@payloadcms/figma 0.0.1-alpha.61 → 0.0.1-alpha.62

package/dist/api/control-plane.d.ts

@@ -28,6 +28,10 @@ export interface CreateTenantOptions {
  * Options for creating a new deployment
  */
 export interface CreateDeploymentOptions {
+    /** Framework adapter name (e.g., "vite", "nextjs"). Forwarded to Gatekeeper. */
+    adapter?: string;
+    /** SPA fallback path (e.g., "/index.html"). Vite-only. */
+    fallback?: string;
     /** Pages keyed by route, each with its associated asset keys */
     pages: Record<string, {
         assets: string[];

package/dist/api/control-plane.js

@@ -184,14 +184,21 @@ import * as log from '../utils/log.js';
             assets: pageData.assets
         };
     }
+    const body = {
+        pages,
+        static_assets: options.staticAssets
+    };
+    if (options.adapter) {
+        body.adapter = options.adapter;
+    }
+    if (options.fallback) {
+        body.fallback = options.fallback;
+    }
     // REAL API IMPLEMENTATION
     const response = await controlPlaneFetch({
         context: 'create deployment',
         options: {
-            body: JSON.stringify({
-                pages,
-                static_assets: options.staticAssets
-            }),
+            body: JSON.stringify(body),
             headers: {
                 ...getAuthHeaders(credential),
                 'Content-Type': 'application/json'

package/dist/cli.js

@@ -68,9 +68,11 @@ class Main {
                 setInfraEnvironment('production');
             } else if (infraEnvArg === 'staging') {
                 setInfraEnvironment('staging');
+            } else if (infraEnvArg === 'devbox') {
+                setInfraEnvironment('devbox');
             } else {
                 // eslint-disable-next-line no-console
-                console.error(`Invalid --infra-env value: ${this.args['--infra-env']}. Use 'production' or 'staging'.`);
+                console.error(`Invalid --infra-env value: ${this.args['--infra-env']}. Use 'production', 'staging', or 'devbox'.`);
                 process.exit(1);
             }
         }

package/dist/commands/deploy.js

@@ -241,6 +241,8 @@ import { loginCommand } from './login.js';
             };
         }
         const createResponse = await createDeployment(credential, tenantInstanceId, {
+            adapter: adapter.name,
+            fallback: adapter.fallback,
             pages: pagesPayload,
             staticAssets: assets.uploadKeys
         });

package/dist/commands/init.js

@@ -67,7 +67,7 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
  *
  * @param options - Command options
  */ export async function initCommand(options) {
-    // Check for outdated version (non-blocking)
+    // Check for mismatched version (non-blocking)
     const currentVersion = await getOwnVersion();
     await checkForUpdates(currentVersion);
     // Check authentication

package/dist/config/oauth.d.ts

@@ -1,8 +1,16 @@
 import type { OAuthConfig } from '../auth/types.js';
 export declare const DEFAULT_CALLBACK_PORT = 34462;
 /**
- * Get OAuth configuration for current environment
- * Uses getEnvConfig() to determine staging vs production
+ * Get OAuth configuration for current environment.
+ *
+ * Honors env overrides:
+ *   FIGMA_API_BASE_URL → tokenUrl, refreshUrl
+ *   FIGMA_WEB_BASE_URL → authorizationUrl (appends /oauth)
+ *   FIGMA_CLIENT_ID    → clientId
+ *   FIGMA_REDIRECT_URI → redirectUri
+ *
+ * When FIGMA_INFRA_ENV=devbox, FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL are
+ * required (ENV_CONFIG.devbox has empty URL defaults to fail-closed).
  */
 export declare function getOAuthConfig(): OAuthConfig;
 export declare const TOKEN_EXPIRY_BUFFER_SECONDS = 300;

