@payloadcms/figma 0.0.1-alpha.30 → 0.0.1-alpha.32

package/dist/db-content-api/utilities/{data.js → data/index.js}

@@ -1,12 +1,17 @@
-import { traverseFields } from 'payload';
+import { flattenAllFields, traverseFields } from 'payload';
+import { applyDefaults } from './applyDefaults.js';
+import { castFieldValue } from './castFieldValue.js';
+import { stripFields } from './stripFields.js';
 /**
  * Transform data before sending to Content API (WRITE operations)
  *
  * Conversions applied:
+ * - Default values: Apply static defaults for undefined fields (when applyDefaults=true)
+ * - Type casting: Convert values to match field types (e.g., number -> string for text fields)
  * - RichText fields: Objects -> JSON strings
  *
  * Note: Date fields are automatically converted to ISO strings by JSON.stringify()
- */ export function dataToContentAPI(payload, collectionSlug, data) {
+ */ export function dataToContentAPI(payload, collectionSlug, data, options) {
     if (!data || typeof data !== 'object') {
         return data;
     }
@@ -19,7 +24,12 @@ import { traverseFields } from 'payload';
     if (!collectionConfig?.fields) {
         return transformed;
     }
-    // Use Payload's traverseFields to iterate over all fields
+    // Apply static defaults recursively to handle nested structures (arrays, groups)
+    // This must happen before traverseFields to ensure defaults are in place
+    if (options?.applyDefaults) {
+        applyDefaults(transformed, collectionConfig.fields);
+    }
+    // Use Payload's traverseFields to iterate over all fields for transformations
     const callback = ({ field, ref })=>{
         if (!('name' in field) || !field.name) {
             return;
@@ -28,8 +38,13 @@ import { traverseFields } from 'payload';
             return;
         }
         const current = ref;
-        const value = current[field.name];
+        let value = current[field.name];
+        // Transform existing values
         if (value !== null && value !== undefined) {
+            // Step 1: Apply type casting (e.g., number -> string for text fields)
+            value = castFieldValue(field, value);
+            current[field.name] = value;
+            // Step 2: Apply Content API specific transformations
             // RichText: object -> JSON string
             if (field.type === 'richText' && typeof value !== 'string') {
                 current[field.name] = JSON.stringify(value);
@@ -42,6 +57,23 @@ import { traverseFields } from 'payload';
         fields: collectionConfig.fields,
         ref: transformed
     });
+    stripFields({
+        config: payload.config,
+        data: transformed,
+        fields: flattenAllFields({
+            cache: true,
+            fields: collectionConfig.fields
+        }),
+        reservedKeys: [
+            'id',
+            'globalType'
+        ]
+    });
+    // Convert numeric ID to string for Content API
+    const customIDType = payload.collections?.[collectionSlug]?.customIDType;
+    if (customIDType === 'number') {
+        transformed.id = String(transformed.id);
+    }
     return transformed;
 }
 /**
@@ -96,6 +128,23 @@ import { traverseFields } from 'payload';
         fields: collectionConfig.fields,
         ref: transformed
     });
+    // Convert string ID to number if collection uses numeric custom ID
+    const customIDType = payload.collections?.[collectionSlug]?.customIDType;
+    if (customIDType === 'number') {
+        transformed.id = Number(transformed.id);
+    }
+    stripFields({
+        config: payload.config,
+        data: transformed,
+        fields: flattenAllFields({
+            cache: true,
+            fields: collectionConfig.fields
+        }),
+        reservedKeys: [
+            'id',
+            'globalType'
+        ]
+    });
     // Handle auth-specific fields that aren't in the field schema
     // When these fields are null in DB, Content API omits them from response (undefined)
     // But Payload expects them to be null, not undefined
@@ -107,7 +156,6 @@ import { traverseFields } from 'payload';
         ];
         for (const fieldName of authFields){
             if (!(fieldName in transformed)) {
-                ;
                 transformed[fieldName] = null;
             }
         }
@@ -115,4 +163,4 @@ import { traverseFields } from 'payload';
     return transformed;
 }
 
