create-payload-stack 0.1.1 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Presecan / Fortbit d.o.o. and Payload Solutions contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -6,11 +6,11 @@ Scaffold a SaaS on Payload CMS in one command.
 npx create-payload-stack@latest
 ```
 
-Six prompts: project name, database (PostgreSQL, MongoDB, SQLite, Vercel Postgres), connection string, sign-in methods, organizations, billing. The CLI downloads [Payload Stack](https://www.payloadstack.com), writes your answers into `src/stack.config.ts`, swaps the Payload database adapter, generates `.env` with fresh secrets, installs dependencies and initializes git.
+Nine prompts: project name, database (PostgreSQL, MongoDB, SQLite, Vercel Postgres), connection string, sign-in methods, organizations, billing, media storage (skip for local disk, or Vercel Blob, AWS S3, Cloudflare R2, Azure Blob Storage, Google Cloud Storage, Uploadthing), transactional emails (edit copy in the Payload admin, or keep React Email components in code) and cookie consent (banner with audited legal pages, or plain legal pages). The CLI downloads [Payload Stack](https://www.payloadstack.com), writes your answers into `src/stack.config.ts`, swaps the Payload database adapter, wires the storage adapter into `payload.config.ts`, generates `.env` with fresh secrets, installs dependencies and initializes git.
 
 ```bash
 # non-interactive
-npx create-payload-stack@latest ridgeline -d postgres --auth email-password,magic-link,passkey --social github --billing organization -y
+npx create-payload-stack@latest ridgeline -d postgres --auth email-password,magic-link,passkey --social github --billing organization --storage vercel-blob --emails --consent -y
 ```
 
 Run `npx create-payload-stack@latest --help` for every flag. Documentation: https://payload.solutions/docs/payload-stack

package/dist/index.js

@@ -1,21 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { parseArgs } from "util";
 import { createRequire } from "module";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 
-// src/cli.ts
-import * as p from "@clack/prompts";
-import { execa as execa2 } from "execa";
-import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
+// src/args.ts
+import { parseArgs } from "util";
 import pc from "picocolors";
 
-// src/configure.ts
-import { readFile, writeFile } from "fs/promises";
-import path from "path";
-
 // src/databases.ts
 var DB_CHOICES = {
   postgres: {
@@ -76,10 +68,437 @@ function defaultConnectionString(db, projectSlug) {
   return `${db.connectionPrefix}${projectSlug}${db.connectionSuffix}`;
 }
 
+// src/storage.ts
+var LOCAL_STORAGE_CONFIG = `// Local disk (./media): fine for development, lost on redeploy on Vercel and other ephemeral hosts.
+// Move uploads to Vercel Blob, S3, R2, Azure, GCS or Uploadthing: https://payload.solutions/docs/payload-stack/storage`;
+var STORAGE_CHOICES = {
+  "vercel-blob": {
+    key: "vercel-blob",
+    label: "Vercel Blob",
+    hint: "needs BLOB_READ_WRITE_TOKEN",
+    packageName: "@payloadcms/storage-vercel-blob",
+    importName: "vercelBlobStorage",
+    usesRequireEnv: false,
+    envVars: ["BLOB_READ_WRITE_TOKEN"],
+    config: `// Vercel Blob. Without BLOB_READ_WRITE_TOKEN uploads stay on local disk (./media).
+if (env.BLOB_READ_WRITE_TOKEN) {
+  plugins.push(
+    vercelBlobStorage({
+      collections: { media: true },
+      token: env.BLOB_READ_WRITE_TOKEN,
+      // Vercel functions accept request bodies up to 4.5 MB. For larger files upload from the
+      // browser instead: set clientUploads: true and run pnpm generate:importmap.
+      // clientUploads: true,
+    }),
+  )
+}`
+  },
+  s3: {
+    key: "s3",
+    label: "AWS S3",
+    hint: "or S3-compatible: MinIO, DigitalOcean Spaces, Backblaze B2",
+    packageName: "@payloadcms/storage-s3",
+    importName: "s3Storage",
+    usesRequireEnv: false,
+    envVars: ["S3_BUCKET", "S3_REGION", "S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY"],
+    config: `// AWS S3, or any S3-compatible service. Without S3_BUCKET uploads stay on local disk (./media).
+if (env.S3_BUCKET) {
+  plugins.push(
+    s3Storage({
+      collections: { media: true },
+      bucket: env.S3_BUCKET,
+      config: {
+        region: env.S3_REGION,
+        // Leave the keys unset to use the AWS default credential chain (IAM roles, profiles).
+        credentials:
+          env.S3_ACCESS_KEY_ID && env.S3_SECRET_ACCESS_KEY
+            ? { accessKeyId: env.S3_ACCESS_KEY_ID, secretAccessKey: env.S3_SECRET_ACCESS_KEY }
+            : undefined,
+        // MinIO, DigitalOcean Spaces, Backblaze B2 and other S3-compatible services: set S3_ENDPOINT.
+        endpoint: env.S3_ENDPOINT,
+        forcePathStyle: Boolean(env.S3_ENDPOINT),
+      },
+    }),
+  )
+}`
+  },
+  r2: {
+    key: "r2",
+    label: "Cloudflare R2",
+    hint: "through the S3 API; needs R2_BUCKET, R2_ENDPOINT and keys",
+    packageName: "@payloadcms/storage-s3",
+    importName: "s3Storage",
+    usesRequireEnv: true,
+    envVars: ["R2_BUCKET", "R2_ENDPOINT", "R2_ACCESS_KEY_ID", "R2_SECRET_ACCESS_KEY"],
+    config: `// Cloudflare R2 through its S3-compatible API. Without R2_BUCKET uploads stay on local disk (./media).