package/dist/config/oauth.js

@@ -1,10 +1,24 @@
-import { getEnvConfig } from '../constants.js';
+import { getEnvConfig, getInfraEnvironment } from '../constants.js';
 export const DEFAULT_CALLBACK_PORT = 34462;
 /**
- * Get OAuth configuration for current environment
- * Uses getEnvConfig() to determine staging vs production
+ * Get OAuth configuration for current environment.
+ *
+ * Honors env overrides:
+ *   FIGMA_API_BASE_URL → tokenUrl, refreshUrl
+ *   FIGMA_WEB_BASE_URL → authorizationUrl (appends /oauth)
+ *   FIGMA_CLIENT_ID    → clientId
+ *   FIGMA_REDIRECT_URI → redirectUri
+ *
+ * When FIGMA_INFRA_ENV=devbox, FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL are
+ * required (ENV_CONFIG.devbox has empty URL defaults to fail-closed).
  */ export function getOAuthConfig() {
-    const { apiBaseUrl, authorizationUrl, clientId } = getEnvConfig();
+    const { apiBaseUrl: defaultApi, authorizationUrl: defaultAuth, clientId } = getEnvConfig();
+    const apiBaseUrl = process.env.FIGMA_API_BASE_URL || defaultApi;
+    const webBase = process.env.FIGMA_WEB_BASE_URL;
+    const authorizationUrl = webBase ? `${webBase}/oauth` : defaultAuth;
+    if (getInfraEnvironment() === 'devbox' && (!apiBaseUrl || !authorizationUrl)) {
+        throw new Error('FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL must be set when FIGMA_INFRA_ENV=devbox');
+    }
     return {
         authorizationUrl,
         clientId: process.env.FIGMA_CLIENT_ID || clientId,

package/dist/constants.d.ts

@@ -1,7 +1,9 @@
 /**
- * Figma infrastructure environment (production or staging)
+ * Figma infrastructure environment (production, staging, or devbox).
+ * devbox is a local-dev mode that requires FIGMA_API_BASE_URL and
+ * FIGMA_WEB_BASE_URL env overrides to point at a Coder devbox.
  */
-export type Environment = 'production' | 'staging';
+export type Environment = 'devbox' | 'production' | 'staging';
 type EnvironmentConfig = {
     /** Figma API base URL. Override: FIGMA_API_BASE_URL */
     apiBaseUrl: string;

package/dist/constants.js

@@ -18,6 +18,17 @@ import { getEnvVarSync } from './utils/env-management.js';
         contentApiUrl: 'https://us-east-1.cms-tenants-001-staging.figmacontentstaging.com',
         identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',
         jwksUri: 'https://static.figmacontentstaging.com/.well_known/jwks.json'
+    },
+    // Empty URLs are intentional: devbox mode requires FIGMA_API_BASE_URL and
+    // FIGMA_WEB_BASE_URL to be set, validated at getOAuthConfig() time.
+    // clientId defaults to the dev seed value in sinatra/db/seeds.rb.
+    devbox: {
+        apiBaseUrl: '',
+        authorizationUrl: '',
+        clientId: 'rNZBcf3xBDmI76mQ9603su',
+        contentApiUrl: '',
+        identityMetadata: '',
+        jwksUri: ''
     }
 };
 /**
@@ -58,9 +69,13 @@ export function getInfraEnvironment() {
         return envOverride;
     }
     // Check process.env first (case-insensitive)
-    if (process.env.FIGMA_INFRA_ENV?.toLowerCase() === 'staging') {
+    const processEnv = process.env.FIGMA_INFRA_ENV?.toLowerCase();
+    if (processEnv === 'staging') {
         return 'staging';
     }
+    if (processEnv === 'devbox') {
+        return 'devbox';
+    }
     // Fall back to .env file in cwd (check both new and old env var names)
     const envFileValue = getEnvVarSync(process.cwd(), 'FIGMA_INFRA_ENV') ?? getEnvVarSync(process.cwd(), 'FIGMA_ENV');
     if (envFileValue) {
@@ -68,6 +83,9 @@ export function getInfraEnvironment() {
         if (env === 'staging') {
             return 'staging';
         }
+        if (env === 'devbox') {
+            return 'devbox';
+        }
         if (env !== 'production') {
             // eslint-disable-next-line no-console
             console.warn(`Warning: Invalid FIGMA_INFRA_ENV value "${envFileValue}" in .env file. Using production.`);

package/dist/db-content-api/index.js

@@ -8,6 +8,7 @@ import { addFallbackSort } from './temp-utilities/sorting.js';
 import { unwrapDocument, unwrapFindResponse } from './temp-utilities/unwrapDocument.js';
 import { createAuthMiddleware, createErrorMiddleware } from './utilities/auth.js';
 import { dataToContentAPI, resolveVersionContent } from './utilities/data/index.js';
+import { validateRelationshipIds } from './utilities/data/validateRelationships.js';
 import { convertPayloadJoinsToContentAPI } from './utilities/joins.js';
 import { addFallbackLocale } from './utilities/locale/index.js';
 import { buildMeta } from './utilities/meta/buildMeta.js';
@@ -353,6 +354,11 @@ async function findDistinct(args) {
 }
 async function updateMany(args) {
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,
@@ -394,6 +400,11 @@ async function updateOne(args) {
             equals: args.id
         }
     };
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,
@@ -498,6 +509,11 @@ async function create(args) {
         id = uuid();
     }
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:create', {
         body: {
             collection: args.collection,
@@ -611,6 +627,11 @@ async function upsert(args) {
         documentId = uuid();
     }
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,

