@payloadcms/figma 0.0.1-alpha.61 → 0.0.1-alpha.63

package/dist/api/control-plane.d.ts

@@ -28,6 +28,10 @@ export interface CreateTenantOptions {
  * Options for creating a new deployment
  */
 export interface CreateDeploymentOptions {
+    /** Framework adapter name (e.g., "vite", "nextjs"). Forwarded to Gatekeeper. */
+    adapter?: string;
+    /** SPA fallback path (e.g., "/index.html"). Vite-only. */
+    fallback?: string;
     /** Pages keyed by route, each with its associated asset keys */
     pages: Record<string, {
         assets: string[];

package/dist/api/control-plane.js

@@ -184,14 +184,21 @@ import * as log from '../utils/log.js';
             assets: pageData.assets
         };
     }
+    const body = {
+        pages,
+        static_assets: options.staticAssets
+    };
+    if (options.adapter) {
+        body.adapter = options.adapter;
+    }
+    if (options.fallback) {
+        body.fallback = options.fallback;
+    }
     // REAL API IMPLEMENTATION
     const response = await controlPlaneFetch({
         context: 'create deployment',
         options: {
-            body: JSON.stringify({
-                pages,
-                static_assets: options.staticAssets
-            }),
+            body: JSON.stringify(body),
             headers: {
                 ...getAuthHeaders(credential),
                 'Content-Type': 'application/json'

package/dist/auth/crypto-utils.d.ts

@@ -36,4 +36,15 @@ export declare function deriveEncryptionKey(): string;
  * without exposing the actual key.
  */
 export declare function getEncryptionKeyHash(): string;
+/**
+ * Write decrypted versions of all encrypted store files for debugging.
+ *
+ * For each .json file in the store directory, creates a neighboring .decrypted.json
+ * file containing the decrypted contents. Useful for debugging token storage issues.
+ *
+ * @param rootDir - Root directory of the token store (e.g., ~/Library/Preferences/payloadcms-figma-nodejs)
+ * @param encryptionKey - The encryption key used by Conf
+ * @returns Array of paths to decrypted files created
+ */
+export declare function exportDecryptedStoreFiles(rootDir: string, encryptionKey: string): string[];
 //# sourceMappingURL=crypto-utils.d.ts.map

package/dist/auth/crypto-utils.js

@@ -1,6 +1,8 @@
 import Conf from 'conf';
 import crypto from 'crypto';
+import fsSync from 'node:fs';
 import os from 'os';
+import path from 'path';
 /**
  * Get or generate a random salt for key derivation
  *
@@ -94,5 +96,54 @@ import os from 'os';
     const key = deriveEncryptionKey();
     return crypto.createHash('sha256').update(key).digest('hex').substring(0, 8);
 }
+/**
+ * Write decrypted versions of all encrypted store files for debugging.
+ *
+ * For each .json file in the store directory, creates a neighboring .decrypted.json
+ * file containing the decrypted contents. Useful for debugging token storage issues.
+ *
+ * @param rootDir - Root directory of the token store (e.g., ~/Library/Preferences/payloadcms-figma-nodejs)
+ * @param encryptionKey - The encryption key used by Conf
+ * @returns Array of paths to decrypted files created
+ */ export function exportDecryptedStoreFiles(rootDir, encryptionKey) {
+    const decryptedFiles = [];
+    function processDirectory(dir) {
+        if (!fsSync.existsSync(dir)) {
+            return;
+        }
+        const entries = fsSync.readdirSync(dir, {
+            withFileTypes: true
+        });
+        for (const entry of entries){
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                processDirectory(fullPath);
+            } else if (entry.name.endsWith('.json') && !entry.name.endsWith('.decrypted.json') && !entry.name.includes('.corrupt-')) {
+                try {
+                    // Extract configName from filename (remove .json extension)
+                    const configName = entry.name.replace(/\.json$/, '');
+                    // Create a Conf instance to read/decrypt the file
+                    const config = new Conf({
+                        clearInvalidConfig: false,
+                        configName,
+                        cwd: dir,
+                        encryptionKey,
+                        projectName: 'payloadcms-figma'
+                    });
+                    // Read all data from the store (Conf decrypts it)
+                    const data = config.store;
+                    // Write decrypted content to neighboring file
+                    const decryptedPath = fullPath.replace(/\.json$/, '.decrypted.json');
+                    fsSync.writeFileSync(decryptedPath, JSON.stringify(data, null, 2));
+                    decryptedFiles.push(decryptedPath);
+                } catch  {
+                // Skip files that can't be decrypted (e.g., crypto config, already unencrypted)
+                }
+            }
+        }
+    }
+    processDirectory(rootDir);
+    return decryptedFiles;
+}
 