+if (env.R2_BUCKET) {
+  plugins.push(
+    s3Storage({
+      collections: {
+        media: env.R2_PUBLIC_URL
+          ? {
+              // Serve files from the bucket's public URL or custom domain instead of through Payload.
+              disablePayloadAccessControl: true,
+              generateFileURL: ({ filename, prefix }) =>
+                \`\${env.R2_PUBLIC_URL}/\${prefix ? \`\${prefix}/\${filename}\` : filename}\`,
+            }
+          : true,
+      },
+      bucket: env.R2_BUCKET,
+      config: {
+        credentials: {
+          accessKeyId: requireEnv('R2_ACCESS_KEY_ID', 'for Cloudflare R2'),
+          secretAccessKey: requireEnv('R2_SECRET_ACCESS_KEY', 'for Cloudflare R2'),
+        },
+        // R2 requires region "auto" and path-style addressing.
+        region: 'auto',
+        endpoint: requireEnv('R2_ENDPOINT', 'for Cloudflare R2'),
+        forcePathStyle: true,
+      },
+    }),
+  )
+}`
+  },
+  azure: {
+    key: "azure",
+    label: "Azure Blob Storage",
+    hint: "needs AZURE_STORAGE_CONNECTION_STRING, container name and base URL",
+    packageName: "@payloadcms/storage-azure",
+    importName: "azureStorage",
+    usesRequireEnv: true,
+    envVars: ["AZURE_STORAGE_CONNECTION_STRING", "AZURE_STORAGE_CONTAINER_NAME", "AZURE_STORAGE_ACCOUNT_BASEURL"],
+    config: `// Azure Blob Storage. Without AZURE_STORAGE_CONNECTION_STRING uploads stay on local disk (./media).
+if (env.AZURE_STORAGE_CONNECTION_STRING) {
+  plugins.push(
+    azureStorage({
+      collections: { media: true },
+      connectionString: env.AZURE_STORAGE_CONNECTION_STRING,
+      containerName: requireEnv('AZURE_STORAGE_CONTAINER_NAME', 'for Azure Blob Storage'),
+      baseURL: requireEnv('AZURE_STORAGE_ACCOUNT_BASEURL', 'for Azure Blob Storage'),
+      allowContainerCreate: env.AZURE_STORAGE_ALLOW_CONTAINER_CREATE === 'true',
+    }),
+  )
+}`
+  },
+  gcs: {
+    key: "gcs",
+    label: "Google Cloud Storage",
+    hint: "needs GCS_BUCKET and service-account credentials",
+    packageName: "@payloadcms/storage-gcs",
+    importName: "gcsStorage",
+    usesRequireEnv: false,
+    envVars: ["GCS_BUCKET", "GCS_PROJECT_ID", "GOOGLE_APPLICATION_CREDENTIALS or GCS_SERVICE_ACCOUNT_KEY"],
+    config: `// Google Cloud Storage. Without GCS_BUCKET uploads stay on local disk (./media).
+if (env.GCS_BUCKET) {
+  plugins.push(
+    gcsStorage({
+      collections: { media: true },
+      bucket: env.GCS_BUCKET,
+      options: {
+        projectId: env.GCS_PROJECT_ID,
+        // Locally, point GOOGLE_APPLICATION_CREDENTIALS at a service-account key file. On hosts
+        // without a filesystem, paste the key's JSON into GCS_SERVICE_ACCOUNT_KEY instead.
+        credentials: env.GCS_SERVICE_ACCOUNT_KEY ? JSON.parse(env.GCS_SERVICE_ACCOUNT_KEY) : undefined,
+      },
+    }),
+  )
+}`
+  },
+  uploadthing: {
+    key: "uploadthing",
+    label: "Uploadthing",
+    hint: "needs UPLOADTHING_TOKEN",
+    packageName: "@payloadcms/storage-uploadthing",
+    importName: "uploadthingStorage",
+    usesRequireEnv: false,
+    envVars: ["UPLOADTHING_TOKEN"],
+    config: `// Uploadthing. Without UPLOADTHING_TOKEN uploads stay on local disk (./media).
+if (env.UPLOADTHING_TOKEN) {
+  plugins.push(
+    uploadthingStorage({
+      collections: { media: true },
+      options: {
+        token: env.UPLOADTHING_TOKEN,
+        acl: 'public-read',
+      },
+    }),
+  )
+}`
+  }
+};
+var STORAGE_ADAPTER_KEYS = Object.keys(STORAGE_CHOICES);
+var STORAGE_KEYS = ["none", ...STORAGE_ADAPTER_KEYS];
+var STORAGE_PACKAGES = [...new Set(Object.values(STORAGE_CHOICES).map((c) => c.packageName))];
+
+// src/args.ts
+function helpText(version2) {
+  return `
+  ${pc.bold("create-payload-stack")} ${pc.dim(`v${version2}`)}
+  Scaffold a SaaS on Payload CMS: Better Auth, organizations, Stripe and a shadcn dashboard.