package/dist/db-content-api/utilities/data/validateRelationships.d.ts

@@ -0,0 +1,7 @@
+import type { Payload } from 'payload';
+export declare function validateRelationshipIds({ collectionSlug, data, payload, }: {
+    collectionSlug: string;
+    data: Record<string, unknown>;
+    payload: Payload;
+}): void;
+//# sourceMappingURL=validateRelationships.d.ts.map

package/dist/db-content-api/utilities/data/validateRelationships.js

@@ -0,0 +1,102 @@
+import { traverseFields } from 'payload';
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function collectRelationshipValues({ data, fields }) {
+    const relationships = [];
+    const callback = ({ field, ref })=>{
+        if (!('name' in field) || !field.name) {
+            return;
+        }
+        if (field.type !== 'relationship' && field.type !== 'upload') {
+            return;
+        }
+        if (!ref || typeof ref !== 'object') {
+            return;
+        }
+        const rawValue = ref[field.name];
+        if (rawValue == null || rawValue === '') {
+            return;
+        }
+        // For localized fields, the value is a locale map (e.g. { en: "uuid", fr: "uuid" }).
+        // Iterate locale values instead of treating the map as an ID.
+        if ('localized' in field && field.localized) {
+            if (typeof rawValue === 'object' && !Array.isArray(rawValue)) {
+                for (const localeValue of Object.values(rawValue)){
+                    if (localeValue != null && localeValue !== '') {
+                        parseRelationshipValues(localeValue, field.relationTo, relationships);
+                    }
+                }
+            }
+            return;
+        }
+        parseRelationshipValues(rawValue, field.relationTo, relationships);
+    };
+    traverseFields({
+        callback,
+        fields,
+        fillEmpty: false,
+        ref: data
+    });
+    return relationships;
+}
+function parseRelationshipValues(value, relationTo, relationships) {
+    if (Array.isArray(relationTo)) {
+        // Polymorphic (single or hasMany): value is { relationTo, value } or array of them
+        const values = Array.isArray(value) ? value : [
+            value
+        ];
+        for (const v of values){
+            if (v && typeof v === 'object' && 'relationTo' in v && 'value' in v) {
+                const obj = v;
+                if (obj.value != null && obj.value !== '') {
+                    relationships.push({
+                        collection: obj.relationTo,
+                        value: obj.value
+                    });
+                }
+            }
+        }
+    } else {
+        // Non-polymorphic (single or hasMany): value is a bare ID or array of IDs
+        const values = Array.isArray(value) ? value : [
+            value
+        ];
+        for (const v of values){
+            if (v != null && v !== '') {
+                relationships.push({
+                    collection: relationTo,
+                    value: v
+                });
+            }
+        }
+    }
+}
+function isValidId(value, customIDType) {
+    if (customIDType === 'number') {
+        const num = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+        return Number.isFinite(num);
+    }
+    if (customIDType === 'text') {
+        return typeof value === 'string' && value.length > 0;
+    }
+    return typeof value === 'string' && UUID_REGEX.test(value);
+}
+export function validateRelationshipIds({ collectionSlug, data, payload }) {
+    const isGlobal = collectionSlug.startsWith('_global-');
+    const actualSlug = isGlobal ? collectionSlug.substring(8) : collectionSlug;
+    const config = isGlobal ? payload.config.globals?.find((g)=>g.slug === actualSlug) : payload.config.collections.find((c)=>c.slug === actualSlug);
+    if (!config?.fields) {
+        return;
+    }
+    const relationships = collectRelationshipValues({
+        data,
+        fields: config.fields
+    });
+    for (const { collection, value } of relationships){
+        const customIDType = payload.collections?.[collection]?.customIDType;
+        if (!isValidId(value, customIDType)) {
+            throw new Error(`Invalid relationship ID "${String(value)}" for collection "${collection}". Expected ${customIDType === 'number' ? 'a number' : customIDType === 'text' ? 'a non-empty string' : 'a valid UUID'}.`);
+        }
+    }
+}
+
+//# sourceMappingURL=validateRelationships.js.map