-//# sourceMappingURL=data.js.map
+//# sourceMappingURL=index.js.map

package/dist/db-content-api/utilities/data/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/db-content-api/utilities/data/index.ts"],"sourcesContent":["import type { CollectionConfig, GlobalConfig, Payload, TraverseFieldsCallback } from 'payload'\n\nimport { flattenAllFields, traverseFields } from 'payload'\n\nimport type { components } from '../../generated/content-api-types.js'\n\nimport { applyDefaults } from './applyDefaults.js'\nimport { castFieldValue } from './castFieldValue.js'\nimport { stripFields } from './stripFields.js'\n\ntype DataWithOperations = components['schemas']['DataWithOperations']\n\n/**\n * Transform data before sending to Content API (WRITE operations)\n *\n * Conversions applied:\n * - Default values: Apply static defaults for undefined fields (when applyDefaults=true)\n * - Type casting: Convert values to match field types (e.g., number -> string for text fields)\n * - RichText fields: Objects -> JSON strings\n *\n * Note: Date fields are automatically converted to ISO strings by JSON.stringify()\n */\nexport function dataToContentAPI(\n  payload: Payload,\n  collectionSlug: string,\n  data: unknown,\n  options?: { applyDefaults?: boolean },\n): DataWithOperations {\n  if (!data || typeof data !== 'object') {\n    return data as DataWithOperations\n  }\n\n  // Deep clone to avoid mutating original data\n  const transformed = JSON.parse(JSON.stringify(data))\n\n  // Get collection config\n  const isGlobal = collectionSlug.startsWith('_global-')\n  const actualSlug = isGlobal ? collectionSlug.substring(8) : collectionSlug\n  const collectionConfig: CollectionConfig | GlobalConfig | undefined = isGlobal\n    ? payload.config.globals?.find((g) => g.slug === actualSlug)\n    : payload.config.collections.find((c) => c.slug === actualSlug)\n\n  if (!collectionConfig?.fields) {\n    return transformed as DataWithOperations\n  }\n\n  // Apply static defaults recursively to handle nested structures (arrays, groups)\n  // This must happen before traverseFields to ensure defaults are in place\n  if (options?.applyDefaults) {\n    applyDefaults(transformed, collectionConfig.fields)\n  }\n\n  // Use Payload's traverseFields to iterate over all fields for transformations\n  const callback: TraverseFieldsCallback = ({ field, ref }) => {\n    if (!('name' in field) || !field.name) {\n      return\n    }\n    if (!ref || typeof ref !== 'object') {\n      return\n    }\n\n    const current = ref as Record<string, unknown>\n    let value = current[field.name]\n\n    // Transform existing values\n    if (value !== null && value !== undefined) {\n      // Step 1: Apply type casting (e.g., number -> string for text fields)\n      value = castFieldValue(field, value)\n      current[field.name] = value\n\n      // Step 2: Apply Content API specific transformations\n      // RichText: object -> JSON string\n      if (field.type === 'richText' && typeof value !== 'string') {\n        current[field.name] = JSON.stringify(value)\n      }\n      // Date fields are already handled by JSON.stringify() which converts Date -> ISO string\n    }\n  }\n\n  traverseFields({ callback, fields: collectionConfig.fields, ref: transformed })\n\n  stripFields({\n    config: payload.config,\n    data: transformed,\n    fields: flattenAllFields({ cache: true, fields: collectionConfig.fields }),\n    reservedKeys: ['id', 'globalType'],\n  })\n\n  // Convert numeric ID to string for Content API\n  const customIDType = payload.collections?.[collectionSlug]?.customIDType\n  if (customIDType === 'number') {\n    transformed.id = String(transformed.id)\n  }\n\n  return transformed as DataWithOperations\n}\n\n/**\n * Transform data received from Content API (READ operations)\n *\n * Conversions applied:\n * - RichText fields: JSON strings -> Objects\n *\n * Note: Date fields come as ISO strings from Content API and stay as strings\n * (matching MongoDB and other adapters' behavior)\n */\nexport function dataFromContentAPI(\n  payload: Payload,\n  collectionSlug: string,\n  data: unknown,\n): unknown {\n  if (!data || typeof data !== 'object') {\n    return data\n  }\n\n  // Deep clone to avoid mutating original data\n  const transformed = JSON.parse(JSON.stringify(data))\n\n  // Get collection config\n  const isGlobal = collectionSlug.startsWith('_global-')\n  const actualSlug = isGlobal ? collectionSlug.substring(8) : collectionSlug\n  const collectionConfig: CollectionConfig | GlobalConfig | undefined = isGlobal\n    ? payload.config.globals?.find((g) => g.slug === actualSlug)\n    : payload.config.collections.find((c) => c.slug === actualSlug)\n\n  if (!collectionConfig?.fields) {\n    return transformed\n  }\n\n  // Use Payload's traverseFields to iterate over all fields\n  const callback: TraverseFieldsCallback = ({ field, parentPath, ref }) => {\n    if (!('name' in field) || !field.name) {\n      return\n    }\n    if (!ref || typeof ref !== 'object') {\n      return\n    }\n\n    const current = ref as Record<string, unknown>\n    const value = current[field.name]\n\n    if (value !== null && value !== undefined) {\n      // RichText: JSON string -> object\n      if (field.type === 'richText' && typeof value === 'string') {\n        try {\n          current[field.name] = JSON.parse(value)\n        } catch (error) {\n          const fieldPath = parentPath ? `${parentPath}.${field.name}` : field.name\n          payload.logger.warn({\n            err: error instanceof Error ? error : new Error(String(error)),\n            msg: `Failed to parse richtext field '${fieldPath}' in collection '${collectionSlug}'`,\n          })\n        }\n      }\n      // Date fields: Already ISO strings from Content API, no conversion needed\n    }\n  }\n\n  traverseFields({ callback, fields: collectionConfig.fields, ref: transformed })\n\n  // Convert string ID to number if collection uses numeric custom ID\n  const customIDType = payload.collections?.[collectionSlug]?.customIDType\n  if (customIDType === 'number') {\n    transformed.id = Number(transformed.id)\n  }\n\n  stripFields({\n    config: payload.config,\n    data: transformed,\n    fields: flattenAllFields({ cache: true, fields: collectionConfig.fields }),\n    reservedKeys: ['id', 'globalType'],\n  })\n\n  // Handle auth-specific fields that aren't in the field schema\n  // When these fields are null in DB, Content API omits them from response (undefined)\n  // But Payload expects them to be null, not undefined\n  // Only add them if the collection has auth enabled\n  if ('auth' in collectionConfig && collectionConfig.auth) {\n    const authFields = ['resetPasswordExpiration', 'lockUntil']\n    for (const fieldName of authFields) {\n      if (!(fieldName in transformed)) {\n        transformed[fieldName] = null\n      }\n    }\n  }\n\n  return transformed\n}\n"],"names":["flattenAllFields","traverseFields","applyDefaults","castFieldValue","stripFields","dataToContentAPI","payload","collectionSlug","data","options","transformed","JSON","parse","stringify","isGlobal","startsWith","actualSlug","substring","collectionConfig","config","globals","find","g","slug","collections","c","fields","callback","field","ref","name","current","value","undefined","type","cache","reservedKeys","customIDType","id","String","dataFromContentAPI","parentPath","error","fieldPath","logger","warn","err","Error","msg","Number","auth","authFields","fieldName"],"mappings":"AAEA,SAASA,gBAAgB,EAAEC,cAAc,QAAQ,UAAS;AAI1D,SAASC,aAAa,QAAQ,qBAAoB;AAClD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,WAAW,QAAQ,mBAAkB;AAI9C;;;;;;;;;CASC,GACD,OAAO,SAASC,iBACdC,OAAgB,EAChBC,cAAsB,EACtBC,IAAa,EACbC,OAAqC;IAErC,IAAI,CAACD,QAAQ,OAAOA,SAAS,UAAU;QACrC,OAAOA;IACT;IAEA,6CAA6C;IAC7C,MAAME,cAAcC,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACL;IAE9C,wBAAwB;IACxB,MAAMM,WAAWP,eAAeQ,UAAU,CAAC;IAC3C,MAAMC,aAAaF,WAAWP,eAAeU,SAAS,CAAC,KAAKV;IAC5D,MAAMW,mBAAgEJ,WAClER,QAAQa,MAAM,CAACC,OAAO,EAAEC,KAAK,CAACC,IAAMA,EAAEC,IAAI,KAAKP,cAC/CV,QAAQa,MAAM,CAACK,WAAW,CAACH,IAAI,CAAC,CAACI,IAAMA,EAAEF,IAAI,KAAKP;IAEtD,IAAI,CAACE,kBAAkBQ,QAAQ;QAC7B,OAAOhB;IACT;IAEA,iFAAiF;IACjF,yEAAyE;IACzE,IAAID,SAASP,eAAe;QAC1BA,cAAcQ,aAAaQ,iBAAiBQ,MAAM;IACpD;IAEA,8EAA8E;IAC9E,MAAMC,WAAmC,CAAC,EAAEC,KAAK,EAAEC,GAAG,EAAE;QACtD,IAAI,CAAE,CAAA,UAAUD,KAAI,KAAM,CAACA,MAAME,IAAI,EAAE;YACrC;QACF;QACA,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;YACnC;QACF;QAEA,MAAME,UAAUF;QAChB,IAAIG,QAAQD,OAAO,CAACH,MAAME,IAAI,CAAC;QAE/B,4BAA4B;QAC5B,IAAIE,UAAU,QAAQA,UAAUC,WAAW;YACzC,sEAAsE;YACtED,QAAQ7B,eAAeyB,OAAOI;YAC9BD,OAAO,CAACH,MAAME,IAAI,CAAC,GAAGE;YAEtB,qDAAqD;YACrD,kCAAkC;YAClC,IAAIJ,MAAMM,IAAI,KAAK,cAAc,OAAOF,UAAU,UAAU;gBAC1DD,OAAO,CAACH,MAAME,IAAI,CAAC,GAAGnB,KAAKE,SAAS,CAACmB;YACvC;QACA,wFAAwF;QAC1F;IACF;IAEA/B,eAAe;QAAE0B;QAAUD,QAAQR,iBAAiBQ,MAAM;QAAEG,KAAKnB;IAAY;IAE7EN,YAAY;QACVe,QAAQb,QAAQa,MAAM;QACtBX,MAAME;QACNgB,QAAQ1B,iBAAiB;YAAEmC,OAAO;YAAMT,QAAQR,iBAAiBQ,MAAM;QAAC;QACxEU,cAAc;YAAC;YAAM;SAAa;IACpC;IAEA,+CAA+C;IAC/C,MAAMC,eAAe/B,QAAQkB,WAAW,EAAE,CAACjB,eAAe,EAAE8B;IAC5D,IAAIA,iBAAiB,UAAU;QAC7B3B,YAAY4B,EAAE,GAAGC,OAAO7B,YAAY4B,EAAE;IACxC;IAEA,OAAO5B;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS8B,mBACdlC,OAAgB,EAChBC,cAAsB,EACtBC,IAAa;IAEb,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU;QACrC,OAAOA;IACT;IAEA,6CAA6C;IAC7C,MAAME,cAAcC,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACL;IAE9C,wBAAwB;IACxB,MAAMM,WAAWP,eAAeQ,UAAU,CAAC;IAC3C,MAAMC,aAAaF,WAAWP,eAAeU,SAAS,CAAC,KAAKV;IAC5D,MAAMW,mBAAgEJ,WAClER,QAAQa,MAAM,CAACC,OAAO,EAAEC,KAAK,CAACC,IAAMA,EAAEC,IAAI,KAAKP,cAC/CV,QAAQa,MAAM,CAACK,WAAW,CAACH,IAAI,CAAC,CAACI,IAAMA,EAAEF,IAAI,KAAKP;IAEtD,IAAI,CAACE,kBAAkBQ,QAAQ;QAC7B,OAAOhB;IACT;IAEA,0DAA0D;IAC1D,MAAMiB,WAAmC,CAAC,EAAEC,KAAK,EAAEa,UAAU,EAAEZ,GAAG,EAAE;QAClE,IAAI,CAAE,CAAA,UAAUD,KAAI,KAAM,CAACA,MAAME,IAAI,EAAE;YACrC;QACF;QACA,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;YACnC;QACF;QAEA,MAAME,UAAUF;QAChB,MAAMG,QAAQD,OAAO,CAACH,MAAME,IAAI,CAAC;QAEjC,IAAIE,UAAU,QAAQA,UAAUC,WAAW;YACzC,kCAAkC;YAClC,IAAIL,MAAMM,IAAI,KAAK,cAAc,OAAOF,UAAU,UAAU;gBAC1D,IAAI;oBACFD,OAAO,CAACH,MAAME,IAAI,CAAC,GAAGnB,KAAKC,KAAK,CAACoB;gBACnC,EAAE,OAAOU,OAAO;oBACd,MAAMC,YAAYF,aAAa,GAAGA,WAAW,CAAC,EAAEb,MAAME,IAAI,EAAE,GAAGF,MAAME,IAAI;oBACzExB,QAAQsC,MAAM,CAACC,IAAI,CAAC;wBAClBC,KAAKJ,iBAAiBK,QAAQL,QAAQ,IAAIK,MAAMR,OAAOG;wBACvDM,KAAK,CAAC,gCAAgC,EAAEL,UAAU,iBAAiB,EAAEpC,eAAe,CAAC,CAAC;oBACxF;gBACF;YACF;QACA,0EAA0E;QAC5E;IACF;IAEAN,eAAe;QAAE0B;QAAUD,QAAQR,iBAAiBQ,MAAM;QAAEG,KAAKnB;IAAY;IAE7E,mEAAmE;IACnE,MAAM2B,eAAe/B,QAAQkB,WAAW,EAAE,CAACjB,eAAe,EAAE8B;IAC5D,IAAIA,iBAAiB,UAAU;QAC7B3B,YAAY4B,EAAE,GAAGW,OAAOvC,YAAY4B,EAAE;IACxC;IAEAlC,YAAY;QACVe,QAAQb,QAAQa,MAAM;QACtBX,MAAME;QACNgB,QAAQ1B,iBAAiB;YAAEmC,OAAO;YAAMT,QAAQR,iBAAiBQ,MAAM;QAAC;QACxEU,cAAc;YAAC;YAAM;SAAa;IACpC;IAEA,8DAA8D;IAC9D,qFAAqF;IACrF,qDAAqD;IACrD,mDAAmD;IACnD,IAAI,UAAUlB,oBAAoBA,iBAAiBgC,IAAI,EAAE;QACvD,MAAMC,aAAa;YAAC;YAA2B;SAAY;QAC3D,KAAK,MAAMC,aAAaD,WAAY;YAClC,IAAI,CAAEC,CAAAA,aAAa1C,WAAU,GAAI;gBAC/BA,WAAW,CAAC0C,UAAU,GAAG;YAC3B;QACF;IACF;IAEA,OAAO1C;AACT"}