+
+  ${pc.bold("Usage")}
+    $ npx create-payload-stack@latest [name] [options]
+
+  ${pc.bold("Options")}
+    -n, --name <name>             Project name (also the directory)
+    -d, --db <db>                 ${DB_KEYS.join(" | ")}
+        --db-connection-string    Connection string written to .env
+        --auth <list>             Comma-separated: email-password, magic-link, passkey
+        --social <list>           Comma-separated: google, github
+        --organizations           Enable organizations (teams)
+        --no-organizations        Disable organizations
+        --billing <mode>          organization | user | none
+        --storage <adapter>       ${STORAGE_KEYS.join(" | ")} (none = local disk)
+        --emails                  Edit transactional email copy in the Payload admin
+        --no-emails               Keep emails as React Email components in code
+        --consent                 Cookie banner and audited legal pages (Payload Consent)
+        --no-consent              Plain legal pages, no banner
+        --use-pnpm | --use-npm | --use-yarn | --use-bun
+        --no-install              Skip dependency installation
+        --no-git                  Skip git init
+    -y, --defaults                Accept defaults for every unanswered prompt
+        --branch <ref>            Git branch or tag of the template repo (default: main)
+        --local-template <path>   Scaffold from a local checkout of templates/payload-stack
+        --dry-run                 Print the resolved options and exit
+    -h, --help                    Show this help
+    -v, --version                 Show the version
+
+  ${pc.bold("Examples")}
+    $ npx create-payload-stack@latest ridgeline
+    $ npx create-payload-stack@latest ridgeline -d sqlite --auth email-password,passkey --billing none -y
+    $ npx create-payload-stack@latest ridgeline --storage vercel-blob -y
+
+  Docs: https://payload.solutions/docs/payload-stack
+`;
+}
+function parse(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    allowNegative: true,
+    options: {
+      name: { type: "string", short: "n" },
+      db: { type: "string", short: "d" },
+      "db-connection-string": { type: "string" },
+      auth: { type: "string" },
+      social: { type: "string" },
+      organizations: { type: "boolean" },
+      billing: { type: "string" },
+      storage: { type: "string" },
+      emails: { type: "boolean" },
+      consent: { type: "boolean" },
+      "use-pnpm": { type: "boolean" },
+      "use-npm": { type: "boolean" },
+      "use-yarn": { type: "boolean" },
+      "use-bun": { type: "boolean" },
+      install: { type: "boolean", default: true },
+      git: { type: "boolean", default: true },
+      defaults: { type: "boolean", short: "y", default: false },
+      branch: { type: "string", default: "main" },
+      "local-template": { type: "string" },
+      "dry-run": { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false },
+      version: { type: "boolean", short: "v", default: false }
+    }
+  });
+  const packageManager = values["use-pnpm"] ? "pnpm" : values["use-npm"] ? "npm" : values["use-yarn"] ? "yarn" : values["use-bun"] ? "bun" : void 0;
+  return {
+    flags: {
+      name: values.name,
+      db: values.db,
+      connectionString: values["db-connection-string"],
+      auth: values.auth,
+      social: values.social,
+      organizations: values.organizations,
+      billing: values.billing,
+      storage: values.storage,
+      emails: values.emails,
+      consent: values.consent,
+      packageManager,
+      install: values.install ?? true,
+      git: values.git ?? true,
+      defaults: values.defaults ?? false,
+      branch: values.branch ?? "main",
+      localTemplate: values["local-template"],
+      dryRun: values["dry-run"] ?? false,
+      help: values.help ?? false,
+      version: values.version ?? false
+    },
+    positional: positionals[0]
+  };
+}
+
+// src/cli.ts
+import * as p from "@clack/prompts";
+import { execa as execa2 } from "execa";
+import { existsSync as existsSync5 } from "fs";
+import path6 from "path";
+import pc2 from "picocolors";
+
+// src/configure.ts
+import { readFile, writeFile } from "fs/promises";
+import path4 from "path";
+
+// src/consent.ts
+import { cp, rm as rm2, rmdir } from "fs/promises";
+import { existsSync } from "fs";
+import path2 from "path";
+
+// src/variants.ts
+import { rm } from "fs/promises";
+import path from "path";
+var VARIANT_DIR = "variants";
+function variantPath(step) {
+  return path.join(VARIANT_DIR, step);
+}
+async function removeVariants(directory) {
+  await rm(path.join(directory, VARIANT_DIR), { force: true, recursive: true });
+}
+
+// src/consent.ts
+var CONSENT_PACKAGE = "@payload-solutions/plugin-consent";
+var CONSENT_REACT_PACKAGE = "@payload-solutions/consent-react";
+var CONSENT_VERSION = "0.1.0";
+var CONSENT_PACKAGES = {
+  [CONSENT_PACKAGE]: CONSENT_VERSION,
+  [CONSENT_REACT_PACKAGE]: CONSENT_VERSION
+};
+var VARIANT_CONSENT = variantPath("consent-plugin");
+var SEAM_FILES = [
+  "plugin.ts",
+  "collections.ts",
+  "seed.ts",
+  "consent-root.tsx",
+  "consent-settings-link.tsx",
