cli(feat): add safe opt-in demo seed scripts

[Ducksss]

Summary

• Add strict payload-components seed <component> [--cwd <path>] and payload-components add <component> [--cwd <path>] [--demo] interfaces.
• Generate payload-components/seed-<component>.ts only after rejecting unknown flags, extra arguments, unsupported components/targets, recorded partial installs, missing files, and missing Payload fragments.
• Keep database access outside the distribution CLI: generation only writes reviewable source, and the operator explicitly runs it through the project's Payload CLI.
• Require a drafts-enabled Pages collection; create or update only the exact generated draft Page and never publish implicitly.
• Atomically replace only version-marked owned scripts while refusing path escapes, symlinks, non-files, and unrelated existing files.
• Reuse exact marker-owned placeholder media, clean duplicates only after a successful Page write, and propagate every mutation failure.
• Document the CLI/database boundary, install flow, first-block workflow, and consumer registry contract.

Why

Demo content is useful only if it cannot silently publish, overwrite consumer files, or mutate unrelated Payload documents. This design keeps elevated Local API access visible in an explicit operator-run script while preserving the CLI's existing dependency and trust boundary.

Security contract

• Seed generation performs no network or database operations and adds no runtime dependencies.
• --demo runs only after all five install stages and installed-state recording succeed.
• Recorded partial installs fail closed even when copied files and fragments happen to exist.
• The generated Page is owned by exact slug, title, first-block marker, and block type; conflicts abort before mutation.
• Placeholder media is selected only by its exact component marker and is deleted only after the Page write succeeds.
• overrideAccess: true exists only in the explicit operator-run script, with the existing revalidation-safe context.
• No registry item, manifest schema, site runtime, Payload collection, secret, telemetry, migration, or component-source changes are included.

Verification

• npx pnpm@10 lint
• npx pnpm@10 source:build
• npx pnpm@10 exec tsc --noEmit
• npx pnpm@10 run test:int — 111 passed, 1 skipped
• npx pnpm@10 run test:pack — packed CLI, dependency boundary, and add --demo passed
• Focused seed/security coverage — parsing, partial installs, containment, symlinks, atomic reruns, drafts, conflicts, two runtime executions, media cleanup, and failure recovery
• Focused browser gate — 14/14 accessibility and Geo tests passed
• Production build — TypeScript plus 275/275 static pages
• npx pnpm@10 run test:fresh -- --components hero-basic — real Payload 3.85.2 install, seed, build, route, and Playwright assertion passed
• Full test:fresh reached all 31 direct installs and all 31 CLI installs; final schema initialization is blocked by the unchanged pre-existing 64-character pricing-enterprise identifier (Payload/Drizzle maximum: 63)
• CodeQL 2.26.0 security-and-quality — 333 JS/TS and 3 Actions files scanned; no diff-scoped findings
• CodeRabbit review on descriptor-hardened head — 0 issues
• Diff-scoped security review — no reportable findings; native UI setup expired without starting
• Vercel deployments
• Final GitHub release gate on this head

Scope note

The original incomplete admin-field-hints sweep was removed. This PR now contains demo seeding, its tests, its smoke-harness reuse, and its documentation only.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
payload-components	Ready	Preview, Comment	Jul 10, 2026 5:01pm
payload-components-97bf	Ready	Preview, Comment	Jul 10, 2026 5:01pm

[Ducksss]

Retargeted to dev, which is the integration branch. This still needs rebase/conflict resolution before review because GitHub reports merge conflicts.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.