Extend a Payload backend with @awl plugins

Starting point: A Payload CMS v3 project with payload.config.ts and access to the @awl registry. Goal: The required @awl/payload-* packages are registered, and a scan of the access rules has run.

1. Pick and register a package with payload-plugins. The skill reads the project, checks registry access, installs the package, adds transpilePackages in next.config.js and registers it in payload.config.ts.

   Tell ClaudeCopy

   Add payload oidc and payload access policies to this backend.

2. Sort out how they interact before access rules depend on req.user. payload-plugins knows the order, for example: write role rules only against fields the OIDC login actually fills.

3. Check the access rules with payload-security-scan. The skill looks for missing or overly open access functions, unprotected endpoints and hooks that leak data.

   Tell ClaudeCopy

   Review payload security for all collections.

When something goes wrong

• The dev server reports “module not found” for an @awl/* package → the transpilePackages entry is missing, see payload-plugins
• placeholderFeature() fails at runtime without an error message → the import map is stale, run payload generate:importmap, see payload-plugins
• The frontend is a SvelteKit app without Payload → sveltekit-app-setup