+  "legal-page.tsx",
+  "legal-setup-notice.tsx"
+];
+var BANNER_FILES = ["consent-banner.tsx", "consent-preferences-dialog.tsx"];
+var TEMPLATE_LEGAL_FILES = ["src/collections/LegalPages.ts", "src/seed/legal.ts", "tests/unit/seed-legal.spec.ts"];
+function swapConsentPackages(packageJson, enabled) {
+  const deps = { ...packageJson.dependencies };
+  const devDeps = { ...packageJson.devDependencies };
+  for (const pkg of Object.keys(CONSENT_PACKAGES)) {
+    delete devDeps[pkg];
+    if (enabled) deps[pkg] = CONSENT_PACKAGES[pkg];
+    else delete deps[pkg];
+  }
+  return { ...packageJson, dependencies: sortKeys(deps), devDependencies: sortKeys(devDeps) };
+}
+function sortKeys(obj) {
+  return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
+}
+async function applyConsentChoice(directory, enabled) {
+  if (!enabled) return;
+  const variant = path2.join(directory, VARIANT_CONSENT);
+  if (!existsSync(variant)) {
+    throw new Error(`The template is missing ${VARIANT_CONSENT}; it cannot scaffold with consent.`);
+  }
+  for (const name of [...SEAM_FILES, ...BANNER_FILES]) {
+    await cp(path2.join(variant, name), path2.join(directory, "src/consent", name), { recursive: true });
+  }
+  await cp(path2.join(variant, "tests/consent.spec.ts"), path2.join(directory, "tests/unit/consent.spec.ts"));
+  for (const name of TEMPLATE_LEGAL_FILES) {
+    await rm2(path2.join(directory, name), { force: true, recursive: true });
+  }
+  await rmdir(path2.join(directory, "src/seed")).catch(() => {
+  });
+}
+
+// src/emails.ts
+import { cp as cp2, rm as rm3 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path3 from "path";
+var EMAILS_PACKAGE = "@payload-solutions/plugin-emails";
+var EMAILS_VERSION = "0.1.0";
+var REACT_EMAIL_COMPONENTS = ["@react-email/components", "^1.0.12"];
+var REACT_EMAIL_ONLY_PACKAGES = {
+  "@react-email/render": "^2.1.0",
+  "react-email": "^6.9.3"
+};
+var EMAIL_DEV_SCRIPT = ["email:dev", "email dev --dir src/components/auth/email --port 3001"];
+var VARIANT_EMAILS = variantPath("emails-plugin");
+var IMPORT_MARKER = "// emails-plugin-import";
+var CONFIG_START = "// emails-plugin-config-start";
+var CONFIG_END = "// emails-plugin-config-end";
+var IMPORTS = `${IMPORT_MARKER}
+import { emailsPlugin } from '${EMAILS_PACKAGE}'
+import { emailDefinitions } from '@/emails/definitions'
+import { StackEmailTemplate } from '@/emails/template'
+import { globalVariableManifest, globalVariables } from '@/emails/variables'`;
+var REGISTRATION = `plugins.push(
+  emailsPlugin({
+    // The catalogue, filtered by the features in stack.config.ts (src/emails/definitions).
+    emails: emailDefinitions,
+    // Branding lives in code; editors own the words (src/emails/template.tsx).
+    templates: { default: StackEmailTemplate },
+    // {{site.name}}, {{support.email}}, {{url.dashboard}} \u2026 in every email (src/emails/variables.ts).
+    globalVariables,
+    globalVariableManifest,
+    // Every send recorded, for 90 days. Set enabled: false to keep no record at all.
+    log: { enabled: true, retentionDays: 90 },
+    settings: { mediaCollection: 'media' },
+  }),
+)`;
+function addEmailsPlugin(payloadConfigSource) {
+  if (!payloadConfigSource.includes(IMPORT_MARKER)) {
+    throw new Error(`payload.config.ts is missing the "${IMPORT_MARKER}" marker`);
+  }
+  const start = payloadConfigSource.indexOf(CONFIG_START);
+  const end = payloadConfigSource.indexOf(CONFIG_END);
+  if (start === -1 || end === -1 || end < start) {
+    throw new Error(`payload.config.ts is missing the emails plugin markers`);
+  }
+  const withImports = payloadConfigSource.replace(IMPORT_MARKER, IMPORTS);
+  const at = withImports.indexOf(CONFIG_START);
+  const to = withImports.indexOf(CONFIG_END);
+  return `${withImports.slice(0, at)}${CONFIG_START}
+${REGISTRATION}
+${withImports.slice(to)}`;
+}
+function swapEmailsPackages(packageJson, enabled) {
+  const deps = { ...packageJson.dependencies };
+  const devDeps = { ...packageJson.devDependencies };
+  const scripts = { ...packageJson.scripts };
+  delete devDeps[EMAILS_PACKAGE];
+  delete devDeps[REACT_EMAIL_COMPONENTS[0]];
+  if (enabled) {
+    deps[EMAILS_PACKAGE] = EMAILS_VERSION;
+    deps[REACT_EMAIL_COMPONENTS[0]] = REACT_EMAIL_COMPONENTS[1];
+    for (const pkg of Object.keys(REACT_EMAIL_ONLY_PACKAGES)) delete deps[pkg];
+    delete scripts[EMAIL_DEV_SCRIPT[0]];
+  } else {
+    delete deps[EMAILS_PACKAGE];
+    delete deps[REACT_EMAIL_COMPONENTS[0]];
+    Object.assign(deps, REACT_EMAIL_ONLY_PACKAGES);
+    scripts[EMAIL_DEV_SCRIPT[0]] = EMAIL_DEV_SCRIPT[1];
+  }
+  return { ...packageJson, dependencies: sortKeys2(deps), devDependencies: sortKeys2(devDeps), scripts: sortKeys2(scripts) };
+}
+function sortKeys2(obj) {
+  return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
+}
+var REACT_EMAIL_FILES = ["src/emails/send.ts", "src/components/auth/email"];
+async function applyEmailsChoice(directory, enabled) {
+  const variant = path3.join(directory, VARIANT_EMAILS);
+  if (enabled) {
+    if (!existsSync2(variant)) {
+      throw new Error(`The template is missing ${VARIANT_EMAILS}; it cannot scaffold with emails.`);
+    }
