Structured content. Connected commerce. Defined interfaces.

Architecture

The foundation separates a Payload CMS from a Next.js frontend. Content schemas are maintained in code; APIs connect content and commerce data to the customer-facing experience.

Pages, posts, media, forms and reusable blocks sit alongside site-level settings. Preview helpers and a frontend revalidation endpoint connect editorial changes to the rendered experience.

Commerce boundaries

Source includes product and variant models, inventory, guest-cart endpoints, shipping and tax structures, and manual and Stripe checkout handlers. Live payments, webhooks, fulfilment, refunds and production operating controls require configuration and end-to-end validation.

Site scope and localisation

Site-scoping configuration and English/German localisation patterns exist in source. A particular multi-site deployment still needs its own content ownership, permissions, routing and isolation review.

Permission-controlled content tools

The CMS includes authenticated Model Context Protocol (MCP) tooling for content-management agents. Scoped API keys and the linked user's access rules control content, catalogue, media and site-configuration operations. Publishing pages, posts, products and variants requires separate publishing permissions; editing a draft does not automatically authorise publication.

Commerce tooling separates catalogue and configuration changes from operational records. Customers, carts, orders, transactions and addresses are read-only through MCP. Checkout mutations, payment initiation, secrets, webhooks and order finalisation stay with server-owned workflows. Tenant discovery is read-only; tenant changes and delete operations are excluded from this tooling.

Media creation is permission-controlled and limited to new image assets with alternative text. Existing file replacement and deletion remain outside the MCP surface. The available tools need a deliberate permission and environment review for each implementation. This is a capability of the foundation's CMS; this marketing website exposes no MCP endpoint.

Integration and extension

ERP, PIM, CRM, identity, analytics and fulfilment connections are assessed per implementation. These are possible extension areas, not a catalogue of verified ready-made connectors.

Operations and release readiness

Publishing access, deployment, revalidation, payment configuration and monitoring responsibilities need to be defined for the implementation. Source inspection alone does not validate runtime behaviour.

Customer account history and a full account portal are not represented as completed capabilities. Personalisation, CDP and experimentation are not included in the verified scope described here.

Evaluation and ownership

Source access, reusable foundation rights, third-party licences and project-specific deliverables are distinct. A project agreement must define these alongside hosting, support and handover responsibilities.

Based on repository source reviewed on 15 November 2026. Product runtime tests, security assurance and production deployment were outside that review.