@payloadcms/figma 0.0.1-alpha.42 → 0.0.1-alpha.6

package/dist/auth/token-store.js

@@ -1,23 +1,6 @@
 /* eslint-disable perfectionist/sort-classes */ import Conf from 'conf';
 import { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
 import { deriveEncryptionKey } from './crypto-utils.js';
-/**
- * Environment-keyed instances for singleton pattern
- */ const instances = {};
-/**
- * Get the singleton TokenStore instance for an environment
- * Use this for all production code to ensure a single shared instance per environment
- *
- * @param environment - The environment to get the token store for
- * @returns The singleton TokenStore instance for that environment
- */ export function getTokenStore(environment) {
-    if (!instances[environment]) {
-        instances[environment] = new TokenStore({
-            environment
-        });
-    }
-    return instances[environment];
-}
 /**
  * Secure storage manager for Figma OAuth2 tokens
  *
@@ -28,22 +11,16 @@ import { deriveEncryptionKey } from './crypto-utils.js';
  *
  * Tokens are encrypted at rest with a machine-specific key and file permissions
  * are set to 0600 (owner read/write only)
- *
- * For production code, use getTokenStore() to get the singleton instance.
- * The constructor is still exported for test isolation.
  */ export class TokenStore {
     config;
     constructor(options){
-        if (process.env.AWS_EXECUTION_ENV) {
-            throw new Error('TokenStore cannot be used in AWS Lambda environments');
-        }
-        const environment = options?.environment ?? 'production';
-        const projectName = environment === 'production' ? 'payloadcms-figma' : `payloadcms-figma-${environment}`;
         this.config = new Conf({
-            clearInvalidConfig: true,
-            configName: options?.configName || projectName,
+            configName: options?.configName || 'payloadcms-figma',
+            projectName: 'payloadcms-figma',
+            // Enable encryption with machine-specific key for better security
             encryptionKey: options?.encryptionKey || deriveEncryptionKey(),
-            projectName
+            // Clear schema to avoid validation issues
+            clearInvalidConfig: true
         });
     }
     /**

package/dist/auth/token-store.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/token-store.ts"],"sourcesContent":["/* eslint-disable perfectionist/sort-classes */\nimport Conf from 'conf'\n\nimport type { Environment } from '../constants.js'\nimport type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js'\n\nimport { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js'\nimport { deriveEncryptionKey } from './crypto-utils.js'\n\n/**\n * Environment-keyed instances for singleton pattern\n */\nconst instances: Partial<Record<Environment, TokenStore>> = {}\n\n/**\n * Get the singleton TokenStore instance for an environment\n * Use this for all production code to ensure a single shared instance per environment\n *\n * @param environment - The environment to get the token store for\n * @returns The singleton TokenStore instance for that environment\n */\nexport function getTokenStore(environment: Environment): TokenStore {\n  if (!instances[environment]) {\n    instances[environment] = new TokenStore({ environment })\n  }\n  return instances[environment]\n}\n\n/**\n * Secure storage manager for Figma OAuth2 tokens\n *\n * Uses the `conf` library to store tokens in an OS-specific secure location:\n * - macOS: ~/Library/Preferences/payloadcms-figma\n * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma\n * - Windows: %APPDATA%/payloadcms-figma/Config\n *\n * Tokens are encrypted at rest with a machine-specific key and file permissions\n * are set to 0600 (owner read/write only)\n *\n * For production code, use getTokenStore() to get the singleton instance.\n * The constructor is still exported for test isolation.\n */\nexport class TokenStore {\n  private config: Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>\n\n  constructor(options?: TokenStoreConfig) {\n    if (process.env.AWS_EXECUTION_ENV) {\n      throw new Error('TokenStore cannot be used in AWS Lambda environments')\n    }\n\n    const environment = options?.environment ?? 'production'\n    const projectName =\n      environment === 'production' ? 'payloadcms-figma' : `payloadcms-figma-${environment}`\n\n    this.config = new Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>({\n      clearInvalidConfig: true,\n      configName: options?.configName || projectName,\n      encryptionKey: options?.encryptionKey || deriveEncryptionKey(),\n      projectName,\n    })\n  }\n\n  /**\n   * Retrieve stored tokens\n   * @returns FigmaTokens if stored, null otherwise\n   */\n  getTokens(): FigmaTokens | null {\n    const tokens = this.config.get('tokens')\n    return tokens || null\n  }\n\n  /**\n   * Store OAuth2 tokens securely\n   * @param tokens - Figma OAuth2 tokens to store\n   */\n  setTokens(tokens: FigmaTokens): void {\n    this.config.set('tokens', tokens)\n  }\n\n  /**\n   * Clear all stored tokens (used for logout)\n   */\n  clearTokens(): void {\n    this.config.delete('tokens')\n  }\n\n  /**\n   * Check if valid (non-expired) tokens exist\n   * @returns true if tokens exist and are not expired\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.getTokens()\n    if (!tokens) {\n      return false\n    }\n    return !this.isExpired()\n  }\n\n  /**\n   * Check if the current access token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isExpired(): boolean {\n    // Access config directly to avoid circular dependency with getTokens()\n    const tokens = this.config.get('tokens')\n    if (!tokens) {\n      return true\n    }\n\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = tokens.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Get the access token if it exists and is valid\n   * @returns Access token string or null if expired/missing\n   */\n  getAccessToken(): null | string {\n    if (!this.hasValidTokens()) {\n      return null\n    }\n    const tokens = this.getTokens()\n    return tokens?.accessToken || null\n  }\n\n  /**\n   * Get the refresh token if it exists\n   * @returns Refresh token string or null if missing\n   */\n  getRefreshToken(): null | string {\n    const tokens = this.getTokens()\n    return tokens?.refreshToken || null\n  }\n\n  /**\n   * Update just the access token after a refresh\n   * Preserves the existing refresh token and other metadata\n   * @param accessToken - New access token\n   * @param expiresIn - Expiration time in seconds\n   */\n  updateAccessToken(accessToken: string, expiresIn: number): void {\n    const existingTokens = this.getTokens()\n    if (!existingTokens) {\n      throw new Error('Cannot update access token: no existing tokens found')\n    }\n\n    const expiresAt = Date.now() + expiresIn * 1000\n\n    this.setTokens({\n      ...existingTokens,\n      accessToken,\n      expiresAt,\n    })\n  }\n\n  /**\n   * Get the path to the config file (useful for debugging)\n   * @returns Absolute path to the token storage file\n   */\n  getStoragePath(): string {\n    return this.config.path\n  }\n\n  /**\n   * Retrieve a project token for a specific tenant\n   * Automatically removes expired tokens from storage\n   * @param tenantId - The tenant/CMS ID\n   * @returns ProjectToken if stored and valid, null otherwise\n   */\n  getProjectToken(tenantId: string): null | ProjectToken {\n    const projectTokens = this.config.get('projectTokens') || {}\n    const projectToken = projectTokens[tenantId]\n\n    if (!projectToken) {\n      return null\n    }\n\n    // Auto-cleanup expired project token\n    if (this.isProjectTokenExpired(projectToken)) {\n      this.clearProjectToken(tenantId)\n      return null\n    }\n\n    return projectToken\n  }\n\n  /**\n   * Store a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   * @param projectToken - The project token to store\n   */\n  setProjectToken(tenantId: string, projectToken: ProjectToken): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    projectTokens[tenantId] = projectToken\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   */\n  clearProjectToken(tenantId: string): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    delete projectTokens[tenantId]\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear all project tokens\n   */\n  clearAllProjectTokens(): void {\n    this.config.delete('projectTokens')\n  }\n\n  /**\n   * Check if a project token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @param projectToken - The project token to check\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isProjectTokenExpired(projectToken: ProjectToken): boolean {\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = projectToken.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Check if a valid (non-expired) project token exists for a tenant\n   * @param tenantId - The tenant/CMS ID\n   * @returns true if token exists and is not expired\n   */\n  hasValidProjectToken(tenantId: string): boolean {\n    const projectToken = this.getProjectToken(tenantId)\n    if (!projectToken) {\n      return false\n    }\n    return !this.isProjectTokenExpired(projectToken)\n  }\n\n  /**\n   * Get validated JWT claims from a project token\n   * @param tenantId - The tenant/CMS ID\n   * @returns JWT payload claims or null if token not found or has no claims\n   */\n  getProjectTokenClaims(tenantId: string): JWTPayload | null {\n    const projectToken = this.getProjectToken(tenantId)\n    return projectToken?.claims || null\n  }\n\n  /**\n   * Get all tenant IDs that have stored project tokens\n   * @returns Array of tenant IDs\n   */\n  getAllProjectTokenTenantIds(): string[] {\n    const projectTokens = this.config.get('projectTokens') || {}\n    return Object.keys(projectTokens)\n  }\n}\n"],"names":["Conf","TOKEN_EXPIRY_BUFFER_SECONDS","deriveEncryptionKey","instances","getTokenStore","environment","TokenStore","config","options","process","env","AWS_EXECUTION_ENV","Error","projectName","clearInvalidConfig","configName","encryptionKey","getTokens","tokens","get","setTokens","set","clearTokens","delete","hasValidTokens","isExpired","now","Date","bufferMs","expiryWithBuffer","expiresAt","getAccessToken","accessToken","getRefreshToken","refreshToken","updateAccessToken","expiresIn","existingTokens","getStoragePath","path","getProjectToken","tenantId","projectTokens","projectToken","isProjectTokenExpired","clearProjectToken","setProjectToken","clearAllProjectTokens","hasValidProjectToken","getProjectTokenClaims","claims","getAllProjectTokenTenantIds","Object","keys"],"mappings":"AAAA,6CAA6C,GAC7C,OAAOA,UAAU,OAAM;AAKvB,SAASC,2BAA2B,QAAQ,qBAAoB;AAChE,SAASC,mBAAmB,QAAQ,oBAAmB;AAEvD;;CAEC,GACD,MAAMC,YAAsD,CAAC;AAE7D;;;;;;CAMC,GACD,OAAO,SAASC,cAAcC,WAAwB;IACpD,IAAI,CAACF,SAAS,CAACE,YAAY,EAAE;QAC3BF,SAAS,CAACE,YAAY,GAAG,IAAIC,WAAW;YAAED;QAAY;IACxD;IACA,OAAOF,SAAS,CAACE,YAAY;AAC/B;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC;IACHC,OAAkF;IAE1F,YAAYC,OAA0B,CAAE;QACtC,IAAIC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;YACjC,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAMP,cAAcG,SAASH,eAAe;QAC5C,MAAMQ,cACJR,gBAAgB,eAAe,qBAAqB,CAAC,iBAAiB,EAAEA,aAAa;QAEvF,IAAI,CAACE,MAAM,GAAG,IAAIP,KAA2E;YAC3Fc,oBAAoB;YACpBC,YAAYP,SAASO,cAAcF;YACnCG,eAAeR,SAASQ,iBAAiBd;YACzCW;QACF;IACF;IAEA;;;GAGC,GACDI,YAAgC;QAC9B,MAAMC,SAAS,IAAI,CAACX,MAAM,CAACY,GAAG,CAAC;QAC/B,OAAOD,UAAU;IACnB;IAEA;;;GAGC,GACDE,UAAUF,MAAmB,EAAQ;QACnC,IAAI,CAACX,MAAM,CAACc,GAAG,CAAC,UAAUH;IAC5B;IAEA;;GAEC,GACDI,cAAoB;QAClB,IAAI,CAACf,MAAM,CAACgB,MAAM,CAAC;IACrB;IAEA;;;GAGC,GACDC,iBAA0B;QACxB,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,IAAI,CAACC,QAAQ;YACX,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACO,SAAS;IACxB;IAEA;;;;GAIC,GACDA,YAAqB;QACnB,uEAAuE;QACvE,MAAMP,SAAS,IAAI,CAACX,MAAM,CAACY,GAAG,CAAC;QAC/B,IAAI,CAACD,QAAQ;YACX,OAAO;QACT;QAEA,MAAMQ,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAW3B,8BAA8B;QAC/C,MAAM4B,mBAAmBX,OAAOY,SAAS,GAAGF;QAE5C,OAAOF,OAAOG;IAChB;IAEA;;;GAGC,GACDE,iBAAgC;QAC9B,IAAI,CAAC,IAAI,CAACP,cAAc,IAAI;YAC1B,OAAO;QACT;QACA,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQc,eAAe;IAChC;IAEA;;;GAGC,GACDC,kBAAiC;QAC/B,MAAMf,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQgB,gBAAgB;IACjC;IAEA;;;;;GAKC,GACDC,kBAAkBH,WAAmB,EAAEI,SAAiB,EAAQ;QAC9D,MAAMC,iBAAiB,IAAI,CAACpB,SAAS;QACrC,IAAI,CAACoB,gBAAgB;YACnB,MAAM,IAAIzB,MAAM;QAClB;QAEA,MAAMkB,YAAYH,KAAKD,GAAG,KAAKU,YAAY;QAE3C,IAAI,CAAChB,SAAS,CAAC;YACb,GAAGiB,cAAc;YACjBL;YACAF;QACF;IACF;IAEA;;;GAGC,GACDQ,iBAAyB;QACvB,OAAO,IAAI,CAAC/B,MAAM,CAACgC,IAAI;IACzB;IAEA;;;;;GAKC,GACDC,gBAAgBC,QAAgB,EAAuB;QACrD,MAAMC,gBAAgB,IAAI,CAACnC,MAAM,CAACY,GAAG,CAAC,oBAAoB,CAAC;QAC3D,MAAMwB,eAAeD,aAAa,CAACD,SAAS;QAE5C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QAEA,qCAAqC;QACrC,IAAI,IAAI,CAACC,qBAAqB,CAACD,eAAe;YAC5C,IAAI,CAACE,iBAAiB,CAACJ;YACvB,OAAO;QACT;QAEA,OAAOE;IACT;IAEA;;;;GAIC,GACDG,gBAAgBL,QAAgB,EAAEE,YAA0B,EAAQ;QAClE,MAAMD,gBAAgB,IAAI,CAACnC,MAAM,CAACY,GAAG,CAAC,oBAAoB,CAAC;QAC3DuB,aAAa,CAACD,SAAS,GAAGE;QAC1B,IAAI,CAACpC,MAAM,CAACc,GAAG,CAAC,iBAAiBqB;IACnC;IAEA;;;GAGC,GACDG,kBAAkBJ,QAAgB,EAAQ;QACxC,MAAMC,gBAAgB,IAAI,CAACnC,MAAM,CAACY,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOuB,aAAa,CAACD,SAAS;QAC9B,IAAI,CAAClC,MAAM,CAACc,GAAG,CAAC,iBAAiBqB;IACnC;IAEA;;GAEC,GACDK,wBAA8B;QAC5B,IAAI,CAACxC,MAAM,CAACgB,MAAM,CAAC;IACrB;IAEA;;;;;GAKC,GACDqB,sBAAsBD,YAA0B,EAAW;QACzD,MAAMjB,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAW3B,8BAA8B;QAC/C,MAAM4B,mBAAmBc,aAAab,SAAS,GAAGF;QAElD,OAAOF,OAAOG;IAChB;IAEA;;;;GAIC,GACDmB,qBAAqBP,QAAgB,EAAW;QAC9C,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACC,qBAAqB,CAACD;IACrC;IAEA;;;;GAIC,GACDM,sBAAsBR,QAAgB,EAAqB;QACzD,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,OAAOE,cAAcO,UAAU;IACjC;IAEA;;;GAGC,GACDC,8BAAwC;QACtC,MAAMT,gBAAgB,IAAI,CAACnC,MAAM,CAACY,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOiC,OAAOC,IAAI,CAACX;IACrB;AACF"}
+{"version":3,"sources":["../../src/auth/token-store.ts"],"sourcesContent":["/* eslint-disable perfectionist/sort-classes */\nimport Conf from 'conf'\n\nimport type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js'\n\nimport { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js'\nimport { deriveEncryptionKey } from './crypto-utils.js'\n\n/**\n * Secure storage manager for Figma OAuth2 tokens\n *\n * Uses the `conf` library to store tokens in an OS-specific secure location:\n * - macOS: ~/Library/Preferences/payloadcms-figma\n * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma\n * - Windows: %APPDATA%/payloadcms-figma/Config\n *\n * Tokens are encrypted at rest with a machine-specific key and file permissions\n * are set to 0600 (owner read/write only)\n */\nexport class TokenStore {\n  private config: Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>\n\n  constructor(options?: TokenStoreConfig) {\n    this.config = new Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>({\n      configName: options?.configName || 'payloadcms-figma',\n      projectName: 'payloadcms-figma',\n      // Enable encryption with machine-specific key for better security\n      encryptionKey: options?.encryptionKey || deriveEncryptionKey(),\n      // Clear schema to avoid validation issues\n      clearInvalidConfig: true,\n    })\n  }\n\n  /**\n   * Retrieve stored tokens\n   * @returns FigmaTokens if stored, null otherwise\n   */\n  getTokens(): FigmaTokens | null {\n    const tokens = this.config.get('tokens')\n    return tokens || null\n  }\n\n  /**\n   * Store OAuth2 tokens securely\n   * @param tokens - Figma OAuth2 tokens to store\n   */\n  setTokens(tokens: FigmaTokens): void {\n    this.config.set('tokens', tokens)\n  }\n\n  /**\n   * Clear all stored tokens (used for logout)\n   */\n  clearTokens(): void {\n    this.config.delete('tokens')\n  }\n\n  /**\n   * Check if valid (non-expired) tokens exist\n   * @returns true if tokens exist and are not expired\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.getTokens()\n    if (!tokens) {\n      return false\n    }\n    return !this.isExpired()\n  }\n\n  /**\n   * Check if the current access token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isExpired(): boolean {\n    // Access config directly to avoid circular dependency with getTokens()\n    const tokens = this.config.get('tokens')\n    if (!tokens) {\n      return true\n    }\n\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = tokens.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Get the access token if it exists and is valid\n   * @returns Access token string or null if expired/missing\n   */\n  getAccessToken(): null | string {\n    if (!this.hasValidTokens()) {\n      return null\n    }\n    const tokens = this.getTokens()\n    return tokens?.accessToken || null\n  }\n\n  /**\n   * Get the refresh token if it exists\n   * @returns Refresh token string or null if missing\n   */\n  getRefreshToken(): null | string {\n    const tokens = this.getTokens()\n    return tokens?.refreshToken || null\n  }\n\n  /**\n   * Update just the access token after a refresh\n   * Preserves the existing refresh token and other metadata\n   * @param accessToken - New access token\n   * @param expiresIn - Expiration time in seconds\n   */\n  updateAccessToken(accessToken: string, expiresIn: number): void {\n    const existingTokens = this.getTokens()\n    if (!existingTokens) {\n      throw new Error('Cannot update access token: no existing tokens found')\n    }\n\n    const expiresAt = Date.now() + expiresIn * 1000\n\n    this.setTokens({\n      ...existingTokens,\n      accessToken,\n      expiresAt,\n    })\n  }\n\n  /**\n   * Get the path to the config file (useful for debugging)\n   * @returns Absolute path to the token storage file\n   */\n  getStoragePath(): string {\n    return this.config.path\n  }\n\n  /**\n   * Retrieve a project token for a specific tenant\n   * Automatically removes expired tokens from storage\n   * @param tenantId - The tenant/CMS ID\n   * @returns ProjectToken if stored and valid, null otherwise\n   */\n  getProjectToken(tenantId: string): null | ProjectToken {\n    const projectTokens = this.config.get('projectTokens') || {}\n    const projectToken = projectTokens[tenantId]\n\n    if (!projectToken) {\n      return null\n    }\n\n    // Auto-cleanup expired project token\n    if (this.isProjectTokenExpired(projectToken)) {\n      this.clearProjectToken(tenantId)\n      return null\n    }\n\n    return projectToken\n  }\n\n  /**\n   * Store a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   * @param projectToken - The project token to store\n   */\n  setProjectToken(tenantId: string, projectToken: ProjectToken): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    projectTokens[tenantId] = projectToken\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   */\n  clearProjectToken(tenantId: string): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    delete projectTokens[tenantId]\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear all project tokens\n   */\n  clearAllProjectTokens(): void {\n    this.config.delete('projectTokens')\n  }\n\n  /**\n   * Check if a project token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @param projectToken - The project token to check\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isProjectTokenExpired(projectToken: ProjectToken): boolean {\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = projectToken.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Check if a valid (non-expired) project token exists for a tenant\n   * @param tenantId - The tenant/CMS ID\n   * @returns true if token exists and is not expired\n   */\n  hasValidProjectToken(tenantId: string): boolean {\n    const projectToken = this.getProjectToken(tenantId)\n    if (!projectToken) {\n      return false\n    }\n    return !this.isProjectTokenExpired(projectToken)\n  }\n\n  /**\n   * Get validated JWT claims from a project token\n   * @param tenantId - The tenant/CMS ID\n   * @returns JWT payload claims or null if token not found or has no claims\n   */\n  getProjectTokenClaims(tenantId: string): JWTPayload | null {\n    const projectToken = this.getProjectToken(tenantId)\n    return projectToken?.claims || null\n  }\n\n  /**\n   * Get all tenant IDs that have stored project tokens\n   * @returns Array of tenant IDs\n   */\n  getAllProjectTokenTenantIds(): string[] {\n    const projectTokens = this.config.get('projectTokens') || {}\n    return Object.keys(projectTokens)\n  }\n}\n"],"names":["Conf","TOKEN_EXPIRY_BUFFER_SECONDS","deriveEncryptionKey","TokenStore","config","options","configName","projectName","encryptionKey","clearInvalidConfig","getTokens","tokens","get","setTokens","set","clearTokens","delete","hasValidTokens","isExpired","now","Date","bufferMs","expiryWithBuffer","expiresAt","getAccessToken","accessToken","getRefreshToken","refreshToken","updateAccessToken","expiresIn","existingTokens","Error","getStoragePath","path","getProjectToken","tenantId","projectTokens","projectToken","isProjectTokenExpired","clearProjectToken","setProjectToken","clearAllProjectTokens","hasValidProjectToken","getProjectTokenClaims","claims","getAllProjectTokenTenantIds","Object","keys"],"mappings":"AAAA,6CAA6C,GAC7C,OAAOA,UAAU,OAAM;AAIvB,SAASC,2BAA2B,QAAQ,qBAAoB;AAChE,SAASC,mBAAmB,QAAQ,oBAAmB;AAEvD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC;IACHC,OAAkF;IAE1F,YAAYC,OAA0B,CAAE;QACtC,IAAI,CAACD,MAAM,GAAG,IAAIJ,KAA2E;YAC3FM,YAAYD,SAASC,cAAc;YACnCC,aAAa;YACb,kEAAkE;YAClEC,eAAeH,SAASG,iBAAiBN;YACzC,0CAA0C;YAC1CO,oBAAoB;QACtB;IACF;IAEA;;;GAGC,GACDC,YAAgC;QAC9B,MAAMC,SAAS,IAAI,CAACP,MAAM,CAACQ,GAAG,CAAC;QAC/B,OAAOD,UAAU;IACnB;IAEA;;;GAGC,GACDE,UAAUF,MAAmB,EAAQ;QACnC,IAAI,CAACP,MAAM,CAACU,GAAG,CAAC,UAAUH;IAC5B;IAEA;;GAEC,GACDI,cAAoB;QAClB,IAAI,CAACX,MAAM,CAACY,MAAM,CAAC;IACrB;IAEA;;;GAGC,GACDC,iBAA0B;QACxB,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,IAAI,CAACC,QAAQ;YACX,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACO,SAAS;IACxB;IAEA;;;;GAIC,GACDA,YAAqB;QACnB,uEAAuE;QACvE,MAAMP,SAAS,IAAI,CAACP,MAAM,CAACQ,GAAG,CAAC;QAC/B,IAAI,CAACD,QAAQ;YACX,OAAO;QACT;QAEA,MAAMQ,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAWpB,8BAA8B;QAC/C,MAAMqB,mBAAmBX,OAAOY,SAAS,GAAGF;QAE5C,OAAOF,OAAOG;IAChB;IAEA;;;GAGC,GACDE,iBAAgC;QAC9B,IAAI,CAAC,IAAI,CAACP,cAAc,IAAI;YAC1B,OAAO;QACT;QACA,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQc,eAAe;IAChC;IAEA;;;GAGC,GACDC,kBAAiC;QAC/B,MAAMf,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQgB,gBAAgB;IACjC;IAEA;;;;;GAKC,GACDC,kBAAkBH,WAAmB,EAAEI,SAAiB,EAAQ;QAC9D,MAAMC,iBAAiB,IAAI,CAACpB,SAAS;QACrC,IAAI,CAACoB,gBAAgB;YACnB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAMR,YAAYH,KAAKD,GAAG,KAAKU,YAAY;QAE3C,IAAI,CAAChB,SAAS,CAAC;YACb,GAAGiB,cAAc;YACjBL;YACAF;QACF;IACF;IAEA;;;GAGC,GACDS,iBAAyB;QACvB,OAAO,IAAI,CAAC5B,MAAM,CAAC6B,IAAI;IACzB;IAEA;;;;;GAKC,GACDC,gBAAgBC,QAAgB,EAAuB;QACrD,MAAMC,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,MAAMyB,eAAeD,aAAa,CAACD,SAAS;QAE5C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QAEA,qCAAqC;QACrC,IAAI,IAAI,CAACC,qBAAqB,CAACD,eAAe;YAC5C,IAAI,CAACE,iBAAiB,CAACJ;YACvB,OAAO;QACT;QAEA,OAAOE;IACT;IAEA;;;;GAIC,GACDG,gBAAgBL,QAAgB,EAAEE,YAA0B,EAAQ;QAClE,MAAMD,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3DwB,aAAa,CAACD,SAAS,GAAGE;QAC1B,IAAI,CAACjC,MAAM,CAACU,GAAG,CAAC,iBAAiBsB;IACnC;IAEA;;;GAGC,GACDG,kBAAkBJ,QAAgB,EAAQ;QACxC,MAAMC,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOwB,aAAa,CAACD,SAAS;QAC9B,IAAI,CAAC/B,MAAM,CAACU,GAAG,CAAC,iBAAiBsB;IACnC;IAEA;;GAEC,GACDK,wBAA8B;QAC5B,IAAI,CAACrC,MAAM,CAACY,MAAM,CAAC;IACrB;IAEA;;;;;GAKC,GACDsB,sBAAsBD,YAA0B,EAAW;QACzD,MAAMlB,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAWpB,8BAA8B;QAC/C,MAAMqB,mBAAmBe,aAAad,SAAS,GAAGF;QAElD,OAAOF,OAAOG;IAChB;IAEA;;;;GAIC,GACDoB,qBAAqBP,QAAgB,EAAW;QAC9C,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACC,qBAAqB,CAACD;IACrC;IAEA;;;;GAIC,GACDM,sBAAsBR,QAAgB,EAAqB;QACzD,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,OAAOE,cAAcO,UAAU;IACjC;IAEA;;;GAGC,GACDC,8BAAwC;QACtC,MAAMT,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOkC,OAAOC,IAAI,CAACX;IACrB;AACF"}

package/dist/auth/types.d.ts

@@ -1,6 +1,5 @@
 import type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User } from '@figma/rest-api-spec';
 import type { JWTPayload as JoseJWTPayload } from 'jose';
-import type { Environment } from '../constants.js';
 /**
  * Standard OAuth2 scopes for user-level permissions
  * @see https://www.figma.com/developers/api#oauth2
@@ -106,14 +105,12 @@ export interface OAuthTokenRefreshParams {
 /**
  * Configuration for token storage
  */
-export type TokenStoreConfig = {
-    /** Config file name (for testing) */
+export interface TokenStoreConfig {
+    /** Custom config name (defaults to 'payloadcms-figma') */
     configName?: string;
-    /** Encryption key (for testing) */
+    /** Enable encryption (defaults to true) */
     encryptionKey?: string;
-    /** Environment for config file naming */
-    environment?: Environment;
-};
+}
 /**
  * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients
  * @see https://datatracker.ietf.org/doc/html/rfc7636

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,oCAAoC,EACpC,IAAI,EACL,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,MAAM,CAAA;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAElD;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,qBAAqB,GACrB,sBAAsB,GACtB,eAAe,GACf,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAExD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE7D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;IAC1B,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,KAAK,EACD,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,CAAA;IAC5B,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,UAAU,EAAE,oBAAoB,CAAA;IAChC,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,UAAU,EAAE,eAAe,CAAA;IAC3B,oBAAoB;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yCAAyC;IACzC,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0CAA0C;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,+BAA+B;IAC/B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,YAAY,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAA;AAE9F;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kCAAkC,GAClC,oCAAoC,CAAA;AAExC;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,IAAI,EAAE;QACJ,uBAAuB;QACvB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,oCAAoC,EACpC,IAAI,EACL,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,MAAM,CAAA;AAExD;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,qBAAqB,GACrB,sBAAsB,GACtB,eAAe,GACf,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAExD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE7D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;IAC1B,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,KAAK,EACD,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,CAAA;IAC5B,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,UAAU,EAAE,oBAAoB,CAAA;IAChC,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,UAAU,EAAE,eAAe,CAAA;IAC3B,oBAAoB;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0CAA0C;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,+BAA+B;IAC/B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,YAAY,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAA;AAE9F;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kCAAkC,GAClC,oCAAoC,CAAA;AAExC;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,IAAI,EAAE;QACJ,uBAAuB;QACvB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}

package/dist/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type {\n  ErrorResponsePayloadWithErrMessage,\n  ErrorResponsePayloadWithErrorBoolean,\n  User,\n} from '@figma/rest-api-spec'\nimport type { JWTPayload as JoseJWTPayload } from 'jose'\n\nimport type { Environment } from '../constants.js'\n\n/**\n * Standard OAuth2 scopes for user-level permissions\n * @see https://www.figma.com/developers/api#oauth2\n */\nexport type FigmaOAuthScope =\n  | 'current_user:read' // Read user name, email, profile image\n  | 'file_comments:read' // Read file comments\n  | 'file_comments:write' // Post/delete comments and reactions\n  | 'file_content:read' // Read file contents (nodes, editor type)\n  | 'file_dev_resources:read' // Read dev resources\n  | 'file_dev_resources:write' // Write dev resources\n  | 'file_metadata:read' // Read file metadata\n  | 'file_variables:read' // Read variables (Enterprise only)\n  | 'file_variables:write' // Write variables (Enterprise only)\n  | 'file_versions:read' // Read version history\n  | 'files:read' // @deprecated Read files, projects, users\n  | 'library_analytics:read' // Read library analytics\n  | 'library_assets:read' // Read published components/styles data\n  | 'library_content:read' // Read published components/styles\n  | 'projects:read' // List projects and files\n  | 'team_library_content:read' // Read team published content\n  | 'webhooks:read' // Read webhook metadata\n  | 'webhooks:write' // Create/manage webhooks\n\n/**\n * Organization-level OAuth2 scopes\n * Requires organization admin permissions\n */\nexport type FigmaOrgOAuthScope = 'org:activity_log_read' // Read organization activity logs\n\n/**\n * All valid Figma OAuth scopes\n */\nexport type FigmaScope = FigmaOAuthScope | FigmaOrgOAuthScope\n\n/**\n * OAuth tokens returned from Figma API (internal format)\n */\nexport interface FigmaTokens {\n  /** OAuth2 access token for making authenticated API requests */\n  accessToken: string\n  /** Unix timestamp (milliseconds) when the access token expires */\n  expiresAt: number\n  /** OAuth2 refresh token for obtaining new access tokens */\n  refreshToken: string\n  /** OAuth scopes granted to this token */\n  scopes?: FigmaOAuthScope[]\n  /** Token type (typically \"Bearer\") */\n  tokenType?: string\n  /** Figma user ID string */\n  userId?: string\n}\n\n/**\n * Raw token response from Figma OAuth2 token endpoint\n * Response from POST https://api.figma.com/v1/oauth/token\n */\nexport interface FigmaTokenResponse {\n  /** OAuth2 access token */\n  access_token: string\n  /** Token expiration time in seconds */\n  expires_in: number\n  /** OAuth2 refresh token */\n  refresh_token: string\n  /** Space-separated list of granted scopes */\n  scope?: string\n  /** Token type (typically \"Bearer\") */\n  token_type?: string\n  /** Figma user ID string */\n  user_id_string?: string\n}\n\n/**\n * OAuth2 error response\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\n */\nexport interface OAuthErrorResponse {\n  /** Error code */\n  error:\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_request'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n  /** Human-readable error description */\n  error_description?: string\n  /** URI with error information */\n  error_uri?: string\n}\n\n/**\n * Parameters for OAuth2 authorization URL\n */\nexport interface OAuthAuthorizationParams {\n  /** OAuth2 client ID */\n  client_id: string\n  /** PKCE code challenge (optional but recommended) */\n  code_challenge?: string\n  /** PKCE code challenge method (must be S256 if using PKCE) */\n  code_challenge_method?: 'S256'\n  /** Redirect URI for callback */\n  redirect_uri: string\n  /** Response type (always \"code\" for authorization code flow) */\n  response_type: 'code'\n  /** Requested scopes (space-separated) */\n  scope: string\n  /** State parameter for CSRF protection */\n  state: string\n}\n\n/**\n * Parameters for OAuth2 token exchange\n */\nexport interface OAuthTokenExchangeParams {\n  /** Authorization code from callback */\n  code: string\n  /** PKCE code verifier (if PKCE was used) */\n  code_verifier?: string\n  /** Grant type (always \"authorization_code\") */\n  grant_type: 'authorization_code'\n  /** Redirect URI (must match authorization request) */\n  redirect_uri: string\n}\n\n/**\n * Parameters for OAuth2 token refresh\n */\nexport interface OAuthTokenRefreshParams {\n  /** Grant type (always \"refresh_token\") */\n  grant_type: 'refresh_token'\n  /** Refresh token */\n  refresh_token: string\n}\n\n/**\n * Configuration for token storage\n */\nexport type TokenStoreConfig = {\n  /** Config file name (for testing) */\n  configName?: string\n  /** Encryption key (for testing) */\n  encryptionKey?: string\n  /** Environment for config file naming */\n  environment?: Environment\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients\n * @see https://datatracker.ietf.org/doc/html/rfc7636\n */\nexport interface PKCEPair {\n  /** Code challenge derived from code verifier */\n  codeChallenge: string\n  /** Code challenge method (always S256) */\n  codeChallengeMethod: 'S256'\n  /** Code verifier - random string used to generate challenge */\n  codeVerifier: string\n}\n\n/**\n * OAuth configuration for Figma API (public client with PKCE)\n *\n * This configuration is for a PUBLIC OAuth client that uses PKCE\n * (Proof Key for Code Exchange) instead of a client secret.\n * Public clients (like CLIs) cannot securely store client secrets.\n */\nexport interface OAuthConfig {\n  /** Figma OAuth authorization URL */\n  authorizationUrl: string\n  /** OAuth2 client ID (public client) */\n  clientId: string\n  /** OAuth2 redirect URI for callback */\n  redirectUri: string\n  /** Figma OAuth token refresh URL */\n  refreshUrl: string\n  /** OAuth2 scopes to request */\n  scopes: FigmaOAuthScope[]\n  /** Figma OAuth token exchange URL */\n  tokenUrl: string\n}\n\n/**\n * Re-export Figma's official types for convenience\n */\nexport type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User }\n\n/**\n * Type alias for Figma API error responses\n * Combines both error response formats from Figma's REST API\n */\nexport type FigmaErrorResponse =\n  | ErrorResponsePayloadWithErrMessage\n  | ErrorResponsePayloadWithErrorBoolean\n\n/**\n * Figma user information\n * Re-exported from @figma/rest-api-spec\n */\nexport type FigmaUser = User\n\n/**\n * JWT payload structure from Figma project tokens\n * Extends jose's standard JWTPayload with Figma-specific claims\n */\nexport interface JWTPayload extends JoseJWTPayload {\n  [key: string]: unknown\n  /** User email address */\n  email?: string\n  /** Tenant/CMS ID this token is scoped to */\n  tenant_id?: string\n}\n\n/**\n * Project token (JWT) for authenticating to Content API\n * Used by local Payload instances to make authenticated requests\n */\nexport interface ProjectToken {\n  /** Validated JWT claims */\n  claims?: JWTPayload\n  /** Unix timestamp (milliseconds) when the token expires (from validated exp claim) */\n  expiresAt: number\n  /** Tenant/CMS ID this token is scoped to */\n  tenantId: string\n  /** JWT token string signed by Figma API */\n  token: string\n}\n\n/**\n * Raw project token response from Figma API\n * Response from GET https://api.figma.com/v1/cms/:id/token/\n */\nexport interface ProjectTokenResponse {\n  /** Response metadata containing the JWT token */\n  meta: {\n    /** JWT token string */\n    token: string\n  }\n}\n"],"names":[],"mappings":"AA6OA;;;CAGC,GACD,WAMC"}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type {\n  ErrorResponsePayloadWithErrMessage,\n  ErrorResponsePayloadWithErrorBoolean,\n  User,\n} from '@figma/rest-api-spec'\nimport type { JWTPayload as JoseJWTPayload } from 'jose'\n\n/**\n * Standard OAuth2 scopes for user-level permissions\n * @see https://www.figma.com/developers/api#oauth2\n */\nexport type FigmaOAuthScope =\n  | 'current_user:read' // Read user name, email, profile image\n  | 'file_comments:read' // Read file comments\n  | 'file_comments:write' // Post/delete comments and reactions\n  | 'file_content:read' // Read file contents (nodes, editor type)\n  | 'file_dev_resources:read' // Read dev resources\n  | 'file_dev_resources:write' // Write dev resources\n  | 'file_metadata:read' // Read file metadata\n  | 'file_variables:read' // Read variables (Enterprise only)\n  | 'file_variables:write' // Write variables (Enterprise only)\n  | 'file_versions:read' // Read version history\n  | 'files:read' // @deprecated Read files, projects, users\n  | 'library_analytics:read' // Read library analytics\n  | 'library_assets:read' // Read published components/styles data\n  | 'library_content:read' // Read published components/styles\n  | 'projects:read' // List projects and files\n  | 'team_library_content:read' // Read team published content\n  | 'webhooks:read' // Read webhook metadata\n  | 'webhooks:write' // Create/manage webhooks\n\n/**\n * Organization-level OAuth2 scopes\n * Requires organization admin permissions\n */\nexport type FigmaOrgOAuthScope = 'org:activity_log_read' // Read organization activity logs\n\n/**\n * All valid Figma OAuth scopes\n */\nexport type FigmaScope = FigmaOAuthScope | FigmaOrgOAuthScope\n\n/**\n * OAuth tokens returned from Figma API (internal format)\n */\nexport interface FigmaTokens {\n  /** OAuth2 access token for making authenticated API requests */\n  accessToken: string\n  /** Unix timestamp (milliseconds) when the access token expires */\n  expiresAt: number\n  /** OAuth2 refresh token for obtaining new access tokens */\n  refreshToken: string\n  /** OAuth scopes granted to this token */\n  scopes?: FigmaOAuthScope[]\n  /** Token type (typically \"Bearer\") */\n  tokenType?: string\n  /** Figma user ID string */\n  userId?: string\n}\n\n/**\n * Raw token response from Figma OAuth2 token endpoint\n * Response from POST https://api.figma.com/v1/oauth/token\n */\nexport interface FigmaTokenResponse {\n  /** OAuth2 access token */\n  access_token: string\n  /** Token expiration time in seconds */\n  expires_in: number\n  /** OAuth2 refresh token */\n  refresh_token: string\n  /** Space-separated list of granted scopes */\n  scope?: string\n  /** Token type (typically \"Bearer\") */\n  token_type?: string\n  /** Figma user ID string */\n  user_id_string?: string\n}\n\n/**\n * OAuth2 error response\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\n */\nexport interface OAuthErrorResponse {\n  /** Error code */\n  error:\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_request'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n  /** Human-readable error description */\n  error_description?: string\n  /** URI with error information */\n  error_uri?: string\n}\n\n/**\n * Parameters for OAuth2 authorization URL\n */\nexport interface OAuthAuthorizationParams {\n  /** OAuth2 client ID */\n  client_id: string\n  /** PKCE code challenge (optional but recommended) */\n  code_challenge?: string\n  /** PKCE code challenge method (must be S256 if using PKCE) */\n  code_challenge_method?: 'S256'\n  /** Redirect URI for callback */\n  redirect_uri: string\n  /** Response type (always \"code\" for authorization code flow) */\n  response_type: 'code'\n  /** Requested scopes (space-separated) */\n  scope: string\n  /** State parameter for CSRF protection */\n  state: string\n}\n\n/**\n * Parameters for OAuth2 token exchange\n */\nexport interface OAuthTokenExchangeParams {\n  /** Authorization code from callback */\n  code: string\n  /** PKCE code verifier (if PKCE was used) */\n  code_verifier?: string\n  /** Grant type (always \"authorization_code\") */\n  grant_type: 'authorization_code'\n  /** Redirect URI (must match authorization request) */\n  redirect_uri: string\n}\n\n/**\n * Parameters for OAuth2 token refresh\n */\nexport interface OAuthTokenRefreshParams {\n  /** Grant type (always \"refresh_token\") */\n  grant_type: 'refresh_token'\n  /** Refresh token */\n  refresh_token: string\n}\n\n/**\n * Configuration for token storage\n */\nexport interface TokenStoreConfig {\n  /** Custom config name (defaults to 'payloadcms-figma') */\n  configName?: string\n  /** Enable encryption (defaults to true) */\n  encryptionKey?: string\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients\n * @see https://datatracker.ietf.org/doc/html/rfc7636\n */\nexport interface PKCEPair {\n  /** Code challenge derived from code verifier */\n  codeChallenge: string\n  /** Code challenge method (always S256) */\n  codeChallengeMethod: 'S256'\n  /** Code verifier - random string used to generate challenge */\n  codeVerifier: string\n}\n\n/**\n * OAuth configuration for Figma API (public client with PKCE)\n *\n * This configuration is for a PUBLIC OAuth client that uses PKCE\n * (Proof Key for Code Exchange) instead of a client secret.\n * Public clients (like CLIs) cannot securely store client secrets.\n */\nexport interface OAuthConfig {\n  /** Figma OAuth authorization URL */\n  authorizationUrl: string\n  /** OAuth2 client ID (public client) */\n  clientId: string\n  /** OAuth2 redirect URI for callback */\n  redirectUri: string\n  /** Figma OAuth token refresh URL */\n  refreshUrl: string\n  /** OAuth2 scopes to request */\n  scopes: FigmaOAuthScope[]\n  /** Figma OAuth token exchange URL */\n  tokenUrl: string\n}\n\n/**\n * Re-export Figma's official types for convenience\n */\nexport type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User }\n\n/**\n * Type alias for Figma API error responses\n * Combines both error response formats from Figma's REST API\n */\nexport type FigmaErrorResponse =\n  | ErrorResponsePayloadWithErrMessage\n  | ErrorResponsePayloadWithErrorBoolean\n\n/**\n * Figma user information\n * Re-exported from @figma/rest-api-spec\n */\nexport type FigmaUser = User\n\n/**\n * JWT payload structure from Figma project tokens\n * Extends jose's standard JWTPayload with Figma-specific claims\n */\nexport interface JWTPayload extends JoseJWTPayload {\n  [key: string]: unknown\n  /** User email address */\n  email?: string\n  /** Tenant/CMS ID this token is scoped to */\n  tenant_id?: string\n}\n\n/**\n * Project token (JWT) for authenticating to Content API\n * Used by local Payload instances to make authenticated requests\n */\nexport interface ProjectToken {\n  /** Validated JWT claims */\n  claims?: JWTPayload\n  /** Unix timestamp (milliseconds) when the token expires (from validated exp claim) */\n  expiresAt: number\n  /** Tenant/CMS ID this token is scoped to */\n  tenantId: string\n  /** JWT token string signed by Figma API */\n  token: string\n}\n\n/**\n * Raw project token response from Figma API\n * Response from GET https://api.figma.com/v1/cms/:id/token/\n */\nexport interface ProjectTokenResponse {\n  /** Response metadata containing the JWT token */\n  meta: {\n    /** JWT token string */\n    token: string\n  }\n}\n"],"names":[],"mappings":"AAyOA;;;CAGC,GACD,WAMC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAS1C"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAS1C"}

package/dist/cli.js

@@ -1,14 +1,12 @@
 import * as p from '@clack/prompts';
 import arg from 'arg';
 import pc from 'picocolors';
-import { buildLambdaZipCommand } from './commands/build-lambda-zip.js';
 import { deployCommand } from './commands/deploy.js';
 import { initCommand } from './commands/init.js';
 import { listTokensCommand } from './commands/list-tokens.js';
 import { loginCommand } from './commands/login.js';
 import { logoutCommand } from './commands/logout.js';
-import { setEnvironment } from './constants.js';
-import { helpMessage } from './utils/messages.js';
+import { feedbackOutro, helpMessage } from './utils/messages.js';
 /**
  * Entrypoint for bin/cli.js
  */ export async function main() {
@@ -26,21 +24,16 @@ class Main {
     constructor(){
         // @ts-expect-error bad typings
         this.args = arg({
-            '--all': Boolean,
             '--debug': Boolean,
-            '--env': String,
             '--force': Boolean,
             '--help': Boolean,
             '--id': String,
             '--name': String,
             '--skip-auth': Boolean,
-            '--skip-build': Boolean,
-            '--version': Boolean,
             '--yes': Boolean,
             // Aliases
             '-f': '--force',
             '-h': '--help',
-            '-v': '--version',
             '-y': '--yes'
         }, {
             permissive: true
@@ -49,19 +42,6 @@ class Main {
         if (this.args['--debug']) {
             process.env.DEBUG = 'true';
         }
-        // Handle --env flag for environment switching
-        if (this.args['--env']) {
-            const envArg = this.args['--env'].toLowerCase();
-            if (envArg === 'prod' || envArg === 'production') {
-                setEnvironment('production');
-            } else if (envArg === 'staging') {
-                setEnvironment('staging');
-            } else {
-                // eslint-disable-next-line no-console
-                console.error(`Invalid --env value: ${this.args['--env']}. Use 'prod' or 'staging'.`);
-                process.exit(1);
-            }
-        }
     }
     async init() {
         try {
@@ -69,32 +49,16 @@ class Main {
                 helpMessage();
                 process.exit(0);
             }
-            if (this.args['--version']) {
-                const { getOwnVersion } = await import('./utils/version-check.js');
-                const version = await getOwnVersion();
-                // eslint-disable-next-line no-console
-                console.log(version);
-                process.exit(0);
-            }
             // Get the subcommand (first non-flag argument)
             const subcommand = this.args._[0];
-            if (!subcommand) {
-                helpMessage();
-                process.exit(0);
-            }
             // eslint-disable-next-line no-console
             console.log('\n');
             p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')));
             // Route to appropriate command handler
             switch(subcommand){
-                case 'build-lambda-zip':
-                    await buildLambdaZipCommand();
-                    break;
                 case 'deploy':
                     await deployCommand({
-                        id: this.args['--id'],
                         debug: this.args['--debug'],
-                        skipBuild: this.args['--skip-build'],
                         yes: this.args['--yes']
                     });
                     break;
@@ -109,7 +73,6 @@ class Main {
                     break;
                 case 'list-tokens':
                     listTokensCommand({
-                        all: this.args['--all'],
                         debug: this.args['--debug']
                     });
                     break;
@@ -118,10 +81,14 @@ class Main {
                     break;
                 case 'logout':
                     await logoutCommand({
-                        all: this.args['--all'],
                         debug: this.args['--debug']
                     });
                     break;
+                case undefined:
+                    // No subcommand - show default message
+                    p.note("Let's create a new CMS!");
+                    p.outro(feedbackOutro());
+                    break;
                 default:
                     p.log.error(pc.red(`Unknown command: ${subcommand}`));
                     p.note('Use --help to see available commands', 'Tip');

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import * as p from '@clack/prompts'\nimport arg from 'arg'\nimport pc from 'picocolors'\n\nimport type { CliArgs } from './types.js'\n\nimport { buildLambdaZipCommand } from './commands/build-lambda-zip.js'\nimport { deployCommand } from './commands/deploy.js'\nimport { initCommand } from './commands/init.js'\nimport { listTokensCommand } from './commands/list-tokens.js'\nimport { loginCommand } from './commands/login.js'\nimport { logoutCommand } from './commands/logout.js'\nimport { setEnvironment } from './constants.js'\nimport { feedbackOutro, helpMessage } from './utils/messages.js'\n\n/**\n * Entrypoint for bin/cli.js\n */\nexport async function main(): Promise<void> {\n  try {\n    await new Main().init()\n  } catch (e) {\n    if (e instanceof Error) {\n      // eslint-disable-next-line no-console\n      console.error(e.message)\n    }\n  }\n}\n\nclass Main {\n  args: CliArgs\n\n  constructor() {\n    // @ts-expect-error bad typings\n    this.args = arg(\n      {\n        '--all': Boolean,\n        '--debug': Boolean,\n        '--env': String,\n        '--force': Boolean,\n        '--help': Boolean,\n        '--id': String,\n        '--name': String,\n        '--skip-auth': Boolean,\n        '--skip-build': Boolean,\n        '--version': Boolean,\n        '--yes': Boolean,\n\n        // Aliases\n        '-f': '--force',\n        '-h': '--help',\n        '-v': '--version',\n        '-y': '--yes',\n      },\n      { permissive: true },\n    )\n\n    // Set debug flag globally\n    if (this.args['--debug']) {\n      process.env.DEBUG = 'true'\n    }\n\n    // Handle --env flag for environment switching\n    if (this.args['--env']) {\n      const envArg = this.args['--env'].toLowerCase()\n      if (envArg === 'prod' || envArg === 'production') {\n        setEnvironment('production')\n      } else if (envArg === 'staging') {\n        setEnvironment('staging')\n      } else {\n        // eslint-disable-next-line no-console\n        console.error(`Invalid --env value: ${this.args['--env']}. Use 'prod' or 'staging'.`)\n        process.exit(1)\n      }\n    }\n  }\n\n  async init(): Promise<void> {\n    try {\n      if (this.args['--help']) {\n        helpMessage()\n        process.exit(0)\n      }\n\n      if (this.args['--version']) {\n        const { getOwnVersion } = await import('./utils/version-check.js')\n        const version = await getOwnVersion()\n        // eslint-disable-next-line no-console\n        console.log(version)\n        process.exit(0)\n      }\n\n      // Get the subcommand (first non-flag argument)\n      const subcommand = this.args._[0]\n\n      if (!subcommand) {\n        helpMessage()\n        process.exit(0)\n      }\n\n      // eslint-disable-next-line no-console\n      console.log('\\n')\n      p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')))\n\n      // Route to appropriate command handler\n      switch (subcommand) {\n        case 'build-lambda-zip':\n          await buildLambdaZipCommand()\n          break\n\n        case 'deploy':\n          await deployCommand({\n            id: this.args['--id'],\n            debug: this.args['--debug'],\n            skipBuild: this.args['--skip-build'],\n            yes: this.args['--yes'],\n          })\n          break\n\n        case 'init':\n          await initCommand({\n            id: this.args['--id'],\n            name: this.args['--name'],\n            debug: this.args['--debug'],\n            force: this.args['--force'],\n            skipAuth: this.args['--skip-auth'],\n          })\n          break\n\n        case 'list-tokens':\n          listTokensCommand({\n            all: this.args['--all'],\n            debug: this.args['--debug'],\n          })\n          break\n\n        case 'login':\n          await loginCommand()\n          break\n\n        case 'logout':\n          await logoutCommand({\n            all: this.args['--all'],\n            debug: this.args['--debug'],\n          })\n          break\n\n        default:\n          p.log.error(pc.red(`Unknown command: ${subcommand}`))\n          p.note('Use --help to see available commands', 'Tip')\n          process.exit(1)\n      }\n\n      process.exit(0)\n    } catch (err: unknown) {\n      // eslint-disable-next-line no-console\n      console.error(err instanceof Error ? err.message : 'An error occurred')\n      process.exit(1)\n    }\n  }\n}\n"],"names":["p","arg","pc","buildLambdaZipCommand","deployCommand","initCommand","listTokensCommand","loginCommand","logoutCommand","setEnvironment","helpMessage","main","Main","init","e","Error","console","error","message","args","Boolean","String","permissive","process","env","DEBUG","envArg","toLowerCase","exit","getOwnVersion","version","log","subcommand","_","intro","bgCyan","black","id","debug","skipBuild","yes","name","force","skipAuth","all","red","note","err"],"mappings":"AAAA,YAAYA,OAAO,iBAAgB;AACnC,OAAOC,SAAS,MAAK;AACrB,OAAOC,QAAQ,aAAY;AAI3B,SAASC,qBAAqB,QAAQ,iCAAgC;AACtE,SAASC,aAAa,QAAQ,uBAAsB;AACpD,SAASC,WAAW,QAAQ,qBAAoB;AAChD,SAASC,iBAAiB,QAAQ,4BAA2B;AAC7D,SAASC,YAAY,QAAQ,sBAAqB;AAClD,SAASC,aAAa,QAAQ,uBAAsB;AACpD,SAASC,cAAc,QAAQ,iBAAgB;AAC/C,SAAwBC,WAAW,QAAQ,sBAAqB;AAEhE;;CAEC,GACD,OAAO,eAAeC;IACpB,IAAI;QACF,MAAM,IAAIC,OAAOC,IAAI;IACvB,EAAE,OAAOC,GAAG;QACV,IAAIA,aAAaC,OAAO;YACtB,sCAAsC;YACtCC,QAAQC,KAAK,CAACH,EAAEI,OAAO;QACzB;IACF;AACF;AAEA,MAAMN;IACJO,KAAa;IAEb,aAAc;QACZ,+BAA+B;QAC/B,IAAI,CAACA,IAAI,GAAGlB,IACV;YACE,SAASmB;YACT,WAAWA;YACX,SAASC;YACT,WAAWD;YACX,UAAUA;YACV,QAAQC;YACR,UAAUA;YACV,eAAeD;YACf,gBAAgBA;YAChB,aAAaA;YACb,SAASA;YAET,UAAU;YACV,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;QACR,GACA;YAAEE,YAAY;QAAK;QAGrB,0BAA0B;QAC1B,IAAI,IAAI,CAACH,IAAI,CAAC,UAAU,EAAE;YACxBI,QAAQC,GAAG,CAACC,KAAK,GAAG;QACtB;QAEA,8CAA8C;QAC9C,IAAI,IAAI,CAACN,IAAI,CAAC,QAAQ,EAAE;YACtB,MAAMO,SAAS,IAAI,CAACP,IAAI,CAAC,QAAQ,CAACQ,WAAW;YAC7C,IAAID,WAAW,UAAUA,WAAW,cAAc;gBAChDjB,eAAe;YACjB,OAAO,IAAIiB,WAAW,WAAW;gBAC/BjB,eAAe;YACjB,OAAO;gBACL,sCAAsC;gBACtCO,QAAQC,KAAK,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAACE,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;gBACpFI,QAAQK,IAAI,CAAC;YACf;QACF;IACF;IAEA,MAAMf,OAAsB;QAC1B,IAAI;YACF,IAAI,IAAI,CAACM,IAAI,CAAC,SAAS,EAAE;gBACvBT;gBACAa,QAAQK,IAAI,CAAC;YACf;YAEA,IAAI,IAAI,CAACT,IAAI,CAAC,YAAY,EAAE;gBAC1B,MAAM,EAAEU,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC;gBACvC,MAAMC,UAAU,MAAMD;gBACtB,sCAAsC;gBACtCb,QAAQe,GAAG,CAACD;gBACZP,QAAQK,IAAI,CAAC;YACf;YAEA,+CAA+C;YAC/C,MAAMI,aAAa,IAAI,CAACb,IAAI,CAACc,CAAC,CAAC,EAAE;YAEjC,IAAI,CAACD,YAAY;gBACftB;gBACAa,QAAQK,IAAI,CAAC;YACf;YAEA,sCAAsC;YACtCZ,QAAQe,GAAG,CAAC;YACZ/B,EAAEkC,KAAK,CAAChC,GAAGiC,MAAM,CAACjC,GAAGkC,KAAK,CAAC;YAE3B,uCAAuC;YACvC,OAAQJ;gBACN,KAAK;oBACH,MAAM7B;oBACN;gBAEF,KAAK;oBACH,MAAMC,cAAc;wBAClBiC,IAAI,IAAI,CAAClB,IAAI,CAAC,OAAO;wBACrBmB,OAAO,IAAI,CAACnB,IAAI,CAAC,UAAU;wBAC3BoB,WAAW,IAAI,CAACpB,IAAI,CAAC,eAAe;wBACpCqB,KAAK,IAAI,CAACrB,IAAI,CAAC,QAAQ;oBACzB;oBACA;gBAEF,KAAK;oBACH,MAAMd,YAAY;wBAChBgC,IAAI,IAAI,CAAClB,IAAI,CAAC,OAAO;wBACrBsB,MAAM,IAAI,CAACtB,IAAI,CAAC,SAAS;wBACzBmB,OAAO,IAAI,CAACnB,IAAI,CAAC,UAAU;wBAC3BuB,OAAO,IAAI,CAACvB,IAAI,CAAC,UAAU;wBAC3BwB,UAAU,IAAI,CAACxB,IAAI,CAAC,cAAc;oBACpC;oBACA;gBAEF,KAAK;oBACHb,kBAAkB;wBAChBsC,KAAK,IAAI,CAACzB,IAAI,CAAC,QAAQ;wBACvBmB,OAAO,IAAI,CAACnB,IAAI,CAAC,UAAU;oBAC7B;oBACA;gBAEF,KAAK;oBACH,MAAMZ;oBACN;gBAEF,KAAK;oBACH,MAAMC,cAAc;wBAClBoC,KAAK,IAAI,CAACzB,IAAI,CAAC,QAAQ;wBACvBmB,OAAO,IAAI,CAACnB,IAAI,CAAC,UAAU;oBAC7B;oBACA;gBAEF;oBACEnB,EAAE+B,GAAG,CAACd,KAAK,CAACf,GAAG2C,GAAG,CAAC,CAAC,iBAAiB,EAAEb,YAAY;oBACnDhC,EAAE8C,IAAI,CAAC,wCAAwC;oBAC/CvB,QAAQK,IAAI,CAAC;YACjB;YAEAL,QAAQK,IAAI,CAAC;QACf,EAAE,OAAOmB,KAAc;YACrB,sCAAsC;YACtC/B,QAAQC,KAAK,CAAC8B,eAAehC,QAAQgC,IAAI7B,OAAO,GAAG;YACnDK,QAAQK,IAAI,CAAC;QACf;IACF;AACF"}
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import * as p from '@clack/prompts'\nimport arg from 'arg'\nimport pc from 'picocolors'\n\nimport type { CliArgs } from './types.js'\n\nimport { deployCommand } from './commands/deploy.js'\nimport { initCommand } from './commands/init.js'\nimport { listTokensCommand } from './commands/list-tokens.js'\nimport { loginCommand } from './commands/login.js'\nimport { logoutCommand } from './commands/logout.js'\nimport { feedbackOutro, helpMessage } from './utils/messages.js'\n\n/**\n * Entrypoint for bin/cli.js\n */\nexport async function main(): Promise<void> {\n  try {\n    await new Main().init()\n  } catch (e) {\n    if (e instanceof Error) {\n      // eslint-disable-next-line no-console\n      console.error(e.message)\n    }\n  }\n}\n\nclass Main {\n  args: CliArgs\n\n  constructor() {\n    // @ts-expect-error bad typings\n    this.args = arg(\n      {\n        '--debug': Boolean,\n        '--force': Boolean,\n        '--help': Boolean,\n        '--id': String,\n        '--name': String,\n        '--skip-auth': Boolean,\n        '--yes': Boolean,\n\n        // Aliases\n        '-f': '--force',\n        '-h': '--help',\n        '-y': '--yes',\n      },\n      { permissive: true },\n    )\n\n    // Set debug flag globally\n    if (this.args['--debug']) {\n      process.env.DEBUG = 'true'\n    }\n  }\n\n  async init(): Promise<void> {\n    try {\n      if (this.args['--help']) {\n        helpMessage()\n        process.exit(0)\n      }\n\n      // Get the subcommand (first non-flag argument)\n      const subcommand = this.args._[0]\n\n      // eslint-disable-next-line no-console\n      console.log('\\n')\n      p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')))\n\n      // Route to appropriate command handler\n      switch (subcommand) {\n        case 'deploy':\n          await deployCommand({\n            debug: this.args['--debug'],\n            yes: this.args['--yes'],\n          })\n          break\n\n        case 'init':\n          await initCommand({\n            id: this.args['--id'],\n            name: this.args['--name'],\n            debug: this.args['--debug'],\n            force: this.args['--force'],\n            skipAuth: this.args['--skip-auth'],\n          })\n          break\n\n        case 'list-tokens':\n          listTokensCommand({\n            debug: this.args['--debug'],\n          })\n          break\n\n        case 'login':\n          await loginCommand()\n          break\n\n        case 'logout':\n          await logoutCommand({\n            debug: this.args['--debug'],\n          })\n          break\n\n        case undefined:\n          // No subcommand - show default message\n          p.note(\"Let's create a new CMS!\")\n          p.outro(feedbackOutro())\n          break\n\n        default:\n          p.log.error(pc.red(`Unknown command: ${subcommand}`))\n          p.note('Use --help to see available commands', 'Tip')\n          process.exit(1)\n      }\n\n      process.exit(0)\n    } catch (err: unknown) {\n      // eslint-disable-next-line no-console\n      console.error(err instanceof Error ? err.message : 'An error occurred')\n      process.exit(1)\n    }\n  }\n}\n"],"names":["p","arg","pc","deployCommand","initCommand","listTokensCommand","loginCommand","logoutCommand","feedbackOutro","helpMessage","main","Main","init","e","Error","console","error","message","args","Boolean","String","permissive","process","env","DEBUG","exit","subcommand","_","log","intro","bgCyan","black","debug","yes","id","name","force","skipAuth","undefined","note","outro","red","err"],"mappings":"AAAA,YAAYA,OAAO,iBAAgB;AACnC,OAAOC,SAAS,MAAK;AACrB,OAAOC,QAAQ,aAAY;AAI3B,SAASC,aAAa,QAAQ,uBAAsB;AACpD,SAASC,WAAW,QAAQ,qBAAoB;AAChD,SAASC,iBAAiB,QAAQ,4BAA2B;AAC7D,SAASC,YAAY,QAAQ,sBAAqB;AAClD,SAASC,aAAa,QAAQ,uBAAsB;AACpD,SAASC,aAAa,EAAEC,WAAW,QAAQ,sBAAqB;AAEhE;;CAEC,GACD,OAAO,eAAeC;IACpB,IAAI;QACF,MAAM,IAAIC,OAAOC,IAAI;IACvB,EAAE,OAAOC,GAAG;QACV,IAAIA,aAAaC,OAAO;YACtB,sCAAsC;YACtCC,QAAQC,KAAK,CAACH,EAAEI,OAAO;QACzB;IACF;AACF;AAEA,MAAMN;IACJO,KAAa;IAEb,aAAc;QACZ,+BAA+B;QAC/B,IAAI,CAACA,IAAI,GAAGjB,IACV;YACE,WAAWkB;YACX,WAAWA;YACX,UAAUA;YACV,QAAQC;YACR,UAAUA;YACV,eAAeD;YACf,SAASA;YAET,UAAU;YACV,MAAM;YACN,MAAM;YACN,MAAM;QACR,GACA;YAAEE,YAAY;QAAK;QAGrB,0BAA0B;QAC1B,IAAI,IAAI,CAACH,IAAI,CAAC,UAAU,EAAE;YACxBI,QAAQC,GAAG,CAACC,KAAK,GAAG;QACtB;IACF;IAEA,MAAMZ,OAAsB;QAC1B,IAAI;YACF,IAAI,IAAI,CAACM,IAAI,CAAC,SAAS,EAAE;gBACvBT;gBACAa,QAAQG,IAAI,CAAC;YACf;YAEA,+CAA+C;YAC/C,MAAMC,aAAa,IAAI,CAACR,IAAI,CAACS,CAAC,CAAC,EAAE;YAEjC,sCAAsC;YACtCZ,QAAQa,GAAG,CAAC;YACZ5B,EAAE6B,KAAK,CAAC3B,GAAG4B,MAAM,CAAC5B,GAAG6B,KAAK,CAAC;YAE3B,uCAAuC;YACvC,OAAQL;gBACN,KAAK;oBACH,MAAMvB,cAAc;wBAClB6B,OAAO,IAAI,CAACd,IAAI,CAAC,UAAU;wBAC3Be,KAAK,IAAI,CAACf,IAAI,CAAC,QAAQ;oBACzB;oBACA;gBAEF,KAAK;oBACH,MAAMd,YAAY;wBAChB8B,IAAI,IAAI,CAAChB,IAAI,CAAC,OAAO;wBACrBiB,MAAM,IAAI,CAACjB,IAAI,CAAC,SAAS;wBACzBc,OAAO,IAAI,CAACd,IAAI,CAAC,UAAU;wBAC3BkB,OAAO,IAAI,CAAClB,IAAI,CAAC,UAAU;wBAC3BmB,UAAU,IAAI,CAACnB,IAAI,CAAC,cAAc;oBACpC;oBACA;gBAEF,KAAK;oBACHb,kBAAkB;wBAChB2B,OAAO,IAAI,CAACd,IAAI,CAAC,UAAU;oBAC7B;oBACA;gBAEF,KAAK;oBACH,MAAMZ;oBACN;gBAEF,KAAK;oBACH,MAAMC,cAAc;wBAClByB,OAAO,IAAI,CAACd,IAAI,CAAC,UAAU;oBAC7B;oBACA;gBAEF,KAAKoB;oBACH,uCAAuC;oBACvCtC,EAAEuC,IAAI,CAAC;oBACPvC,EAAEwC,KAAK,CAAChC;oBACR;gBAEF;oBACER,EAAE4B,GAAG,CAACZ,KAAK,CAACd,GAAGuC,GAAG,CAAC,CAAC,iBAAiB,EAAEf,YAAY;oBACnD1B,EAAEuC,IAAI,CAAC,wCAAwC;oBAC/CjB,QAAQG,IAAI,CAAC;YACjB;YAEAH,QAAQG,IAAI,CAAC;QACf,EAAE,OAAOiB,KAAc;YACrB,sCAAsC;YACtC3B,QAAQC,KAAK,CAAC0B,eAAe5B,QAAQ4B,IAAIzB,OAAO,GAAG;YACnDK,QAAQG,IAAI,CAAC;QACf;IACF;AACF"}

package/dist/commands/deploy.d.ts

@@ -4,10 +4,6 @@
 export interface DeployCommandOptions {
     /** Enable debug mode */
     debug?: boolean;
-    /** Tenant ID */
-    id?: string;
-    /** Skip the build step (use existing build) */
-    skipBuild?: boolean;
     /** Skip confirmation prompts */
     yes?: boolean;
 }

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gBAAgB;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gCAAgC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AA6BD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyPhF"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gCAAgC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AA6BD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyThF"}