+    for (const name of ["index.ts", "hooks.ts", "template.tsx", "variables.ts", "definitions"]) {
+      await cp2(path3.join(variant, name), path3.join(directory, "src/emails", name), { recursive: true });
+    }
+    await cp2(path3.join(variant, "tests/emails.spec.ts"), path3.join(directory, "tests/unit/emails.spec.ts"));
+    for (const name of REACT_EMAIL_FILES) {
+      await rm3(path3.join(directory, name), { force: true, recursive: true });
+    }
+  }
+}
+
 // src/utils.ts
 import slugifyBase from "@sindresorhus/slugify";
 import { randomBytes } from "crypto";
-import { existsSync, readdirSync } from "fs";
+import { existsSync as existsSync3, readdirSync } from "fs";
 import { execa } from "execa";
 function slugify(input) {
   return slugifyBase(input.trim()).replace(/^-+|-+$/g, "") || "my-saas";
@@ -88,7 +507,7 @@ function generateSecret(bytes = 32) {
   return randomBytes(bytes).toString("base64url");
 }
 function isDirectoryEmpty(dir) {
-  if (!existsSync(dir)) return true;
+  if (!existsSync3(dir)) return true;
   const entries = readdirSync(dir).filter((e) => ![".git", ".DS_Store"].includes(e));
   return entries.length === 0;
 }
@@ -153,6 +572,18 @@ function renderStackConfig(o) {
       },
     ],
   },`;
+  const legalBlock = o.consent ? `  legal: {
+    company: '${o.name.replace(/'/g, "\\'")} Ltd',
+    jurisdiction: 'Ireland',
+    // The seeded legal pages are written from here. Fill these in before you publish them:
+    // \`npx payload-consent scan\` lists every value still left as a placeholder.
+    // https://payload.solutions/docs/plugins/payload-consent/audit
+    legalName: '${o.name.replace(/'/g, "\\'")} Ltd',
+    address: '[REGISTERED ADDRESS]',
+  },` : `  legal: {
+    company: '${o.name.replace(/'/g, "\\'")} Ltd',
+    jurisdiction: 'Ireland',
+  },`;
   return `import { defineStack } from '@/lib/stack'
 
 /**
@@ -190,38 +621,86 @@ export default defineStack({
 
 ${billingBlock}
 
-  legal: {
-    company: '${o.name.replace(/'/g, "\\'")} Ltd',
-    jurisdiction: 'Ireland',
+  observability: {
+    tracesSampleRate: 0.1,
+    sendPII: false,
   },
 
+${legalBlock}
+
   nav: [${o.billing !== "none" ? "{ label: 'Pricing', href: '/pricing' }, " : ""}{ label: 'Docs', href: 'https://payload.solutions/docs/payload-stack' }],
 
   social: {},
 })
 `;
 }
-var IMPORT_MARKER = "// database-adapter-import";
-var CONFIG_START = "// database-adapter-config-start";
-var CONFIG_END = "// database-adapter-config-end";
+var IMPORT_MARKER2 = "// database-adapter-import";
+var CONFIG_START2 = "// database-adapter-config-start";
+var CONFIG_END2 = "// database-adapter-config-end";
 function swapDatabaseAdapter(payloadConfigSource, db) {
-  const importLine = `${IMPORT_MARKER}
+  const importLine = `${IMPORT_MARKER2}
 import { ${db.importName} } from '${db.packageName}'`;
   const withImport = payloadConfigSource.replace(
-    new RegExp(`${escapeRegExp(IMPORT_MARKER)}\\nimport [^\\n]+\\n`),
+    new RegExp(`${escapeRegExp(IMPORT_MARKER2)}\\nimport [^\\n]+\\n`),
     `${importLine}
 `
   );
   if (withImport === payloadConfigSource && !payloadConfigSource.includes(importLine)) {
-    throw new Error(`payload.config.ts is missing the "${IMPORT_MARKER}" marker`);
+    throw new Error(`payload.config.ts is missing the "${IMPORT_MARKER2}" marker`);
   }
-  const start = withImport.indexOf(CONFIG_START);
-  const end = withImport.indexOf(CONFIG_END);
+  const start = withImport.indexOf(CONFIG_START2);
+  const end = withImport.indexOf(CONFIG_END2);
   if (start === -1 || end === -1) throw new Error(`payload.config.ts is missing the database adapter markers`);
-  return `${withImport.slice(0, start)}${CONFIG_START}
+  return `${withImport.slice(0, start)}${CONFIG_START2}
   ${db.config}
   ${withImport.slice(end)}`;
 }
+var STORAGE_IMPORT_MARKER = "// storage-adapter-import";
+var STORAGE_CONFIG_START = "// storage-adapter-config-start";
+var STORAGE_CONFIG_END = "// storage-adapter-config-end";
+var ENV_IMPORT = /^import \{ ([^}]*) \} from '@\/lib\/env'$/m;
+function swapStorageAdapter(payloadConfigSource, storage) {
+  const importPattern = new RegExp(
+    `${escapeRegExp(STORAGE_IMPORT_MARKER)}
+(?:import \\{ \\w+ \\} from '@payloadcms\\/storage-[a-z0-9-]+'
+)?`
+  );
+  if (!importPattern.test(payloadConfigSource)) {
+    throw new Error(`payload.config.ts is missing the "${STORAGE_IMPORT_MARKER}" marker`);
+  }
+  const importLines = storage ? `${STORAGE_IMPORT_MARKER}
+import { ${storage.importName} } from '${storage.packageName}'
+` : `${STORAGE_IMPORT_MARKER}
+`;
+  let out = payloadConfigSource.replace(importPattern, importLines);
+  const envImport = ENV_IMPORT.exec(out);
+  if (!envImport) throw new Error(`payload.config.ts is missing the "@/lib/env" import`);
+  const names = envImport[1].split(",").map((name) => name.trim()).filter((name) => name && name !== "requireEnv");
+  if (storage?.usesRequireEnv) {
+    const at = names.findIndex((name) => name > "requireEnv");
+    names.splice(at === -1 ? names.length : at, 0, "requireEnv");
+  }
+  out = out.replace(ENV_IMPORT, `import { ${names.join(", ")} } from '@/lib/env'`);
+  const start = out.indexOf(STORAGE_CONFIG_START);