package/dist/db-content-api/utilities/data/stripFields.d.ts

@@ -0,0 +1,48 @@
+import type { FlattenedField, SanitizedConfig } from 'payload';
+/**
+ * Strips fields from data that are not defined in the schema or are invalid.
+ *
+ * This function was copied from the MongoDB adapter's implementation:
+ * @see packages/db-mongodb/src/utilities/transform.ts (stripFields function)
+ *
+ * @description
+ * This utility performs deep sanitization of document data by:
+ * 1. **Removing undefined fields**: Strips any field not present in the collection's schema
+ *    (e.g., sensitive fields like `password`, `apiKey`, or any extra fields not in config)
+ * 2. **Removing invalid locales**: Deletes locale keys that don't exist in `config.localization.localeCodes`
+ *    (e.g., if data contains `{ "es-MX": "..." }` but only `"en"` is configured)
+ * 3. **Removing invalid blocks**: Filters out blocks with unknown `blockType` values
+ *    (prevents data corruption from blocks that don't exist in the schema)
+ * 4. **Recursive sanitization**: Processes nested structures (arrays, groups, blocks, localized fields)
+ *    to ensure deep data integrity
+ *
+ * @remarks
+ * Unlike MongoDB's adapter which uses Mongoose schemas with `strict: true` (rejecting extra fields
+ * on write), Content API uses flexible JSONB storage that accepts any fields. Therefore, this
+ * function is called on **both read and write operations** to ensure data consistency.
+ *
+ * The MongoDB adapter also supports an `allowAdditionalKeys` option that allows reading/writing
+ * fields not in the schema. For now, Content API does not support this feature - we always
+ * sanitize data. If users request this functionality in the future, we can consider adding it.
+ *
+ * @todo
+ * 1. Consider moving this utility to `payload/shared` so both MongoDB and Content API adapters
+ *    can use the same implementation, reducing code duplication and maintenance burden.
+ *
+ * 2. Performance optimization: This function iterates through all fields recursively.
+ *    The `dataToContentAPI` and `dataFromContentAPI` functions in
+ *    `packages/figma/src/db-content-api/utilities/data.ts` also iterate through fields
+ *    to transform richText (object ↔ JSON string), custom IDs (number ↔ string), and dates.
+ *    Consider combining both traversals into a single abstraction to avoid iterating twice.
+ *
+ * 3. Feature parity: MongoDB adapter has `allowAdditionalKeys` option. We currently always
+ *    strip additional keys, but could add this as a configurable option if users need it.
+ */
+export declare const stripFields: ({ config, data, fields, parentIsLocalized, reservedKeys, }: {
+    config: SanitizedConfig;
+    data: any;
+    fields: FlattenedField[];
+    parentIsLocalized?: boolean;
+    reservedKeys?: string[];
+}) => void;
+//# sourceMappingURL=stripFields.d.ts.map

package/dist/db-content-api/utilities/data/stripFields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripFields.d.ts","sourceRoot":"","sources":["../../../../src/db-content-api/utilities/data/stripFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,WAAW,+DAMrB;IACD,MAAM,EAAE,eAAe,CAAA;IAEvB,IAAI,EAAE,GAAG,CAAA;IACT,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB,SAmLA,CAAA"}

