only through `apps/web/src/migrations` — `push` is off, in
+development too. From `apps/web`:
+
+- `pnpm migrate:create <name>` — generate a migration from the config. It diffs against the `.json` snapshot beside the newest migration, not against the database, and needs no database.
+- `pnpm migrate` — apply pending migrations. Connects through `MIGRATION_DATABASE_URL` when it is set.
+- `pnpm migrate:status` — what has been applied.
+- `pnpm migrate:snapshot` — after **hand-writing** a migration, write its snapshot, or the generator falls a step behind and re-proposes changes that already shipped.
+- `pnpm check:migrations` — every migration has a snapshot, no snapshot is orphaned, and no drop follows a `CASCADE` that already carried it out. Also runs from the root.
+
+Scripts that write to a database can call `requireTarget` from `apps/web/scripts/lib/target.ts`, which prints the database, host and variable it is about to write through, and demands `--confirm` before overwriting anything.
+
+## Generated files
+
+`apps/web/src/payload-types.ts` and `apps/web/src/app/(payload)/admin/importMap.js`
+are generated from `payload.config.ts` and **committed**. Regenerate both after
+any change to the config, a collection or a plugin version, and commit the
+result — CI regenerates them and fails on a difference:
+
+```bash
+pnpm --dir apps/web generate:types
+pnpm --dir apps/web generate:importmap
+```
+
+A stale import map is a 500 on any admin screen that renders a component the
+map has never heard of.
+
+## CI
+
+`.github/workflows/ci.yml` runs two tiers. `fast` runs on every pull request
+and needs no database: install from the lockfile, typecheck, lint, the gates
+below, manifest validation, the generated-files check and tests. `verify` runs
+on pushes to main: it migrates a fresh Postgres, runs a production build, and
+runs the smoke pack against it.
+
+## Workspace gates
+
+Each is explained at the top of its script in `scripts/`:
+
+- `pnpm check:instances` — `payload`, `@payloadcms/ui`, `react` and `react-dom` each resolve to exactly one copy. Two byte-identical copies are two React contexts, and a runtime failure nothing else can see.
+- `pnpm check:tested` — every workspace package that ships code has at least one test. Not a coverage number. A package with no tests can go on the exception list in the script, with a reason. An entry fails once that package has tests.
+- `pnpm check:audit` — high and critical production advisories against an allowlist that carries a reason for each entry, and that fails when an entry stops applying.
 
 ## Project layout
 
@@ -72,10 +153,14 @@ pnpm dev
 {{projectName}}/
 ├── apps/
 │   └── web/                  # Next.js + Payload host
-├── packages/
-│   ├── design-system/        # UI components consumed by Components MCP
-│   ├── content/              # Reusable collections + blocks (optional)
-│   └── brand/                # Brand tokens / email theme (optional)
+│       ├── scripts/          # migration tooling, requireTarget
+│       └── src/migrations/   # the only way the schema changes
+├── design-system/            # components + contracts -> the manifest the CMS reads
+├── packages/                 # your own shared packages (optional)
+├── scripts/                  # workspace gates
+├── .claude/                  # agent settings and the Stop-hook gate
+├── .github/                  # CI: fast + verify
+├── CLAUDE.md                 # the rules an agent (or a new developer) needs
 ├── .env.example
 ├── pnpm-workspace.yaml
 ├── turbo.json

package/dist/templates/base/apps/web/e2e/site.ts

@@ -0,0 +1,36 @@
+/*
+What the smoke pack checks, and where. Site data: change the paths here, not in
+the specs.
+
+**What the pack does not check yet, because a fresh project does not serve it.**
+Each is a check worth adding with the route that makes it true:
+
+  - security headers — `next.config.mjs` sets none. Add `headers()` there, then
+    assert them per route: HSTS, `nosniff`, a referrer policy, and framing
+    (`DENY` on `/admin`, `SAMEORIGIN` where live preview frames the site).
+  - `robots.txt` and `sitemap.xml` — add `app/robots.ts` and `app/sitemap.ts`;
+    assert a 200, the content type, and that the sitemap lists each URL once.
+  - `llms.txt` — a route serving `text/markdown`, with a heading and links.
+  - draft mode — a preview route must refuse a request without its secret
+    (401) and one naming no document (400).
+*/
+export const site = {
+  /**
+   * A deployed site to point at, from `E2E_BASE_URL`. Unset, the pack starts
+   * `next start` locally on `port`.
+   */
+  baseURL: process.env.E2E_BASE_URL?.trim() || undefined,
+  port: 3100,
+
+  /** The front door. */
+  home: '/',
+  /** The Payload admin. On an empty database it asks for the first user. */
+  admin: '/admin',
+  /** A path nothing serves, which must be a 404 and never a 500. */
+  missing: '/a-page-that-was-never-written',
+
+  /** REST collections an anonymous request must be refused. */
+  privateCollections: ['users', 'payload-mcp-api-keys'],
+  /** REST collections an anonymous request may read — published documents only. */
+  publicCollections: ['pages'],
+}

package/dist/templates/base/apps/web/e2e/smoke.spec.ts

@@ -0,0 +1,52 @@
+import { expect, test } from '@playwright/test'
+import { site } from './site'
+
+test.describe('the front door', () => {
+  test('answers with a document and a main landmark', async ({ page }) => {
+    const response = await page.goto(site.home)
+    expect(response?.status()).toBe(200)
+    await expect(page.locator('main')).toBeAttached()
+  })
+
+  test('404s a path that does not exist, rather than erroring', async ({ request }) => {
+    const response = await request.get(site.missing, { maxRedirects: 0 })
+    expect(response.status()).toBe(404)
+  })
+})
+
+test.describe('the admin', () => {
+  /*
+  The whole admin is one client bundle and the import map it reads. A stale
+  map, a missing environment variable or a plugin that throws at init all
+  surface here as a 500 or a blank screen — and as nothing at all in a test
+  that does not load the page.
+  */
+  test('serves a sign-in screen', async ({ page }) => {
+    const response = await page.goto(site.admin)
+    expect(response?.status()).toBeLessThan(500)
+    await expect(page.getByRole('textbox', { name: /email/i })).toBeVisible({ timeout: 30_000 })
+  })
+})
+
+test.describe('the REST API, to a request with nobody signed in', () => {
+  /*
+  The same rules `src/access/anonymousAccess.test.ts` checks as values, here as
+  responses: proof that nothing between the rule and the wire — a plugin, an
+  endpoint, a framework upgrade — reopened a collection.
+  */
+  for (const slug of site.privateCollections) {
+    test(`refuses to list ${slug}`, async ({ request }) => {
+      const response = await request.get(`/api/${slug}`)
+      expect(response.status()).toBe(403)
+    })
+  }
+
+  for (const slug of site.publicCollections) {
+    test(`lists ${slug}`, async ({ request }) => {
+      const response = await request.get(`/api/${slug}`)
+      expect(response.status()).toBe(200)
+      const body = (await response.json()) as { docs?: unknown }
+      expect(Array.isArray(body.docs)).toBe(true)
+    })
+  }
+})