+  const end = out.indexOf(STORAGE_CONFIG_END);
+  if (start === -1 || end === -1 || end < start) throw new Error(`payload.config.ts is missing the storage adapter markers`);
+  const body = storage ? storage.config : LOCAL_STORAGE_CONFIG;
+  return `${out.slice(0, start)}${STORAGE_CONFIG_START}
+${body}
+${out.slice(end)}`;
+}
+function swapStoragePackage(packageJson, storage) {
+  const deps = { ...packageJson.dependencies };
+  const payloadVersion = deps.payload ?? "latest";
+  for (const pkg of STORAGE_PACKAGES) {
+    if (pkg !== storage?.packageName) delete deps[pkg];
+  }
+  if (storage) deps[storage.packageName] = payloadVersion;
+  return { ...packageJson, dependencies: sortKeys3(deps) };
+}
+function storageChoice(key) {
+  return key === "none" ? null : STORAGE_CHOICES[key];
+}
 function swapDatabasePackage(packageJson, db) {
   const deps = { ...packageJson.dependencies };
   const payloadVersion = deps.payload ?? "latest";
@@ -229,7 +708,16 @@ function swapDatabasePackage(packageJson, db) {
     if (other.packageName !== db.packageName) delete deps[other.packageName];
   }
   deps[db.packageName] = payloadVersion;
-  return { ...packageJson, dependencies: sortKeys(deps) };
+  return { ...packageJson, dependencies: sortKeys3(deps) };
+}
+function stripWorkspaceDependencies(packageJson) {
+  const next = { ...packageJson };
+  for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
+    const deps = next[field];
+    if (!deps) continue;
+    next[field] = Object.fromEntries(Object.entries(deps).filter(([, version2]) => !version2.startsWith("workspace:")));
+  }
+  return next;
 }
 function renameProject(packageJson, slug) {
   const next = { ...packageJson, name: slug, version: "0.1.0", private: true };
@@ -254,7 +742,7 @@ function renderEnv(example, o) {
   });
   return lines.join("\n");
 }
-function sortKeys(obj) {
+function sortKeys3(obj) {
   return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
 }
 function escapeRegExp(s) {
@@ -262,13 +750,25 @@ function escapeRegExp(s) {
 }
 async function configureProject(o) {
   const db = DB_CHOICES[o.db];
-  const read = (rel) => readFile(path.join(o.directory, rel), "utf8");
-  const write = (rel, content) => writeFile(path.join(o.directory, rel), content);
+  const read = (rel) => readFile(path4.join(o.directory, rel), "utf8");
+  const write = (rel, content) => writeFile(path4.join(o.directory, rel), content);
   await write("src/stack.config.ts", renderStackConfig(o));
+  const storage = storageChoice(o.storage);
   const payloadConfig = await read("src/payload.config.ts");
-  await write("src/payload.config.ts", swapDatabaseAdapter(payloadConfig, db));
+  const withAdapters = swapStorageAdapter(swapDatabaseAdapter(payloadConfig, db), storage);
+  await write("src/payload.config.ts", o.emails ? addEmailsPlugin(withAdapters) : withAdapters);
+  await applyEmailsChoice(o.directory, o.emails);
+  await applyConsentChoice(o.directory, o.consent);
+  await removeVariants(o.directory);
   const pkg = JSON.parse(await read("package.json"));
-  await write("package.json", JSON.stringify(renameProject(swapDatabasePackage(pkg, db), o.slug), null, 2) + "\n");
+  const configured = swapConsentPackages(
+    swapEmailsPackages(swapStoragePackage(swapDatabasePackage(pkg, db), storage), o.emails),
+    o.consent
+  );
+  await write(
+    "package.json",
+    JSON.stringify(renameProject(stripWorkspaceDependencies(configured), o.slug), null, 2) + "\n"
+  );
   const example = await read(".env.example");
   await write(".env", renderEnv(example, { connectionString: o.connectionString }));
 }
@@ -278,9 +778,9 @@ var AUTH_METHODS = ["email-password", "magic-link", "passkey"];
 var SOCIAL_PROVIDERS = ["google", "github"];
 
 // src/template.ts
-import { cp, mkdir, rm } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
+import { cp as cp3, mkdir, rm as rm4 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import path5 from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 import * as tar from "tar";
@@ -308,29 +808,30 @@ Check your network, or pass --local-template <path> to scaffold from a local che
       }
     })
   );
-  if (!existsSync2(path2.join(dest, "package.json"))) {
+  if (!existsSync4(path5.join(dest, "package.json"))) {
     throw new Error(`The downloaded archive did not contain ${TEMPLATE_PATH}/package.json (branch "${branch}").`);
   }
 }
 async function copyLocalTemplate({ from, dest }) {
-  const source = path2.resolve(from);
-  if (!existsSync2(path2.join(source, "package.json"))) {
+  const source = path5.resolve(from);
+  if (!existsSync4(path5.join(source, "package.json"))) {
     throw new Error(`--local-template must point at a directory containing package.json (got ${source})`);
   }
   await mkdir(dest, { recursive: true });
-  await cp(source, dest, {
+  await cp3(source, dest, {
     recursive: true,
     filter: (src) => {
-      const rel = path2.relative(source, src);
-      const top = rel.split(path2.sep)[0];
+      const rel = path5.relative(source, src);
+      const top = rel.split(path5.sep)[0];
       return !["node_modules", ".next", ".turbo", ".env", "test-results", "playwright-report", "next-env.d.ts", "tsconfig.tsbuildinfo", "CLAUDE.md"].includes(top ?? "");