package/dist/db-content-api/utilities/data/stripFields.js

@@ -0,0 +1,195 @@
+import { fieldShouldBeLocalized } from 'payload/shared';
+/**
+ * Strips fields from data that are not defined in the schema or are invalid.
+ *
+ * This function was copied from the MongoDB adapter's implementation:
+ * @see packages/db-mongodb/src/utilities/transform.ts (stripFields function)
+ *
+ * @description
+ * This utility performs deep sanitization of document data by:
+ * 1. **Removing undefined fields**: Strips any field not present in the collection's schema
+ *    (e.g., sensitive fields like `password`, `apiKey`, or any extra fields not in config)
+ * 2. **Removing invalid locales**: Deletes locale keys that don't exist in `config.localization.localeCodes`
+ *    (e.g., if data contains `{ "es-MX": "..." }` but only `"en"` is configured)
+ * 3. **Removing invalid blocks**: Filters out blocks with unknown `blockType` values
+ *    (prevents data corruption from blocks that don't exist in the schema)
+ * 4. **Recursive sanitization**: Processes nested structures (arrays, groups, blocks, localized fields)
+ *    to ensure deep data integrity
+ *
+ * @remarks
+ * Unlike MongoDB's adapter which uses Mongoose schemas with `strict: true` (rejecting extra fields
+ * on write), Content API uses flexible JSONB storage that accepts any fields. Therefore, this
+ * function is called on **both read and write operations** to ensure data consistency.
+ *
+ * The MongoDB adapter also supports an `allowAdditionalKeys` option that allows reading/writing
+ * fields not in the schema. For now, Content API does not support this feature - we always
+ * sanitize data. If users request this functionality in the future, we can consider adding it.
+ *
+ * @todo
+ * 1. Consider moving this utility to `payload/shared` so both MongoDB and Content API adapters
+ *    can use the same implementation, reducing code duplication and maintenance burden.
+ *
+ * 2. Performance optimization: This function iterates through all fields recursively.
+ *    The `dataToContentAPI` and `dataFromContentAPI` functions in
+ *    `packages/figma/src/db-content-api/utilities/data.ts` also iterate through fields
+ *    to transform richText (object ↔ JSON string), custom IDs (number ↔ string), and dates.
+ *    Consider combining both traversals into a single abstraction to avoid iterating twice.
+ *
+ * 3. Feature parity: MongoDB adapter has `allowAdditionalKeys` option. We currently always
+ *    strip additional keys, but could add this as a configurable option if users need it.
+ */ export const stripFields = ({ config, data, fields, parentIsLocalized = false, reservedKeys = [] })=>{
+    for(const k in data){
+        if (!fields.some((field)=>field.name === k) && !reservedKeys.includes(k)) {
+            delete data[k];
+        }
+    }
+    for (const field of fields){
+        reservedKeys = [];
+        const fieldData = data[field.name];
+        if (!fieldData || typeof fieldData !== 'object') {
+            continue;
+        }
+        const shouldLocalizeField = fieldShouldBeLocalized({
+            field,
+            parentIsLocalized
+        });
+        if (field.type === 'blocks') {
+            reservedKeys.push('blockType');
+        }
+        if ('flattenedFields' in field || 'blocks' in field) {
+            if (shouldLocalizeField && config.localization) {
+                for(const localeKey in fieldData){
+                    if (!config.localization.localeCodes.some((code)=>code === localeKey)) {
+                        delete fieldData[localeKey];
+                        continue;
+                    }
+                    const localeData = fieldData[localeKey];
+                    if (!localeData || typeof localeData !== 'object') {
+                        continue;
+                    }
+                    if (field.type === 'array' || field.type === 'blocks') {
+                        if (!Array.isArray(localeData)) {
+                            continue;
+                        }
+                        let hasNull = false;
+                        for(let i = 0; i < localeData.length; i++){
+                            const data = localeData[i];
+                            let fields = null;
+                            if (field.type === 'array') {
+                                fields = field.flattenedFields;
+                            } else {
+                                let maybeBlock = undefined;
+                                if (field.blockReferences) {
+                                    const maybeBlockReference = field.blockReferences.find((each)=>{
+                                        const slug = typeof each === 'string' ? each : each.slug;
+                                        return slug === data.blockType;
+                                    });
+                                    if (maybeBlockReference) {
+                                        if (typeof maybeBlockReference === 'object') {
+                                            maybeBlock = maybeBlockReference;
+                                        } else {
+                                            maybeBlock = config.blocks?.find((each)=>each.slug === maybeBlockReference);
+                                        }
+                                    }
+                                }
+                                if (!maybeBlock) {
+                                    maybeBlock = field.blocks.find((each)=>each.slug === data.blockType);
+                                }
+                                if (maybeBlock) {
+                                    fields = maybeBlock.flattenedFields;
+                                } else {
+                                    localeData[i] = null;
+                                    hasNull = true;
+                                }
+                            }
+                            if (!fields) {
+                                continue;
+                            }
+                            stripFields({
+                                config,
+                                data,
+                                fields,
+                                parentIsLocalized: parentIsLocalized || field.localized,
+                                reservedKeys
+                            });
+                        }
+                        if (hasNull) {
+                            fieldData[localeKey] = localeData.filter(Boolean);
+                        }
+                        continue;
+                    } else {
+                        stripFields({
+                            config,
+                            data: localeData,
+                            fields: field.flattenedFields,
+                            parentIsLocalized: parentIsLocalized || field.localized,
+                            reservedKeys
+                        });
+                    }
+                }
+                continue;
+            }
+            if (field.type === 'array' || field.type === 'blocks') {
+                if (!Array.isArray(fieldData)) {
+                    continue;
+                }
+                let hasNull = false;
+                for(let i = 0; i < fieldData.length; i++){
+                    const data = fieldData[i];
+                    let fields = null;
+                    if (field.type === 'array') {
+                        fields = field.flattenedFields;
+                    } else {
+                        let maybeBlock = undefined;
+                        if (field.blockReferences) {
+                            const maybeBlockReference = field.blockReferences.find((each)=>{
+                                const slug = typeof each === 'string' ? each : each.slug;
+                                return slug === data.blockType;
+                            });
+                            if (maybeBlockReference) {
+                                if (typeof maybeBlockReference === 'object') {
+                                    maybeBlock = maybeBlockReference;
+                                } else {
+                                    maybeBlock = config.blocks?.find((each)=>each.slug === maybeBlockReference);
+                                }
+                            }
+                        }
+                        if (!maybeBlock) {
+                            maybeBlock = field.blocks.find((each)=>each.slug === data.blockType);
+                        }
+                        if (maybeBlock) {
+                            fields = maybeBlock.flattenedFields;
+                        } else {
+                            fieldData[i] = null;
+                            hasNull = true;
+                        }
+                    }
+                    if (!fields) {
+                        continue;
+                    }
+                    stripFields({
+                        config,
+                        data,
+                        fields,
+                        parentIsLocalized: parentIsLocalized || field.localized,
+                        reservedKeys
+                    });
+                }
+                if (hasNull) {
+                    data[field.name] = fieldData.filter(Boolean);
+                }
+                continue;
+            } else {
+                stripFields({
+                    config,
+                    data: fieldData,
+                    fields: field.flattenedFields,
+                    parentIsLocalized: parentIsLocalized || field.localized,
+                    reservedKeys
+                });
+            }
+        }
+    }
+};
+
+//# sourceMappingURL=stripFields.js.map

