Open-Source CMS Bakeoff — Basketball-Team Site (Next.js on Vercel, multi-user auth, client handover)

Author: hermes • Date: 2026-07-15 • Tier: T-deep (decision-grade — repeatable agency offering; every load-bearing claim verified against a primary source) Sources: sources/T1-payload.md · sources/T2-directus.md · sources/T3-strapi.md · sources/T4-vercel-db-handover.md Supersedes for THIS constraint: the fleet's prior Directus pick (that was for the fleet's own self-hosted media/authoring stack — a different constraint; see §6).

TL;DR

Winner: Payload CMS v3. It is the only option that runs inside your Next.js app and deploys as one Vercel project (admin + API + frontend in the same build). MIT-licensed, native multi-user auth, relational content modeling. — Payload deploy docs, LICENSE.md
Directus and Strapi are NOT Vercel-deployable. Both are stateful always-on backends — they need a separate host (Directus Cloud/Railway/VPS, Strapi Node host) plus DB plus storage. That's 3-4 things to hand the client, not one. Their content/auth capabilities are fine; the deployment shape is the disqualifier for your Vercel-handover goal.
License is NOT the differentiator — all three are handover-safe. Payload = MIT. Strapi = MIT (outside the ee/ enterprise dir). Directus = new MSCL-1.0 (as of 2026-04-22, no longer the old BSL) whose grant explicitly permits agency "professional services to deploy or host the Software for the licensee." My pre-verification worry about a Directus revenue gate was outdated — corrected by reading the actual license.
The real cost/handover reality is the same for any DB-backed CMS on Vercel: Vercel's filesystem is ephemeral → external media storage is mandatory day one; serverless functions exhaust Postgres connections → you must use a pooled connection string. Realistic floor the client inherits: ~$0–10/mo (light Neon) rising to ~$20–35/mo once you want Pro/backups. — Neon connection pooling
⚠ Handover gotcha (any choice): provision the database DIRECTLY at the provider, NOT through the Vercel Marketplace integration. Neon blocks transferring a project that has a Vercel/GitHub integration installed — that would strand the DB you're trying to hand over. — Neon: Transfer projects
Recommended stack: Payload v3 + Neon Postgres (provisioned directly, pooled -pooler string, @payloadcms/db-vercel-postgres) + Cloudflare R2 or Vercel Blob for media, all on Vercel. One deploy target, MIT, cleanest handover.

Scorecard (your 5 criteria)

Criterion	Payload v3	Directus	Strapi v5
1. Vercel-native deploy (one project)	✅ Yes — runs in Next.js, official Vercel template	❌ No — separate always-on Docker host	❌ No — separate always-on Node host
2. Auth + RBAC	✅ Native auth; roles = custom `role` field + access fns (dev sets up)	✅ Native, policy-based additive permissions	✅ Native admin + Users-Permissions; custom roles + field-level (free since v4.8)
3. Relational team data (roster/schedule/stats)	✅ Collections + Relationship/Join/Array fields	✅ Real SQL tables + Knex FK relations	✅ Content-Types Builder + relations
4. License for resale/handover	✅ MIT (verified; Figma acquisition preserved OSS + self-host)	✅ MSCL-1.0 — agency-services clause on-point; core grant not revenue-gated	✅ MIT outside `ee/`
5. What the client inherits	Vercel + DB + storage + email (multi-vendor, but 1 deploy)	Vercel + Directus host + DB + storage (4 parts)	Vercel + Strapi host + DB + storage (3-4 parts)
Fit verdict	STRONG	OK (wrong shape)	OK (wrong shape)

Why Payload wins for this specific goal

Your goal has one hard architectural filter: "deploy through Vercel and hand over the whole project." Vercel is a serverless frontend host — no persistent process. A CMS is either (a) code that runs inside the Next app (serverless-compatible), or (b) a separate always-on server.

Payload is (a). npx create-payload-app / install-into-Next means the admin panel and REST/GraphQL API are Next.js routes. git push → Vercel builds everything. Handover = transfer one Vercel project + the DB + a storage bucket. — Payload 3.0 blog
Directus and Strapi are (b). Directus maintainers explicitly say it "relies on features unavailable in serverless runtimes: persistent connections, local filesystem, persistent memory" (discussion #15572). Strapi's own docs route the backend to a dedicated host, Next-only to Vercel (docs.strapi.io/cms/deployment). Choosing either means standing up + billing + eventually transferring a second production server. For a basketball team that's ongoing cost and an ops surface they'll struggle to own.

RBAC note for Payload (only real setup cost): Payload has no turnkey "roles" dropdown — you add a role field to the Users collection and write access-control functions (e.g. admin can delete, contributor can only author). Standard Payload practice, ~an afternoon, fully covers coach/admin/player-contributor tiers. — Access Control docs

The infra reality every option shares (T4) — build this right or handover breaks

Media storage is mandatory, day one. Vercel's filesystem is read-only/ephemeral — uploaded images vanish. Wire Cloudflare R2 (cheapest, no egress fees) or Vercel Blob (native, ~$0.023/GB-mo) before launch. — Vercel Blob pricing
Postgres connection pooling is mandatory. Serverless functions each open their own DB connection and blow past Postgres's ceiling under trivial load. Fix: Neon's PgBouncer pooled endpoint — add -pooler to the connection hostname. Not optional. — Neon pooling
"Vercel Postgres" no longer exists — Vercel moved it to a native Neon Marketplace integration (Q4 2024–Q1 2025). Any guide citing "Vercel Postgres $20/mo" is STALE. — Neon transition guide
⚠ Provision the DB directly at Neon, NOT via the Vercel Marketplace. Neon cannot transfer a project that has the Vercel integration installed, and transfers must target an organization (not a personal account). Provision direct + connect via env var, and DB handover stays clean. — Neon transfer

Realistic monthly cost the client inherits (light-traffic team site)

Piece	Provider	Floor	Notes
Hosting	Vercel	$0 (Hobby) → $20/mo (Pro)	Pro needed for commercial/SLA
Database	Neon (direct)	~$0–10/mo	free tier plausibly enough; autosuspends when idle
Media	Cloudflare R2 / Vercel Blob	~$0–5/mo	R2 = no egress fees
Email (optional)	Resend/Postmark	$0–20/mo	for auth/notify emails
Total		~$0–15/mo light → ~$25–45/mo with Pro+backups	multi-vendor, disclose at handover

Recommendation

Build it on Payload v3 + Neon Postgres (direct) + Cloudflare R2, all deployed to Vercel.

Use the Postgres adapter (@payloadcms/db-vercel-postgres), not MongoDB — a MongoDB-adapter serverless connection-pool bug on Vercel was live as recently as Nov 2025 (#14547, since fixed). Postgres/Neon is the proven serverless path. — Neon × Payload guide
Provision Neon directly (not Marketplace) so the DB transfers cleanly at handover.
Define role field + access functions for the team's auth tiers during build.
At handover: transfer the Vercel project (docs), transfer the Neon project to a client-owned Neon org, move the R2 bucket, hand over env vars + domain. Disclose the multi-vendor bill up front.

Directus is not "wrong" — it's wrong-shape for THIS constraint. If the fleet later wants a self-hosted authoring backend it controls (not client-handover, not Vercel), Directus/MSCL remains a fine pick. The two decisions don't conflict.

§6 — Relationship to the prior fleet Directus decision

The earlier Directus pick was scoped to the fleet's own media/authoring stack (self-hosted, R2 + Bunny CDN, fleet controls the infra). That constraint has no "must run on Vercel" and no "hand to a third party" requirement, so Directus's always-on-backend shape is fine there. This report does not overturn that — it answers a different question (client site, Vercel, handover) where the Vercel-native property is decisive. Keep the two scoped separately.

Confidence + provenance

Every license read from the actual LICENSE file in each repo (fetched 2026-07-15), not from secondary summaries.
Deployment claims cross-checked: official CMS docs + provider docs + (for Directus/Strapi non-Vercel) maintainer statements.
Cost/DB claims sourced to Neon/Vercel/Supabase primary docs, dated; the defunct "Vercel Postgres" product flagged STALE.
One item flagged unknown (not guessed): exact Prisma Accelerate pricing tiers — not needed for the recommendation.