     }
   });
-  await rm(path2.join(dest, "CLAUDE.md"), { force: true });
+  await rm4(path5.join(dest, "CLAUDE.md"), { force: true });
 }
 
 // src/cli.ts
 var DOCS = "https://payload.solutions/docs/payload-stack";
+var CONSENT_DOCS = "https://payload.solutions/docs/plugins/payload-consent/audit";
 function bail(message = "Cancelled.") {
   p.cancel(message);
   process.exit(1);
@@ -347,9 +848,13 @@ function parseList(raw, allowed, flag) {
   }
   return items;
 }
+function listWords(items) {
+  if (items.length <= 1) return items.join("");
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
 async function run(flags, positionalName) {
   console.log();
-  p.intro(pc.bgWhite(pc.black(" create-payload-stack ")));
+  p.intro(pc2.bgWhite(pc2.black(" create-payload-stack ")));
   const providedName = flags.name ?? positionalName;
   const name = flags.defaults && !providedName ? "my-saas" : providedName ?? guard(
     await p.text({
@@ -360,7 +865,7 @@ async function run(flags, positionalName) {
     })
   );
   const slug = slugify(name);
-  const directory = path3.resolve(process.cwd(), slug);
+  const directory = path6.resolve(process.cwd(), slug);
   if (!isDirectoryEmpty(directory)) {
     bail(`Directory ./${slug} already exists and is not empty.`);
   }
@@ -433,6 +938,34 @@ async function run(flags, positionalName) {
       })
     );
   }
+  const storageFlag = flags.storage;
+  if (storageFlag && !STORAGE_KEYS.includes(storageFlag)) bail(`Unknown value "${storageFlag}" for --storage. Allowed: ${STORAGE_KEYS.join(", ")}`);
+  const storage = storageFlag ?? (flags.defaults ? "none" : guard(
+    await p.select({
+      message: "Media storage",
+      initialValue: "none",
+      options: [
+        { value: "none", label: "Skip for now", hint: "uploads go to ./media on local disk; add an adapter any time" },
+        ...STORAGE_ADAPTER_KEYS.map((key) => ({ value: key, label: STORAGE_CHOICES[key].label, hint: STORAGE_CHOICES[key].hint }))
+      ]
+    })
+  ));
+  const emails = flags.emails ?? (flags.defaults ? true : guard(
+    await p.confirm({
+      message: "Transactional emails",
+      initialValue: true,
+      active: "Editable in the admin (Payload Emails)",
+      inactive: "React Email components in code"
+    })
+  ));
+  const consent = flags.consent ?? (flags.defaults ? true : guard(
+    await p.confirm({
+      message: "Cookie consent and legal pages",
+      initialValue: true,
+      active: "Banner, consent records and audited legal pages (Payload Consent)",
+      inactive: "Plain legal pages, no banner"
+    })
+  ));
   const packageManager = flags.packageManager ?? await detectPackageManager();
   const options = {
     name,
@@ -444,6 +977,9 @@ async function run(flags, positionalName) {
     social,
     organizations,
     billing,
+    storage,
+    emails,
+    consent,
     packageManager,
     install: flags.install,
     git: flags.git
@@ -475,11 +1011,11 @@ async function run(flags, positionalName) {
       s2.stop(`Installed dependencies with ${packageManager}`);
     } catch (error) {
       s2.stop("Dependency installation failed");
-      p.log.warn(`Run ${pc.cyan(installCommand(packageManager))} inside ./${slug} to retry.
+      p.log.warn(`Run ${pc2.cyan(installCommand(packageManager))} inside ./${slug} to retry.
 ${error instanceof Error ? error.message.split("\n")[0] : ""}`);
     }
   }
-  if (options.git && !existsSync3(path3.join(directory, ".git"))) {
+  if (options.git && !existsSync5(path6.join(directory, ".git"))) {
     try {
       await execa2("git", ["init", "-b", "main"], { cwd: directory });
       await execa2("git", ["add", "-A"], { cwd: directory });
@@ -494,109 +1030,33 @@ ${error instanceof Error ? error.message.split("\n")[0] : ""}`);
     ...db === "sqlite" ? [] : ["# start your database, then check DATABASE_URL in .env"],
     ...social.length ? [`# add ${social.map((sp) => `${sp.toUpperCase()}_CLIENT_ID / _SECRET`).join(" and ")} to .env`] : [],
     ...billing !== "none" ? ["# add STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET and NEXT_PUBLIC_STRIPE_PRICE_* to .env when you are ready for billing"] : [],
+    ...storage !== "none" ? [`# add ${listWords(STORAGE_CHOICES[storage].envVars)} to .env to store uploads in ${STORAGE_CHOICES[storage].label} (local disk until then)`] : [],
     runCommand(packageManager, "dev"),
-    "open http://localhost:3000/admin"
+    "open http://localhost:3000/admin",
+    ...emails ? ["# email copy is under Emails in the admin; the design is src/emails/template.tsx"] : [],
+    ...consent ? [
+      "# the seeded legal pages are templates, not policy: the homepage shows the six steps in development",
+      `# ${CONSENT_DOCS}`
+    ] : []
   ];
   p.note(steps.join("\n"), "Done. Next steps:");
-  p.outro(`Docs: ${pc.underline(DOCS)}`);
+  p.outro(`Docs: ${pc2.underline(DOCS)}`);
 }
 
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
-var HELP = `
-  ${pc2.bold("create-payload-stack")} ${pc2.dim(`v${version}`)}
-  Scaffold a SaaS on Payload CMS: Better Auth, organizations, Stripe and a shadcn dashboard.
-
-  ${pc2.bold("Usage")}
-    $ npx create-payload-stack@latest [name] [options]
-
-  ${pc2.bold("Options")}
-    -n, --name <name>             Project name (also the directory)
-    -d, --db <db>                 ${DB_KEYS.join(" | ")}
-        --db-connection-string    Connection string written to .env
-        --auth <list>             Comma-separated: email-password, magic-link, passkey
-        --social <list>           Comma-separated: google, github
-        --organizations           Enable organizations (teams)
-        --no-organizations        Disable organizations
-        --billing <mode>          organization | user | none
-        --use-pnpm | --use-npm | --use-yarn | --use-bun
-        --no-install              Skip dependency installation
-        --no-git                  Skip git init
-    -y, --defaults                Accept defaults for every unanswered prompt
-        --branch <ref>            Git branch or tag of the template repo (default: main)
-        --local-template <path>   Scaffold from a local checkout of templates/payload-stack
-        --dry-run                 Print the resolved options and exit
-    -h, --help                    Show this help
-    -v, --version                 Show the version
-
-  ${pc2.bold("Examples")}
-    $ npx create-payload-stack@latest ridgeline
-    $ npx create-payload-stack@latest ridgeline -d sqlite --auth email-password,passkey --billing none -y
-
-  Docs: https://payload.solutions/docs/payload-stack
-`;
-function parse(argv) {
-  const { values, positionals } = parseArgs({
-    args: argv,
-    allowPositionals: true,
-    allowNegative: true,
-    options: {
-      name: { type: "string", short: "n" },
-      db: { type: "string", short: "d" },
-      "db-connection-string": { type: "string" },
-      auth: { type: "string" },
-      social: { type: "string" },
-      organizations: { type: "boolean" },
-      billing: { type: "string" },
-      "use-pnpm": { type: "boolean" },
-      "use-npm": { type: "boolean" },
-      "use-yarn": { type: "boolean" },
-      "use-bun": { type: "boolean" },
-      install: { type: "boolean", default: true },
-      git: { type: "boolean", default: true },
-      defaults: { type: "boolean", short: "y", default: false },
-      branch: { type: "string", default: "main" },
-      "local-template": { type: "string" },
-      "dry-run": { type: "boolean", default: false },
-      help: { type: "boolean", short: "h", default: false },
-      version: { type: "boolean", short: "v", default: false }
-    }
-  });
-  const packageManager = values["use-pnpm"] ? "pnpm" : values["use-npm"] ? "npm" : values["use-yarn"] ? "yarn" : values["use-bun"] ? "bun" : void 0;
-  return {
-    flags: {
-      name: values.name,
-      db: values.db,
-      connectionString: values["db-connection-string"],
-      auth: values.auth,
-      social: values.social,
-      organizations: values.organizations,
-      billing: values.billing,
-      packageManager,
-      install: values.install ?? true,
-      git: values.git ?? true,
-      defaults: values.defaults ?? false,
-      branch: values.branch ?? "main",
-      localTemplate: values["local-template"],
-      dryRun: values["dry-run"] ?? false,
-      help: values.help ?? false,
-      version: values.version ?? false
-    },
-    positional: positionals[0]
-  };
-}
 async function main() {
   let parsed;
   try {
     parsed = parse(process.argv.slice(2));
   } catch (error) {
-    console.error(pc2.red(error instanceof Error ? error.message : String(error)));
-    console.log(HELP);
+    console.error(pc3.red(error instanceof Error ? error.message : String(error)));
+    console.log(helpText(version));
     process.exit(1);
   }
   if (parsed.flags.help) {
-    console.log(HELP);
+    console.log(helpText(version));
     return;
   }
   if (parsed.flags.version) {
@@ -606,6 +1066,6 @@ async function main() {
   await run(parsed.flags, parsed.positional);
 }
 main().catch((error) => {
-  console.error(pc2.red(error instanceof Error ? error.stack ?? error.message : String(error)));
+  console.error(pc3.red(error instanceof Error ? error.stack ?? error.message : String(error)));
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-payload-stack",
-  "version": "0.1.1",
+  "version": "0.4.0",
   "description": "Scaffold a SaaS on Payload CMS: Better Auth, organizations, Stripe subscriptions and a shadcn dashboard, in one command.",
   "keywords": [
     "payload",
@@ -33,14 +33,6 @@
   "engines": {
     "node": ">=20.9.0"
   },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "clean": "rm -rf dist .turbo",
-    "prepublishOnly": "pnpm build"
-  },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@sindresorhus/slugify": "^3.0.1",
@@ -53,5 +45,13 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "pnpm build && vitest run",
+    "clean": "rm -rf dist .turbo",
+    "test:unit": "vitest run --exclude test/scaffold.test.ts"
   }
-}
+}