package/dist/db-content-api/utilities/data/stripFields.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/db-content-api/utilities/data/stripFields.ts"],"sourcesContent":["import type { FlattenedBlock, FlattenedField, SanitizedConfig } from 'payload'\n\nimport { fieldShouldBeLocalized } from 'payload/shared'\n\n/**\n * Strips fields from data that are not defined in the schema or are invalid.\n *\n * This function was copied from the MongoDB adapter's implementation:\n * @see packages/db-mongodb/src/utilities/transform.ts (stripFields function)\n *\n * @description\n * This utility performs deep sanitization of document data by:\n * 1. **Removing undefined fields**: Strips any field not present in the collection's schema\n *    (e.g., sensitive fields like `password`, `apiKey`, or any extra fields not in config)\n * 2. **Removing invalid locales**: Deletes locale keys that don't exist in `config.localization.localeCodes`\n *    (e.g., if data contains `{ \"es-MX\": \"...\" }` but only `\"en\"` is configured)\n * 3. **Removing invalid blocks**: Filters out blocks with unknown `blockType` values\n *    (prevents data corruption from blocks that don't exist in the schema)\n * 4. **Recursive sanitization**: Processes nested structures (arrays, groups, blocks, localized fields)\n *    to ensure deep data integrity\n *\n * @remarks\n * Unlike MongoDB's adapter which uses Mongoose schemas with `strict: true` (rejecting extra fields\n * on write), Content API uses flexible JSONB storage that accepts any fields. Therefore, this\n * function is called on **both read and write operations** to ensure data consistency.\n *\n * The MongoDB adapter also supports an `allowAdditionalKeys` option that allows reading/writing\n * fields not in the schema. For now, Content API does not support this feature - we always\n * sanitize data. If users request this functionality in the future, we can consider adding it.\n *\n * @todo\n * 1. Consider moving this utility to `payload/shared` so both MongoDB and Content API adapters\n *    can use the same implementation, reducing code duplication and maintenance burden.\n *\n * 2. Performance optimization: This function iterates through all fields recursively.\n *    The `dataToContentAPI` and `dataFromContentAPI` functions in\n *    `packages/figma/src/db-content-api/utilities/data.ts` also iterate through fields\n *    to transform richText (object ↔ JSON string), custom IDs (number ↔ string), and dates.\n *    Consider combining both traversals into a single abstraction to avoid iterating twice.\n *\n * 3. Feature parity: MongoDB adapter has `allowAdditionalKeys` option. We currently always\n *    strip additional keys, but could add this as a configurable option if users need it.\n */\nexport const stripFields = ({\n  config,\n  data,\n  fields,\n  parentIsLocalized = false,\n  reservedKeys = [],\n}: {\n  config: SanitizedConfig\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  data: any\n  fields: FlattenedField[]\n  parentIsLocalized?: boolean\n  reservedKeys?: string[]\n}) => {\n  for (const k in data) {\n    if (!fields.some((field) => field.name === k) && !reservedKeys.includes(k)) {\n      delete data[k]\n    }\n  }\n\n  for (const field of fields) {\n    reservedKeys = []\n    const fieldData = data[field.name]\n    if (!fieldData || typeof fieldData !== 'object') {\n      continue\n    }\n\n    const shouldLocalizeField = fieldShouldBeLocalized({ field, parentIsLocalized })\n\n    if (field.type === 'blocks') {\n      reservedKeys.push('blockType')\n    }\n\n    if ('flattenedFields' in field || 'blocks' in field) {\n      if (shouldLocalizeField && config.localization) {\n        for (const localeKey in fieldData) {\n          if (!config.localization.localeCodes.some((code) => code === localeKey)) {\n            delete fieldData[localeKey]\n            continue\n          }\n\n          const localeData = fieldData[localeKey]\n\n          if (!localeData || typeof localeData !== 'object') {\n            continue\n          }\n\n          if (field.type === 'array' || field.type === 'blocks') {\n            if (!Array.isArray(localeData)) {\n              continue\n            }\n\n            let hasNull = false\n            for (let i = 0; i < localeData.length; i++) {\n              const data = localeData[i]\n              let fields: FlattenedField[] | null = null\n\n              if (field.type === 'array') {\n                fields = field.flattenedFields\n              } else {\n                let maybeBlock: FlattenedBlock | undefined = undefined\n\n                if (field.blockReferences) {\n                  const maybeBlockReference = field.blockReferences.find((each) => {\n                    const slug = typeof each === 'string' ? each : each.slug\n                    return slug === data.blockType\n                  })\n\n                  if (maybeBlockReference) {\n                    if (typeof maybeBlockReference === 'object') {\n                      maybeBlock = maybeBlockReference\n                    } else {\n                      maybeBlock = config.blocks?.find((each) => each.slug === maybeBlockReference)\n                    }\n                  }\n                }\n\n                if (!maybeBlock) {\n                  maybeBlock = field.blocks.find((each) => each.slug === data.blockType)\n                }\n\n                if (maybeBlock) {\n                  fields = maybeBlock.flattenedFields\n                } else {\n                  localeData[i] = null\n                  hasNull = true\n                }\n              }\n\n              if (!fields) {\n                continue\n              }\n\n              stripFields({\n                config,\n                data,\n                fields,\n                parentIsLocalized: parentIsLocalized || field.localized,\n                reservedKeys,\n              })\n            }\n\n            if (hasNull) {\n              fieldData[localeKey] = localeData.filter(Boolean)\n            }\n\n            continue\n          } else {\n            stripFields({\n              config,\n              data: localeData,\n              fields: field.flattenedFields,\n              parentIsLocalized: parentIsLocalized || field.localized,\n              reservedKeys,\n            })\n          }\n        }\n        continue\n      }\n\n      if (field.type === 'array' || field.type === 'blocks') {\n        if (!Array.isArray(fieldData)) {\n          continue\n        }\n\n        let hasNull = false\n\n        for (let i = 0; i < fieldData.length; i++) {\n          const data = fieldData[i]\n          let fields: FlattenedField[] | null = null\n\n          if (field.type === 'array') {\n            fields = field.flattenedFields\n          } else {\n            let maybeBlock: FlattenedBlock | undefined = undefined\n\n            if (field.blockReferences) {\n              const maybeBlockReference = field.blockReferences.find((each) => {\n                const slug = typeof each === 'string' ? each : each.slug\n                return slug === data.blockType\n              })\n\n              if (maybeBlockReference) {\n                if (typeof maybeBlockReference === 'object') {\n                  maybeBlock = maybeBlockReference\n                } else {\n                  maybeBlock = config.blocks?.find((each) => each.slug === maybeBlockReference)\n                }\n              }\n            }\n\n            if (!maybeBlock) {\n              maybeBlock = field.blocks.find((each) => each.slug === data.blockType)\n            }\n\n            if (maybeBlock) {\n              fields = maybeBlock.flattenedFields\n            } else {\n              fieldData[i] = null\n              hasNull = true\n            }\n          }\n\n          if (!fields) {\n            continue\n          }\n\n          stripFields({\n            config,\n            data,\n            fields,\n            parentIsLocalized: parentIsLocalized || field.localized,\n            reservedKeys,\n          })\n        }\n\n        if (hasNull) {\n          data[field.name] = fieldData.filter(Boolean)\n        }\n\n        continue\n      } else {\n        stripFields({\n          config,\n          data: fieldData,\n          fields: field.flattenedFields,\n          parentIsLocalized: parentIsLocalized || field.localized,\n          reservedKeys,\n        })\n      }\n    }\n  }\n}\n"],"names":["fieldShouldBeLocalized","stripFields","config","data","fields","parentIsLocalized","reservedKeys","k","some","field","name","includes","fieldData","shouldLocalizeField","type","push","localization","localeKey","localeCodes","code","localeData","Array","isArray","hasNull","i","length","flattenedFields","maybeBlock","undefined","blockReferences","maybeBlockReference","find","each","slug","blockType","blocks","localized","filter","Boolean"],"mappings":"AAEA,SAASA,sBAAsB,QAAQ,iBAAgB;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,OAAO,MAAMC,cAAc,CAAC,EAC1BC,MAAM,EACNC,IAAI,EACJC,MAAM,EACNC,oBAAoB,KAAK,EACzBC,eAAe,EAAE,EAQlB;IACC,IAAK,MAAMC,KAAKJ,KAAM;QACpB,IAAI,CAACC,OAAOI,IAAI,CAAC,CAACC,QAAUA,MAAMC,IAAI,KAAKH,MAAM,CAACD,aAAaK,QAAQ,CAACJ,IAAI;YAC1E,OAAOJ,IAAI,CAACI,EAAE;QAChB;IACF;IAEA,KAAK,MAAME,SAASL,OAAQ;QAC1BE,eAAe,EAAE;QACjB,MAAMM,YAAYT,IAAI,CAACM,MAAMC,IAAI,CAAC;QAClC,IAAI,CAACE,aAAa,OAAOA,cAAc,UAAU;YAC/C;QACF;QAEA,MAAMC,sBAAsBb,uBAAuB;YAAES;YAAOJ;QAAkB;QAE9E,IAAII,MAAMK,IAAI,KAAK,UAAU;YAC3BR,aAAaS,IAAI,CAAC;QACpB;QAEA,IAAI,qBAAqBN,SAAS,YAAYA,OAAO;YACnD,IAAII,uBAAuBX,OAAOc,YAAY,EAAE;gBAC9C,IAAK,MAAMC,aAAaL,UAAW;oBACjC,IAAI,CAACV,OAAOc,YAAY,CAACE,WAAW,CAACV,IAAI,CAAC,CAACW,OAASA,SAASF,YAAY;wBACvE,OAAOL,SAAS,CAACK,UAAU;wBAC3B;oBACF;oBAEA,MAAMG,aAAaR,SAAS,CAACK,UAAU;oBAEvC,IAAI,CAACG,cAAc,OAAOA,eAAe,UAAU;wBACjD;oBACF;oBAEA,IAAIX,MAAMK,IAAI,KAAK,WAAWL,MAAMK,IAAI,KAAK,UAAU;wBACrD,IAAI,CAACO,MAAMC,OAAO,CAACF,aAAa;4BAC9B;wBACF;wBAEA,IAAIG,UAAU;wBACd,IAAK,IAAIC,IAAI,GAAGA,IAAIJ,WAAWK,MAAM,EAAED,IAAK;4BAC1C,MAAMrB,OAAOiB,UAAU,CAACI,EAAE;4BAC1B,IAAIpB,SAAkC;4BAEtC,IAAIK,MAAMK,IAAI,KAAK,SAAS;gCAC1BV,SAASK,MAAMiB,eAAe;4BAChC,OAAO;gCACL,IAAIC,aAAyCC;gCAE7C,IAAInB,MAAMoB,eAAe,EAAE;oCACzB,MAAMC,sBAAsBrB,MAAMoB,eAAe,CAACE,IAAI,CAAC,CAACC;wCACtD,MAAMC,OAAO,OAAOD,SAAS,WAAWA,OAAOA,KAAKC,IAAI;wCACxD,OAAOA,SAAS9B,KAAK+B,SAAS;oCAChC;oCAEA,IAAIJ,qBAAqB;wCACvB,IAAI,OAAOA,wBAAwB,UAAU;4CAC3CH,aAAaG;wCACf,OAAO;4CACLH,aAAazB,OAAOiC,MAAM,EAAEJ,KAAK,CAACC,OAASA,KAAKC,IAAI,KAAKH;wCAC3D;oCACF;gCACF;gCAEA,IAAI,CAACH,YAAY;oCACfA,aAAalB,MAAM0B,MAAM,CAACJ,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK9B,KAAK+B,SAAS;gCACvE;gCAEA,IAAIP,YAAY;oCACdvB,SAASuB,WAAWD,eAAe;gCACrC,OAAO;oCACLN,UAAU,CAACI,EAAE,GAAG;oCAChBD,UAAU;gCACZ;4BACF;4BAEA,IAAI,CAACnB,QAAQ;gCACX;4BACF;4BAEAH,YAAY;gCACVC;gCACAC;gCACAC;gCACAC,mBAAmBA,qBAAqBI,MAAM2B,SAAS;gCACvD9B;4BACF;wBACF;wBAEA,IAAIiB,SAAS;4BACXX,SAAS,CAACK,UAAU,GAAGG,WAAWiB,MAAM,CAACC;wBAC3C;wBAEA;oBACF,OAAO;wBACLrC,YAAY;4BACVC;4BACAC,MAAMiB;4BACNhB,QAAQK,MAAMiB,eAAe;4BAC7BrB,mBAAmBA,qBAAqBI,MAAM2B,SAAS;4BACvD9B;wBACF;oBACF;gBACF;gBACA;YACF;YAEA,IAAIG,MAAMK,IAAI,KAAK,WAAWL,MAAMK,IAAI,KAAK,UAAU;gBACrD,IAAI,CAACO,MAAMC,OAAO,CAACV,YAAY;oBAC7B;gBACF;gBAEA,IAAIW,UAAU;gBAEd,IAAK,IAAIC,IAAI,GAAGA,IAAIZ,UAAUa,MAAM,EAAED,IAAK;oBACzC,MAAMrB,OAAOS,SAAS,CAACY,EAAE;oBACzB,IAAIpB,SAAkC;oBAEtC,IAAIK,MAAMK,IAAI,KAAK,SAAS;wBAC1BV,SAASK,MAAMiB,eAAe;oBAChC,OAAO;wBACL,IAAIC,aAAyCC;wBAE7C,IAAInB,MAAMoB,eAAe,EAAE;4BACzB,MAAMC,sBAAsBrB,MAAMoB,eAAe,CAACE,IAAI,CAAC,CAACC;gCACtD,MAAMC,OAAO,OAAOD,SAAS,WAAWA,OAAOA,KAAKC,IAAI;gCACxD,OAAOA,SAAS9B,KAAK+B,SAAS;4BAChC;4BAEA,IAAIJ,qBAAqB;gCACvB,IAAI,OAAOA,wBAAwB,UAAU;oCAC3CH,aAAaG;gCACf,OAAO;oCACLH,aAAazB,OAAOiC,MAAM,EAAEJ,KAAK,CAACC,OAASA,KAAKC,IAAI,KAAKH;gCAC3D;4BACF;wBACF;wBAEA,IAAI,CAACH,YAAY;4BACfA,aAAalB,MAAM0B,MAAM,CAACJ,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK9B,KAAK+B,SAAS;wBACvE;wBAEA,IAAIP,YAAY;4BACdvB,SAASuB,WAAWD,eAAe;wBACrC,OAAO;4BACLd,SAAS,CAACY,EAAE,GAAG;4BACfD,UAAU;wBACZ;oBACF;oBAEA,IAAI,CAACnB,QAAQ;wBACX;oBACF;oBAEAH,YAAY;wBACVC;wBACAC;wBACAC;wBACAC,mBAAmBA,qBAAqBI,MAAM2B,SAAS;wBACvD9B;oBACF;gBACF;gBAEA,IAAIiB,SAAS;oBACXpB,IAAI,CAACM,MAAMC,IAAI,CAAC,GAAGE,UAAUyB,MAAM,CAACC;gBACtC;gBAEA;YACF,OAAO;gBACLrC,YAAY;oBACVC;oBACAC,MAAMS;oBACNR,QAAQK,MAAMiB,eAAe;oBAC7BrB,mBAAmBA,qBAAqBI,MAAM2B,SAAS;oBACvD9B;gBACF;YACF;QACF;IACF;AACF,EAAC"}