package/dist/storage-content-api/staticHandler.js

@@ -23,24 +23,7 @@ export const getHandler = ({ client, collection })=>{
                     status: 500
                 });
             }
-            // Fetch file bytes from S3 (required for Payload's image processing)
-            const fileResponse = await fetch(data.url);
-            if (!fileResponse.ok) {
-                req.payload.logger.error(`S3 fetch failed: ${fileResponse.status} ${fileResponse.statusText}`);
-                return new Response('Failed to fetch file from storage', {
-                    status: 502
-                });
-            }
-            const contentType = fileResponse.headers.get('content-type') || 'application/octet-stream';
-            const contentLength = fileResponse.headers.get('content-length');
-            return new Response(fileResponse.body, {
-                headers: {
-                    'Content-Type': contentType,
-                    ...contentLength && {
-                        'Content-Length': contentLength
-                    }
-                }
-            });
+            return Response.redirect(data.url, 302);
         } catch (err) {
             req.payload.logger.error({
                 err,

package/dist/utils/build-lambda-zip.d.ts

@@ -4,8 +4,10 @@
  * Cross-platform replacement for build_for_lambda.sh:
  * 1. Copies .next/static to .next/standalone/.next/static
  * 2. Copies run.sh to .next/standalone/run.sh
- * 3. Copies public/ to .next/standalone/public/ (if exists)
- * 4. Creates lambda.zip from .next/standalone/
+ * 3. Creates lambda.zip from .next/standalone/
+ *
+ * Note: public/ is NOT included in the zip — those files are uploaded
+ * as static assets and served via CDN, not from the Lambda function.
  *
  * @param projectPath - Path to project root
  * @throws Error if standalone directory missing or zip creation fails

package/dist/utils/build-lambda-zip.js

@@ -8,15 +8,16 @@ import path from 'path';
  * Cross-platform replacement for build_for_lambda.sh:
  * 1. Copies .next/static to .next/standalone/.next/static
  * 2. Copies run.sh to .next/standalone/run.sh
- * 3. Copies public/ to .next/standalone/public/ (if exists)
- * 4. Creates lambda.zip from .next/standalone/
+ * 3. Creates lambda.zip from .next/standalone/
+ *
+ * Note: public/ is NOT included in the zip — those files are uploaded
+ * as static assets and served via CDN, not from the Lambda function.
  *
  * @param projectPath - Path to project root
  * @throws Error if standalone directory missing or zip creation fails
  */ export async function buildLambdaZip(projectPath) {
     const standalonePath = path.join(projectPath, '.next', 'standalone');
     const staticPath = path.join(projectPath, '.next', 'static');
-    const publicPath = path.join(projectPath, 'public');
     const runShPath = path.join(projectPath, 'run.sh');
     const zipPath = path.join(projectPath, 'lambda.zip');
     if (!await isDirectory(standalonePath)) {
@@ -31,10 +32,6 @@ import path from 'path';
     } catch  {
     // run.sh may not exist in all setups
     }
-    if (await isDirectory(publicPath)) {
-        const destPublic = path.join(standalonePath, 'public');
-        await copyDirectory(publicPath, destPublic);
-    }
     await createZip(standalonePath, zipPath);
 }
 async function isDirectory(dirPath) {

package/dist/utils/messages.js

@@ -59,7 +59,7 @@ export function helpMessage() {
 
   ${pc.bold('GLOBAL OPTIONS')}
 
-      ${pc.dim('--infra-env <env>')}                     Target infrastructure (production or staging)
+      ${pc.dim('--infra-env <env>')}                     Target infrastructure (production, staging, or devbox)
 
   ${pc.bold('DOCUMENTATION')}
 

package/dist/utils/version-check.js

@@ -21,7 +21,7 @@ export async function checkForUpdates(currentVersion) {
         if (!latestVersion || latestVersion === currentVersion) {
             return;
         }
-        p.log.warn(pc.yellow(`@payloadcms/figma ${currentVersion} is outdated. Latest: ${latestVersion}`));
+        p.log.warn(pc.yellow(`@payloadcms/figma ${currentVersion} differs from latest. Latest: ${latestVersion}`));
         p.log.message(pc.dim(`  Run: npx @payloadcms/figma@${latestVersion} init --id <your-id>`));
     } catch  {
     // Silent catch - network errors, timeouts, parse errors should not interrupt CLI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.0.1-alpha.61",
+  "version": "0.0.1-alpha.62",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {