@payloadcms/figma 0.0.1-alpha.5 → 0.0.1-alpha.50

package/dist/auth/oauth-flow.js

@@ -1,11 +1,11 @@
 import * as p from '@clack/prompts';
 import crypto from 'crypto';
-import { OAUTH_CONFIG } from '../config/oauth.js';
+import { DEFAULT_CALLBACK_PORT, getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 import { buildAuthorizationUrl, openBrowser } from './browser.js';
 import { CallbackServer } from './callback-server.js';
 import { generatePKCEPair } from './pkce.js';
-import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
+import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js';
 /**
  * Error during OAuth flow
  */ export class OAuthFlowError extends Error {
@@ -32,16 +32,17 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
  * @throws OAuthFlowError if any step fails
  */ export async function executeOAuthFlow(tokenStore, options = {}) {
     // Check if OAuth flow should be mocked
-    // Default to true for OAuth (allow testing without real authentication by default)
-    const shouldMock = process.env.FIGMA_MOCK_OAUTH !== 'false';
+    // Default to false for OAuth
+    const shouldMock = process.env.FIGMA_MOCK_OAUTH === 'true';
+    const oauthConfig = getOAuthConfig();
     if (shouldMock) {
         // MOCK IMPLEMENTATION: Return mock tokens for testing
-        log.debug('Using mock OAuth flow (FIGMA_MOCK_OAUTH != "false")');
+        log.debug('Using mock OAuth flow (FIGMA_MOCK_OAUTH = true)');
         const mockTokens = {
             accessToken: 'figt_mock_access_token_' + crypto.randomBytes(16).toString('hex'),
             expiresAt: Date.now() + 2 * 60 * 60 * 1000,
             refreshToken: 'figt_mock_refresh_token_' + crypto.randomBytes(16).toString('hex'),
-            scopes: options.scopes || OAUTH_CONFIG.scopes,
+            scopes: options.scopes || oauthConfig.scopes,
             tokenType: 'Bearer'
         };
         // Store mock tokens
@@ -52,7 +53,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         };
     }
     // REAL OAUTH IMPLEMENTATION
-    const { clientId = OAUTH_CONFIG.clientId, port = 3000, redirectUri = OAUTH_CONFIG.redirectUri, scopes = OAUTH_CONFIG.scopes, timeoutMs = 120000 } = options;
+    const { clientId = oauthConfig.clientId, port = DEFAULT_CALLBACK_PORT, redirectUri = oauthConfig.redirectUri, scopes = oauthConfig.scopes, timeoutMs = 120000 } = options;
     // Generate PKCE pair for enhanced security
     const { codeChallenge, codeChallengeMethod, codeVerifier } = generatePKCEPair();
     // Generate random state for CSRF protection
@@ -73,7 +74,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         const actualRedirectUri = redirectUri.replace(/:\d+/, `:${actualPort}`);
         // Build authorization URL
         const authUrl = buildAuthorizationUrl({
-            authorizationUrl: OAUTH_CONFIG.authorizationUrl,
+            authorizationUrl: oauthConfig.authorizationUrl,
             clientId,
             codeChallenge,
             codeChallengeMethod,
@@ -84,7 +85,7 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         // Prompt user to open browser
         const shouldOpenBrowser = await p.confirm({
             initialValue: true,
-            message: 'Log in or create Figma account in your browser?'
+            message: 'Authenticate with Figma in your browser?'
         });
         if (p.isCancel(shouldOpenBrowser)) {
             throw new OAuthFlowError('Authentication cancelled by user');
@@ -160,8 +161,11 @@ import { exchangeCodeForTokens, refreshAccessToken } from './refresh.js';
         tokenStore.setTokens(tokens);
         return tokens.accessToken;
     } catch (error) {
-        // Refresh failed - clear invalid tokens
-        tokenStore.clearTokens();
+        // Only clear tokens for actual auth failures, not transient errors
+        const isAuthFailure = error instanceof TokenRefreshError && (error.statusCode === 401 || error.statusCode === 403 || error.statusCode === 400 && error.errorCode === 'invalid_grant');
+        if (isAuthFailure) {
+            tokenStore.clearTokens();
+        }
         throw new OAuthFlowError('Failed to refresh access token', error instanceof Error ? error : undefined);
     }
 }