package/dist/db-content-api/utilities/where.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"where.d.ts","sourceRoot":"","sources":["../../../src/db-content-api/utilities/where.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,KAAK,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAA;AASvD,KAAK,cAAc,GAAG;IACpB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,SAAS,GAAG,KAAK,EACxB,OAAO,GAAE,cAAmB,GAC3B,WAAW,CA2Db"}
+{"version":3,"file":"where.d.ts","sourceRoot":"","sources":["../../../src/db-content-api/utilities/where.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,KAAK,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAA;AASvD,KAAK,cAAc,GAAG;IACpB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,SAAS,GAAG,KAAK,EACxB,OAAO,GAAE,cAAmB,GAC3B,WAAW,CA4Gb"}

package/dist/db-content-api/utilities/where.js

@@ -13,7 +13,26 @@ export function convertPayloadWhereToContentAPI(where, options = {}) {
             const nestedConditions = value.map((item)=>convertPayloadWhereToContentAPI(item, {
                     ...options,
                     insideLogicalOperator: true
-                }));
+                }))// TODO: A better solution would be to make the `where` schema of `zod` in `content-api`
+            // more permissive. For now I'll do it this way because I have an idea to simplify
+            // everything we're doing with `where` (Post EAP) anyway.
+            // Filter out empty conditions { and: [] } that would be invalid
+            .filter((condition)=>{
+                if ('and' in condition) {
+                    return condition.and.length > 0;
+                }
+                if ('or' in condition) {
+                    return condition.or.length > 0;
+                }
+                return true // Keep path/operator/value conditions
+                ;
+            });
+            // If filtering resulted in no conditions, return empty and
+            if (nestedConditions.length === 0) {
+                return {
+                    and: []
+                };
+            }
             return {
                 and: nestedConditions
             };
@@ -22,7 +41,23 @@ export function convertPayloadWhereToContentAPI(where, options = {}) {
             const nestedConditions = value.map((item)=>convertPayloadWhereToContentAPI(item, {
                     ...options,
                     insideLogicalOperator: true
-                }));
+                }))// Filter out empty conditions { and: [] } or { or: [] } that would be invalid
+            .filter((condition)=>{
+                if ('and' in condition) {
+                    return condition.and.length > 0;
+                }
+                if ('or' in condition) {
+                    return condition.or.length > 0;
+                }
+                return true // Keep path/operator/value conditions
+                ;
+            });
+            // If filtering resulted in no conditions, return empty and
+            if (nestedConditions.length === 0) {
+                return {
+                    and: []
+                };
+            }
             return {
                 or: nestedConditions
             };
@@ -36,7 +71,16 @@ export function convertPayloadWhereToContentAPI(where, options = {}) {
             // Convert field conditions: { fieldName: { operator: value } }
             // to: { path: fieldName, operator, value }
             const operators = value;
+            // Skip empty operator objects { fieldName: {} }
+            if (Object.keys(operators).length === 0) {
+                continue;
+            }
             for (const [op, operatorValue] of Object.entries(operators)){
+                // Skip operators with undefined values (e.g., { equals: undefined })
+                // This can happen when Payload sends incomplete where clauses
+                if (operatorValue === undefined) {
+                    continue;
+                }
                 let finalValue = operatorValue;
                 // Add wildcards for contains/like operators (Payload doesn't add them)
                 if ((op === 'contains' || op === 'like') && typeof operatorValue === 'string') {

package/dist/db-content-api/utilities/where.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/db-content-api/utilities/where.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport type { components } from '../generated/content-api-types.js'\n\ntype WhereClause = components['schemas']['WhereClause']\n\n// Payload's format: { fieldName: { operator: value }, and: [...], or: [...] }\n// Content API expects: { and: [{ path, operator, value }], or: [{ path, operator, value }] }\n//\n// The format stays different. This allows the Content API to evolve its filter schema,\n// for example to support composite types like Point, which are not lexicographically sortable.\n// Semantics must remain identical to Payload.\n\ntype ConvertOptions = {\n  /** Internal flag to track if we're inside a logical operator (and/or) */\n  insideLogicalOperator?: boolean\n  /** If true, transform 'parent' field to 'documentId' (used for version queries) */\n  parentToDocumentId?: boolean\n}\n\nexport function convertPayloadWhereToContentAPI(\n  where: undefined | Where,\n  options: ConvertOptions = {},\n): WhereClause {\n  // Empty where {} should be { and: [] } not undefined\n  // Content API requires a where clause structure even for \"no filter\"\n  if (!where || Object.keys(where).length === 0) {\n    return { and: [] }\n  }\n\n  // Extract the condition type (the variant with 'path', 'operator', 'value') from WhereClause union\n  type WhereCondition = Extract<WhereClause, { path: string }>\n  const conditions: WhereClause[] = []\n\n  for (const [key, value] of Object.entries(where)) {\n    if (key === 'and') {\n      // Recursively convert nested 'and' conditions, preserving options\n      const nestedConditions = (value as Where[]).map((item) =>\n        convertPayloadWhereToContentAPI(item, { ...options, insideLogicalOperator: true }),\n      )\n      return { and: nestedConditions }\n    } else if (key === 'or') {\n      // Recursively convert nested 'or' conditions, preserving options\n      const nestedConditions = (value as Where[]).map((item) =>\n        convertPayloadWhereToContentAPI(item, { ...options, insideLogicalOperator: true }),\n      )\n      return { or: nestedConditions }\n    } else {\n      // TODO: fix this in content api\n      // WORKAROUND: Payload uses 'parent' for version queries, but Content API expects 'documentId'\n      let fieldPath = key\n      if (options.parentToDocumentId && key === 'parent') {\n        fieldPath = 'documentId'\n      }\n\n      // Convert field conditions: { fieldName: { operator: value } }\n      // to: { path: fieldName, operator, value }\n      const operators = value as Record<string, unknown>\n      for (const [op, operatorValue] of Object.entries(operators)) {\n        let finalValue = operatorValue\n\n        // Add wildcards for contains/like operators (Payload doesn't add them)\n        if ((op === 'contains' || op === 'like') && typeof operatorValue === 'string') {\n          finalValue = `%${operatorValue}%`\n        }\n\n        conditions.push({\n          operator: op as WhereCondition['operator'],\n          path: fieldPath,\n          value: finalValue,\n        } as WhereCondition)\n      }\n    }\n  }\n\n  // If inside a logical operator (and/or), return conditions directly\n  // Otherwise, wrap in 'and' to match WhereClause type\n  if (options.insideLogicalOperator && conditions.length === 1) {\n    return conditions[0]\n  }\n\n  return { and: conditions }\n}\n"],"names":["convertPayloadWhereToContentAPI","where","options","Object","keys","length","and","conditions","key","value","entries","nestedConditions","map","item","insideLogicalOperator","or","fieldPath","parentToDocumentId","operators","op","operatorValue","finalValue","push","operator","path"],"mappings":"AAoBA,OAAO,SAASA,gCACdC,KAAwB,EACxBC,UAA0B,CAAC,CAAC;IAE5B,qDAAqD;IACrD,qEAAqE;IACrE,IAAI,CAACD,SAASE,OAAOC,IAAI,CAACH,OAAOI,MAAM,KAAK,GAAG;QAC7C,OAAO;YAAEC,KAAK,EAAE;QAAC;IACnB;IAIA,MAAMC,aAA4B,EAAE;IAEpC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIN,OAAOO,OAAO,CAACT,OAAQ;QAChD,IAAIO,QAAQ,OAAO;YACjB,kEAAkE;YAClE,MAAMG,mBAAmB,AAACF,MAAkBG,GAAG,CAAC,CAACC,OAC/Cb,gCAAgCa,MAAM;oBAAE,GAAGX,OAAO;oBAAEY,uBAAuB;gBAAK;YAElF,OAAO;gBAAER,KAAKK;YAAiB;QACjC,OAAO,IAAIH,QAAQ,MAAM;YACvB,iEAAiE;YACjE,MAAMG,mBAAmB,AAACF,MAAkBG,GAAG,CAAC,CAACC,OAC/Cb,gCAAgCa,MAAM;oBAAE,GAAGX,OAAO;oBAAEY,uBAAuB;gBAAK;YAElF,OAAO;gBAAEC,IAAIJ;YAAiB;QAChC,OAAO;YACL,gCAAgC;YAChC,8FAA8F;YAC9F,IAAIK,YAAYR;YAChB,IAAIN,QAAQe,kBAAkB,IAAIT,QAAQ,UAAU;gBAClDQ,YAAY;YACd;YAEA,+DAA+D;YAC/D,2CAA2C;YAC3C,MAAME,YAAYT;YAClB,KAAK,MAAM,CAACU,IAAIC,cAAc,IAAIjB,OAAOO,OAAO,CAACQ,WAAY;gBAC3D,IAAIG,aAAaD;gBAEjB,uEAAuE;gBACvE,IAAI,AAACD,CAAAA,OAAO,cAAcA,OAAO,MAAK,KAAM,OAAOC,kBAAkB,UAAU;oBAC7EC,aAAa,CAAC,CAAC,EAAED,cAAc,CAAC,CAAC;gBACnC;gBAEAb,WAAWe,IAAI,CAAC;oBACdC,UAAUJ;oBACVK,MAAMR;oBACNP,OAAOY;gBACT;YACF;QACF;IACF;IAEA,oEAAoE;IACpE,qDAAqD;IACrD,IAAInB,QAAQY,qBAAqB,IAAIP,WAAWF,MAAM,KAAK,GAAG;QAC5D,OAAOE,UAAU,CAAC,EAAE;IACtB;IAEA,OAAO;QAAED,KAAKC;IAAW;AAC3B"}
+{"version":3,"sources":["../../../src/db-content-api/utilities/where.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport type { components } from '../generated/content-api-types.js'\n\ntype WhereClause = components['schemas']['WhereClause']\n\n// Payload's format: { fieldName: { operator: value }, and: [...], or: [...] }\n// Content API expects: { and: [{ path, operator, value }], or: [{ path, operator, value }] }\n//\n// The format stays different. This allows the Content API to evolve its filter schema,\n// for example to support composite types like Point, which are not lexicographically sortable.\n// Semantics must remain identical to Payload.\n\ntype ConvertOptions = {\n  /** Internal flag to track if we're inside a logical operator (and/or) */\n  insideLogicalOperator?: boolean\n  /** If true, transform 'parent' field to 'documentId' (used for version queries) */\n  parentToDocumentId?: boolean\n}\n\nexport function convertPayloadWhereToContentAPI(\n  where: undefined | Where,\n  options: ConvertOptions = {},\n): WhereClause {\n  // Empty where {} should be { and: [] } not undefined\n  // Content API requires a where clause structure even for \"no filter\"\n  if (!where || Object.keys(where).length === 0) {\n    return { and: [] }\n  }\n\n  // Extract the condition type (the variant with 'path', 'operator', 'value') from WhereClause union\n  type WhereCondition = Extract<WhereClause, { path: string }>\n  const conditions: WhereClause[] = []\n\n  for (const [key, value] of Object.entries(where)) {\n    if (key === 'and') {\n      // Recursively convert nested 'and' conditions, preserving options\n      const nestedConditions = (value as Where[])\n        .map((item) =>\n          convertPayloadWhereToContentAPI(item, { ...options, insideLogicalOperator: true }),\n        )\n        // TODO: A better solution would be to make the `where` schema of `zod` in `content-api`\n        // more permissive. For now I'll do it this way because I have an idea to simplify\n        // everything we're doing with `where` (Post EAP) anyway.\n        // Filter out empty conditions { and: [] } that would be invalid\n        .filter((condition) => {\n          if ('and' in condition) {\n            return condition.and.length > 0\n          }\n          if ('or' in condition) {\n            return condition.or.length > 0\n          }\n          return true // Keep path/operator/value conditions\n        })\n\n      // If filtering resulted in no conditions, return empty and\n      if (nestedConditions.length === 0) {\n        return { and: [] }\n      }\n\n      return { and: nestedConditions }\n    } else if (key === 'or') {\n      // Recursively convert nested 'or' conditions, preserving options\n      const nestedConditions = (value as Where[])\n        .map((item) =>\n          convertPayloadWhereToContentAPI(item, { ...options, insideLogicalOperator: true }),\n        )\n        // Filter out empty conditions { and: [] } or { or: [] } that would be invalid\n        .filter((condition) => {\n          if ('and' in condition) {\n            return condition.and.length > 0\n          }\n          if ('or' in condition) {\n            return condition.or.length > 0\n          }\n          return true // Keep path/operator/value conditions\n        })\n\n      // If filtering resulted in no conditions, return empty and\n      if (nestedConditions.length === 0) {\n        return { and: [] }\n      }\n\n      return { or: nestedConditions }\n    } else {\n      // TODO: fix this in content api\n      // WORKAROUND: Payload uses 'parent' for version queries, but Content API expects 'documentId'\n      let fieldPath = key\n      if (options.parentToDocumentId && key === 'parent') {\n        fieldPath = 'documentId'\n      }\n\n      // Convert field conditions: { fieldName: { operator: value } }\n      // to: { path: fieldName, operator, value }\n      const operators = value as Record<string, unknown>\n\n      // Skip empty operator objects { fieldName: {} }\n      if (Object.keys(operators).length === 0) {\n        continue\n      }\n\n      for (const [op, operatorValue] of Object.entries(operators)) {\n        // Skip operators with undefined values (e.g., { equals: undefined })\n        // This can happen when Payload sends incomplete where clauses\n        if (operatorValue === undefined) {\n          continue\n        }\n\n        let finalValue = operatorValue\n\n        // Add wildcards for contains/like operators (Payload doesn't add them)\n        if ((op === 'contains' || op === 'like') && typeof operatorValue === 'string') {\n          finalValue = `%${operatorValue}%`\n        }\n\n        conditions.push({\n          operator: op as WhereCondition['operator'],\n          path: fieldPath,\n          value: finalValue,\n        } as WhereCondition)\n      }\n    }\n  }\n\n  // If inside a logical operator (and/or), return conditions directly\n  // Otherwise, wrap in 'and' to match WhereClause type\n  if (options.insideLogicalOperator && conditions.length === 1) {\n    return conditions[0]\n  }\n\n  return { and: conditions }\n}\n"],"names":["convertPayloadWhereToContentAPI","where","options","Object","keys","length","and","conditions","key","value","entries","nestedConditions","map","item","insideLogicalOperator","filter","condition","or","fieldPath","parentToDocumentId","operators","op","operatorValue","undefined","finalValue","push","operator","path"],"mappings":"AAoBA,OAAO,SAASA,gCACdC,KAAwB,EACxBC,UAA0B,CAAC,CAAC;IAE5B,qDAAqD;IACrD,qEAAqE;IACrE,IAAI,CAACD,SAASE,OAAOC,IAAI,CAACH,OAAOI,MAAM,KAAK,GAAG;QAC7C,OAAO;YAAEC,KAAK,EAAE;QAAC;IACnB;IAIA,MAAMC,aAA4B,EAAE;IAEpC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIN,OAAOO,OAAO,CAACT,OAAQ;QAChD,IAAIO,QAAQ,OAAO;YACjB,kEAAkE;YAClE,MAAMG,mBAAmB,AAACF,MACvBG,GAAG,CAAC,CAACC,OACJb,gCAAgCa,MAAM;oBAAE,GAAGX,OAAO;oBAAEY,uBAAuB;gBAAK,GAElF,wFAAwF;YACxF,kFAAkF;YAClF,yDAAyD;YACzD,gEAAgE;aAC/DC,MAAM,CAAC,CAACC;gBACP,IAAI,SAASA,WAAW;oBACtB,OAAOA,UAAUV,GAAG,CAACD,MAAM,GAAG;gBAChC;gBACA,IAAI,QAAQW,WAAW;oBACrB,OAAOA,UAAUC,EAAE,CAACZ,MAAM,GAAG;gBAC/B;gBACA,OAAO,KAAK,sCAAsC;;YACpD;YAEF,2DAA2D;YAC3D,IAAIM,iBAAiBN,MAAM,KAAK,GAAG;gBACjC,OAAO;oBAAEC,KAAK,EAAE;gBAAC;YACnB;YAEA,OAAO;gBAAEA,KAAKK;YAAiB;QACjC,OAAO,IAAIH,QAAQ,MAAM;YACvB,iEAAiE;YACjE,MAAMG,mBAAmB,AAACF,MACvBG,GAAG,CAAC,CAACC,OACJb,gCAAgCa,MAAM;oBAAE,GAAGX,OAAO;oBAAEY,uBAAuB;gBAAK,GAElF,8EAA8E;aAC7EC,MAAM,CAAC,CAACC;gBACP,IAAI,SAASA,WAAW;oBACtB,OAAOA,UAAUV,GAAG,CAACD,MAAM,GAAG;gBAChC;gBACA,IAAI,QAAQW,WAAW;oBACrB,OAAOA,UAAUC,EAAE,CAACZ,MAAM,GAAG;gBAC/B;gBACA,OAAO,KAAK,sCAAsC;;YACpD;YAEF,2DAA2D;YAC3D,IAAIM,iBAAiBN,MAAM,KAAK,GAAG;gBACjC,OAAO;oBAAEC,KAAK,EAAE;gBAAC;YACnB;YAEA,OAAO;gBAAEW,IAAIN;YAAiB;QAChC,OAAO;YACL,gCAAgC;YAChC,8FAA8F;YAC9F,IAAIO,YAAYV;YAChB,IAAIN,QAAQiB,kBAAkB,IAAIX,QAAQ,UAAU;gBAClDU,YAAY;YACd;YAEA,+DAA+D;YAC/D,2CAA2C;YAC3C,MAAME,YAAYX;YAElB,gDAAgD;YAChD,IAAIN,OAAOC,IAAI,CAACgB,WAAWf,MAAM,KAAK,GAAG;gBACvC;YACF;YAEA,KAAK,MAAM,CAACgB,IAAIC,cAAc,IAAInB,OAAOO,OAAO,CAACU,WAAY;gBAC3D,qEAAqE;gBACrE,8DAA8D;gBAC9D,IAAIE,kBAAkBC,WAAW;oBAC/B;gBACF;gBAEA,IAAIC,aAAaF;gBAEjB,uEAAuE;gBACvE,IAAI,AAACD,CAAAA,OAAO,cAAcA,OAAO,MAAK,KAAM,OAAOC,kBAAkB,UAAU;oBAC7EE,aAAa,CAAC,CAAC,EAAEF,cAAc,CAAC,CAAC;gBACnC;gBAEAf,WAAWkB,IAAI,CAAC;oBACdC,UAAUL;oBACVM,MAAMT;oBACNT,OAAOe;gBACT;YACF;QACF;IACF;IAEA,oEAAoE;IACpE,qDAAqD;IACrD,IAAItB,QAAQY,qBAAqB,IAAIP,WAAWF,MAAM,KAAK,GAAG;QAC5D,OAAOE,UAAU,CAAC,EAAE;IACtB;IAEA,OAAO;QAAED,KAAKC;IAAW;AAC3B"}

package/dist/exports/client.d.ts

@@ -1,3 +1,4 @@
 export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js';
 export { LogoutButton } from '../oauth/components/LogoutButton/index.js';
+export { ContentApiClientUploadHandler } from '../storage-content-api/client-uploads/ClientUploadHandler.js';
 //# sourceMappingURL=client.d.ts.map

package/dist/exports/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAA"}

package/dist/exports/client.js

@@ -1,4 +1,5 @@
 export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js';
 export { LogoutButton } from '../oauth/components/LogoutButton/index.js';
+export { ContentApiClientUploadHandler } from '../storage-content-api/client-uploads/ClientUploadHandler.js';
 
 //# sourceMappingURL=client.js.map

package/dist/exports/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js'\nexport { LogoutButton } from '../oauth/components/LogoutButton/index.js'\n"],"names":["DefaultLoginButton","LogoutButton"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,YAAY,QAAQ,4CAA2C"}
+{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["export { DefaultLoginButton } from '../oauth/components/LoginButton/index.js'\nexport { LogoutButton } from '../oauth/components/LogoutButton/index.js'\nexport { ContentApiClientUploadHandler } from '../storage-content-api/client-uploads/ClientUploadHandler.js'\n"],"names":["DefaultLoginButton","LogoutButton","ContentApiClientUploadHandler"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,2CAA0C;AAC7E,SAASC,YAAY,QAAQ,4CAA2C;AACxE,SAASC,6BAA6B,QAAQ,+DAA8D"}

package/dist/plugin/build-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAA;QACvB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CA+GpF"}
+{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../../src/plugin/build-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAiBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC1B,GAAG;IACF,KAAK,EAAE;QACL,eAAe,EAAE,MAAM,CAAA;QACvB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAC3B,CAAA;CACF,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAE7B;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAyHpF"}

package/dist/plugin/build-config.js

@@ -1,10 +1,13 @@
 import { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage';
+import { initClientUploads } from '@payloadcms/plugin-cloud-storage/utilities';
 import { lexicalEditor } from '@payloadcms/richtext-lexical';
 import { buildConfig as payloadBuildConfig } from 'payload';
 import { getTokenStore } from '../auth/token-store.js';
 import { contentAPIAdapter } from '../db-content-api/index.js';
 import { health } from '../endpoints/health.js';
 import { oAuth2Plugin } from '../oauth/index.js';
+import { createStorageClient } from '../storage-content-api/client.js';
+import { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js';
 import { contentApiStorageAdapter } from '../storage-content-api/index.js';
 /**
  * Figma platform wrapper for Payload's buildConfig.
@@ -76,6 +79,7 @@ import { contentApiStorageAdapter } from '../storage-content-api/index.js';
             contentSystemId
         };
         const adapter = contentApiStorageAdapter(storageConfig);
+        const storageClient = createStorageClient(storageConfig);
         const collectionsMap = uploadCollections.reduce((acc, c)=>{
             acc[c.slug] = {
                 adapter,
@@ -83,6 +87,16 @@ import { contentApiStorageAdapter } from '../storage-content-api/index.js';
             };
             return acc;
         }, {});
+        initClientUploads({
+            clientHandler: '@payloadcms/figma/client#ContentApiClientUploadHandler',
+            collections: collectionsMap,
+            config: config,
+            enabled: true,
+            serverHandler: getGenerateSignedURLHandler({
+                client: storageClient
+            }),
+            serverHandlerPath: '/content-api-storage-signed-url'
+        });
         storagePlugin = cloudStoragePlugin({
             collections: collectionsMap
         });