package/dist/auth/project-token.js

@@ -5,7 +5,7 @@
  * to the Content API. Project tokens are scoped to a specific tenant/CMS
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */ import { getProjectToken as fetchProjectToken } from '../api/figma-api.js';
-import { getEnvironment } from '../constants.js';
+import { getInfraEnvironment } from '../constants.js';
 import * as log from '../utils/log.js';
 import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
 import { getValidAccessToken } from './oauth-flow.js';
@@ -60,13 +60,17 @@ import { getValidAccessToken } from './oauth-flow.js';
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
  */ export async function getValidProjectToken(tokenStore, tenantId) {
-    // Check if we have a valid project token already
+    if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        log.debug('FIGMA_CONTENT_API_ACCESS_KEY is set; skipping project token retrieval from API');
+        return null;
+    }
+    // Check for existing valid project token
     if (tokenStore.hasValidProjectToken(tenantId)) {
         const projectToken = tokenStore.getProjectToken(tenantId);
         return projectToken?.token || null;
     }
     // We need to refresh the project token
-    // First, get a valid user access token (will auto-refresh if needed)
+    // An oauth access token is required for the call
     let accessToken;
     try {
         accessToken = await getValidAccessToken(tokenStore);
@@ -80,16 +84,17 @@ import { getValidAccessToken } from './oauth-flow.js';
     // Fetch a new project token from the Figma API
     const projectToken = await fetchProjectToken(accessToken, tenantId);
     // Validate the JWT signature and claims (skip for mocks)
+    const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
     const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
     let validatedClaims;
-    if (shouldMock) {
+    if (hasEnvToken || shouldMock) {
         // MOCK: Skip JWT validation and parse claims directly
-        log.debug('Skipping JWT validation for mock project token');
+        log.debug('Skipping JWT validation for mock/env project token');
         validatedClaims = parseJWTClaims(projectToken.token);
     } else {
         // REAL: Validate JWT signature against JWKS
         try {
-            validatedClaims = await validateProjectToken(projectToken.token, getEnvironment());
+            validatedClaims = await validateProjectToken(projectToken.token, getInfraEnvironment());
         } catch (validationError) {
             // Handle validation errors
             if (validationError instanceof JWTValidationError) {

package/dist/auth/refresh.d.ts

@@ -4,7 +4,8 @@ import type { FigmaTokens } from './types.js';
  */
 export declare class TokenRefreshError extends Error {
     statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
+    errorCode?: string | undefined;
+    constructor(message: string, statusCode?: number | undefined, errorCode?: string | undefined);
 }
 /**
  * Refresh an expired OAuth2 access token using a refresh token

package/dist/auth/refresh.js

@@ -1,11 +1,12 @@
-/* eslint-disable perfectionist/sort-objects */ import { OAUTH_CONFIG } from '../config/oauth.js';
+/* eslint-disable perfectionist/sort-objects */ import { getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 /**
  * Error thrown when token refresh fails
  */ export class TokenRefreshError extends Error {
     statusCode;
-    constructor(message, statusCode){
-        super(message), this.statusCode = statusCode;
+    errorCode;
+    constructor(message, statusCode, errorCode){
+        super(message), this.statusCode = statusCode, this.errorCode = errorCode;
         this.name = 'TokenRefreshError';
     }
 }
@@ -19,15 +20,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to new tokens
  * @throws TokenRefreshError if refresh fails
- */ export async function refreshAccessToken(refreshToken, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function refreshAccessToken(refreshToken, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token refresh request (public client)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         grant_type: 'refresh_token',
         refresh_token: refreshToken
     });
     try {
-        const response = await fetch(OAUTH_CONFIG.refreshUrl, {
+        const response = await fetch(oauthConfig.refreshUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded'
@@ -36,7 +39,14 @@ import * as log from '../utils/log.js';
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status);
+            let errorCode;
+            try {
+                const parsed = JSON.parse(errorText);
+                errorCode = parsed.error;
+            } catch  {
+            // Not JSON, leave errorCode undefined
+            }
+            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status, errorCode);
         }
         const data = await response.json();
         // Validate response contains required fields
@@ -71,14 +81,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to tokens
  * @throws TokenRefreshError if exchange fails
- */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri = OAUTH_CONFIG.redirectUri, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedRedirectUri = redirectUri ?? oauthConfig.redirectUri;
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token exchange (public client with PKCE)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         code,
         code_verifier: codeVerifier,
         grant_type: 'authorization_code',
-        redirect_uri: redirectUri
+        redirect_uri: resolvedRedirectUri
     });
     try {
         // Public client - no client secret or Basic Auth header needed
@@ -88,11 +101,11 @@ import * as log from '../utils/log.js';
         };
         // Debug logging
         log.debug(`Token exchange request: ${JSON.stringify({
-            url: OAUTH_CONFIG.tokenUrl,
+            url: oauthConfig.tokenUrl,
             headers,
             body: params.toString()
         })}`);
-        const response = await fetch(OAUTH_CONFIG.tokenUrl, {
+        const response = await fetch(oauthConfig.tokenUrl, {
             method: 'POST',
             headers,
             body: params.toString()

package/dist/auth/token-store.d.ts

@@ -1,4 +1,13 @@
-import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+import type { Environment } from '../constants.js';
+import type { BootstrapData, FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+/**
+ * Get the singleton TokenStore instance for an environment
+ * Use this for all production code to ensure a single shared instance per environment
+ *
+ * @param environment - The environment to get the token store for
+ * @returns The singleton TokenStore instance for that environment
+ */
+export declare function getTokenStore(environment?: Environment): TokenStore;
 /**
  * Secure storage manager for Figma OAuth2 tokens
  *
@@ -9,6 +18,9 @@ import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './
  *
  * Tokens are encrypted at rest with a machine-specific key and file permissions
  * are set to 0600 (owner read/write only)
+ *
+ * For production code, use getTokenStore() to get the singleton instance.
+ * The constructor is still exported for test isolation.
  */
 export declare class TokenStore {
     private config;
@@ -106,5 +118,32 @@ export declare class TokenStore {
      * @returns Array of tenant IDs
      */
     getAllProjectTokenTenantIds(): string[];
+    /**
+     * Build the composite key for bootstrap data storage
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name (e.g. 'production', 'staging')
+     * @returns Composite key string
+     */
+    private bootstrapKey;
+    /**
+     * Retrieve bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     * @returns BootstrapData if stored, null otherwise
+     */
+    getBootstrapData(projectId: string, environmentName: string): BootstrapData | null;
+    /**
+     * Store bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     * @param data - The bootstrap data to store
+     */
+    setBootstrapData(projectId: string, environmentName: string, data: BootstrapData): void;
+    /**
+     * Clear bootstrap data for a project + environment
+     * @param projectId - The CMS resource/project ID
+     * @param environmentName - The environment name
+     */
+    clearBootstrapData(projectId: string, environmentName: string): void;
 }
 //# sourceMappingURL=token-store.d.ts.map

package/dist/auth/token-store.js

@@ -1,6 +1,24 @@
 /* eslint-disable perfectionist/sort-classes */ import Conf from 'conf';
 import { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
+import { getInfraEnvironment } from '../constants.js';
 import { deriveEncryptionKey } from './crypto-utils.js';
+/**
+ * Environment-keyed instances for singleton pattern
+ */ const instances = {};
+/**
+ * Get the singleton TokenStore instance for an environment
+ * Use this for all production code to ensure a single shared instance per environment
+ *
+ * @param environment - The environment to get the token store for
+ * @returns The singleton TokenStore instance for that environment
+ */ export function getTokenStore(environment = getInfraEnvironment()) {
+    if (!instances[environment]) {
+        instances[environment] = new TokenStore({
+            environment
+        });
+    }
+    return instances[environment];
+}
 /**
  * Secure storage manager for Figma OAuth2 tokens
  *
@@ -11,16 +29,22 @@ import { deriveEncryptionKey } from './crypto-utils.js';
  *
  * Tokens are encrypted at rest with a machine-specific key and file permissions
  * are set to 0600 (owner read/write only)
+ *
+ * For production code, use getTokenStore() to get the singleton instance.
+ * The constructor is still exported for test isolation.
  */ export class TokenStore {
     config;
     constructor(options){
+        if (process.env.AWS_EXECUTION_ENV) {
+            throw new Error('TokenStore cannot be used in AWS Lambda environments');
+        }
+        const environment = options?.environment ?? 'production';
+        const projectName = environment === 'production' ? 'payloadcms-figma' : `payloadcms-figma-${environment}`;
         this.config = new Conf({
-            configName: options?.configName || 'payloadcms-figma',
-            projectName: 'payloadcms-figma',
-            // Enable encryption with machine-specific key for better security
+            clearInvalidConfig: true,
+            configName: options?.configName || projectName,
             encryptionKey: options?.encryptionKey || deriveEncryptionKey(),
-            // Clear schema to avoid validation issues
-            clearInvalidConfig: true
+            projectName
         });
     }
     /**
@@ -183,6 +207,42 @@ import { deriveEncryptionKey } from './crypto-utils.js';
         const projectTokens = this.config.get('projectTokens') || {};
         return Object.keys(projectTokens);
     }
+    /**
+   * Build the composite key for bootstrap data storage
+   * @param projectId - The CMS resource/project ID
+   * @param environmentName - The environment name (e.g. 'production', 'staging')
+   * @returns Composite key string
+   */ bootstrapKey(projectId, environmentName) {
+        return `${projectId}:${environmentName}`;
+    }
+    /**
+   * Retrieve bootstrap data for a project + environment
+   * @param projectId - The CMS resource/project ID
+   * @param environmentName - The environment name
+   * @returns BootstrapData if stored, null otherwise
+   */ getBootstrapData(projectId, environmentName) {
+        const allData = this.config.get('bootstrapData') || {};
+        return allData[this.bootstrapKey(projectId, environmentName)] || null;
+    }
+    /**
+   * Store bootstrap data for a project + environment
+   * @param projectId - The CMS resource/project ID
+   * @param environmentName - The environment name
+   * @param data - The bootstrap data to store
+   */ setBootstrapData(projectId, environmentName, data) {
+        const allData = this.config.get('bootstrapData') || {};
+        allData[this.bootstrapKey(projectId, environmentName)] = data;
+        this.config.set('bootstrapData', allData);
+    }
+    /**
+   * Clear bootstrap data for a project + environment
+   * @param projectId - The CMS resource/project ID
+   * @param environmentName - The environment name
+   */ clearBootstrapData(projectId, environmentName) {
+        const allData = this.config.get('bootstrapData') || {};
+        delete allData[this.bootstrapKey(projectId, environmentName)];
+        this.config.set('bootstrapData', allData);
+    }
 }
 
 //# sourceMappingURL=token-store.js.map

package/dist/auth/types.d.ts

@@ -1,5 +1,6 @@
 import type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User } from '@figma/rest-api-spec';
 import type { JWTPayload as JoseJWTPayload } from 'jose';
+import type { Environment } from '../constants.js';
 /**
  * Standard OAuth2 scopes for user-level permissions
  * @see https://www.figma.com/developers/api#oauth2
@@ -105,12 +106,14 @@ export interface OAuthTokenRefreshParams {
 /**
  * Configuration for token storage
  */
-export interface TokenStoreConfig {
-    /** Custom config name (defaults to 'payloadcms-figma') */
+export type TokenStoreConfig = {
+    /** Config file name (for testing) */
     configName?: string;
-    /** Enable encryption (defaults to true) */
+    /** Encryption key (for testing) */
     encryptionKey?: string;
-}
+    /** Environment for config file naming */
+    environment?: Environment;
+};
 /**
  * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients
  * @see https://datatracker.ietf.org/doc/html/rfc7636
@@ -158,6 +161,16 @@ export type FigmaErrorResponse = ErrorResponsePayloadWithErrMessage | ErrorRespo
  * Re-exported from @figma/rest-api-spec
  */
 export type FigmaUser = User;
+/**
+ * Bootstrap data cached in the local encrypted store
+ * Keyed by projectId:environmentName
+ */
+export type BootstrapData = {
+    contentSystemId: string;
+    oauthClientId: string;
+    oauthClientSecret: string;
+    tenantInstanceId: string;
+};
 /**
  * JWT payload structure from Figma project tokens
  * Extends jose's standard JWTPayload with Figma-specific claims

package/dist/cli.js

@@ -1,12 +1,16 @@
 import * as p from '@clack/prompts';
 import arg from 'arg';
 import pc from 'picocolors';
+import { buildLambdaZipCommand } from './commands/build-lambda-zip.js';
+import { debugCommand } from './commands/debug.js';
 import { deployCommand } from './commands/deploy.js';
+import { envCommand } from './commands/env.js';
 import { initCommand } from './commands/init.js';
 import { listTokensCommand } from './commands/list-tokens.js';
 import { loginCommand } from './commands/login.js';
 import { logoutCommand } from './commands/logout.js';
-import { feedbackOutro, helpMessage } from './utils/messages.js';
+import { setInfraEnvironment } from './constants.js';
+import { helpMessage } from './utils/messages.js';
 /**
  * Entrypoint for bin/cli.js
  */ export async function main() {
@@ -24,16 +28,22 @@ class Main {
     constructor(){
         // @ts-expect-error bad typings
         this.args = arg({
+            '--all': Boolean,
             '--debug': Boolean,
+            '--env': String,
             '--force': Boolean,
             '--help': Boolean,
             '--id': String,
+            '--infra-env': String,
             '--name': String,
             '--skip-auth': Boolean,
+            '--skip-build': Boolean,
+            '--version': Boolean,
             '--yes': Boolean,
             // Aliases
             '-f': '--force',
             '-h': '--help',
+            '-v': '--version',
             '-y': '--yes'
         }, {
             permissive: true
@@ -42,6 +52,19 @@ class Main {
         if (this.args['--debug']) {
             process.env.DEBUG = 'true';
         }
+        // Handle --infra-env flag for infrastructure environment switching
+        if (this.args['--infra-env']) {
+            const infraEnvArg = this.args['--infra-env'].toLowerCase();
+            if (infraEnvArg === 'prod' || infraEnvArg === 'production') {
+                setInfraEnvironment('production');
+            } else if (infraEnvArg === 'staging') {
+                setInfraEnvironment('staging');
+            } else {
+                // eslint-disable-next-line no-console
+                console.error(`Invalid --infra-env value: ${this.args['--infra-env']}. Use 'production' or 'staging'.`);
+                process.exit(1);
+            }
+        }
     }
     async init() {
         try {
@@ -49,30 +72,59 @@ class Main {
                 helpMessage();
                 process.exit(0);
             }
+            if (this.args['--version']) {
+                const { getOwnVersion } = await import('./utils/version-check.js');
+                const version = await getOwnVersion();
+                // eslint-disable-next-line no-console
+                console.log(version);
+                process.exit(0);
+            }
             // Get the subcommand (first non-flag argument)
             const subcommand = this.args._[0];
+            if (!subcommand) {
+                helpMessage();
+                process.exit(0);
+            }
+            // Debug command outputs plain text for copy-paste — skip styled intro
+            if (subcommand === 'debug') {
+                await debugCommand();
+                process.exit(0);
+            }
             // eslint-disable-next-line no-console
             console.log('\n');
             p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')));
             // Route to appropriate command handler
             switch(subcommand){
+                case 'build-lambda-zip':
+                    await buildLambdaZipCommand();
+                    break;
                 case 'deploy':
                     await deployCommand({
+                        id: this.args['--id'],
                         debug: this.args['--debug'],
+                        env: this.args['--env'],
+                        skipBuild: this.args['--skip-build'],
                         yes: this.args['--yes']
                     });
                     break;
+                case 'env':
+                    await envCommand({
+                        name: this.args._[1]
+                    });
+                    break;
                 case 'init':
                     await initCommand({
                         id: this.args['--id'],
                         name: this.args['--name'],
                         debug: this.args['--debug'],
+                        env: this.args['--env'],
                         force: this.args['--force'],
                         skipAuth: this.args['--skip-auth']
                     });
                     break;
                 case 'list-tokens':
                     listTokensCommand({
+                        all: this.args['--all'],
                         debug: this.args['--debug']
                     });
                     break;
@@ -81,14 +133,10 @@ class Main {
                     break;
                 case 'logout':
                     await logoutCommand({
+                        all: this.args['--all'],
                         debug: this.args['--debug']
                     });
                     break;
-                case undefined:
-                    // No subcommand - show default message
-                    p.note("Let's create a new CMS!");
-                    p.outro(feedbackOutro());
-                    break;
                 default:
                     p.log.error(pc.red(`Unknown command: ${subcommand}`));
                     p.note('Use --help to see available commands', 'Tip');

package/dist/commands/build-lambda-zip.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Build Lambda deployment zip from current directory
+ */
+export declare function buildLambdaZipCommand(): Promise<void>;
+//# sourceMappingURL=build-lambda-zip.d.ts.map

package/dist/commands/build-lambda-zip.js

@@ -0,0 +1,19 @@
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { buildLambdaZip } from '../utils/build-lambda-zip.js';
+/**
+ * Build Lambda deployment zip from current directory
+ */ export async function buildLambdaZipCommand() {
+    const projectPath = process.cwd();
+    const s = p.spinner();
+    s.start('Creating lambda.zip');
+    try {
+        await buildLambdaZip(projectPath);
+        s.stop(pc.green('✓ Created lambda.zip'));
+    } catch (error) {
+        s.stop(pc.red('✗ Failed to create lambda.zip'));
+        throw error;
+    }
+}
+
+//# sourceMappingURL=build-lambda-zip.js.map

package/dist/commands/debug.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Handle the `@payloadcms/figma debug` command
+ *
+ * Outputs environment, auth, project, and package info for debugging.
+ * All data is local — no network calls are made.
+ */
+export declare function debugCommand(): Promise<void>;
+//# sourceMappingURL=debug.d.ts.map