 //# sourceMappingURL=crypto-utils.js.map

package/dist/auth/oauth-flow.js

@@ -147,15 +147,15 @@ import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './
  * @throws OAuthFlowError if refresh fails
  */ export async function getValidOAuthAccessToken(tokenStore) {
     // Check if we have valid tokens
-    if (tokenStore.hasValidTokens()) {
-        const token = tokenStore.getAccessToken();
+    if (tokenStore.hasValidOauthToken()) {
+        const token = tokenStore.getCurrentOauthToken();
         return token ? {
             type: 'oauth',
             token
         } : null;
     }
     // Check if we have a refresh token
-    const refreshToken = tokenStore.getRefreshToken();
+    const refreshToken = tokenStore.getCurrentRefreshToken();
     if (!refreshToken) {
         return null;
     }

package/dist/auth/project-token.d.ts

@@ -6,6 +6,7 @@
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */
 import type { TokenStore } from './token-store.js';
+import type { ProjectStoreScope } from './types.js';
 /**
  * Error during project token operations
  */
@@ -26,22 +27,32 @@ export declare class ProjectTokenError extends Error {
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to get a token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
  */
-export declare function getValidProjectToken(tokenStore: TokenStore, tenantId: string): Promise<null | string>;
+export declare function getValidProjectToken({ projectInfo, tenantId, tokenStore, }: {
+    projectInfo?: ProjectStoreScope;
+    tenantId?: string;
+    tokenStore: TokenStore;
+}): Promise<null | string>;
 /**
  * Refresh a project token for a tenant
  *
  * Forces a refresh of the project token even if the current one is still valid.
  * Useful for testing or when you want to ensure you have the freshest token.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to refresh token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
  */
-export declare function refreshProjectToken(tokenStore: TokenStore, tenantId: string): Promise<null | string>;
+export declare function refreshProjectToken(params: {
+    projectInfo?: ProjectStoreScope;
+    tenantId?: string;
+    tokenStore: TokenStore;
+}): Promise<null | string>;
 //# sourceMappingURL=project-token.d.ts.map

package/dist/auth/project-token.js

@@ -55,18 +55,29 @@ import { getValidCredential } from './oauth-flow.js';
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to get a token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token generation fails
- */ export async function getValidProjectToken(tokenStore, tenantId) {
+ */ export async function getValidProjectToken({ projectInfo, tenantId, tokenStore }) {
     if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
         log.debug('FIGMA_CONTENT_API_ACCESS_KEY is set; skipping project token retrieval from API');
         return null;
     }
+    const resolvedTenantId = tenantId ?? tokenStore.getTenantId({
+        projectInfo
+    });
+    if (!resolvedTenantId) {
+        throw new ProjectTokenError('tenantId was not provided and could not be resolved from bootstrap data');
+    }
     // Check for existing valid project token
-    if (tokenStore.hasValidProjectToken(tenantId)) {
-        const projectToken = tokenStore.getProjectToken(tenantId);
+    if (tokenStore.hasValidProjectToken({
+        projectInfo
+    })) {
+        const projectToken = tokenStore.getProjectToken({
+            projectInfo
+        });
         return projectToken?.token || null;
     }
     // We need to refresh the project token
@@ -82,7 +93,7 @@ import { getValidCredential } from './oauth-flow.js';
         return null;
     }
     // Fetch a new project token from the Figma API
-    const projectToken = await fetchProjectToken(credential, tenantId);
+    const fetchedToken = await fetchProjectToken(credential, resolvedTenantId);
     // Validate the JWT signature and claims (skip for mocks)
     const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
     const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
@@ -90,11 +101,11 @@ import { getValidCredential } from './oauth-flow.js';
     if (hasEnvToken || shouldMock) {
         // MOCK: Skip JWT validation and parse claims directly
         log.debug('Skipping JWT validation for mock/env project token');
-        validatedClaims = parseJWTClaims(projectToken.token);
+        validatedClaims = parseJWTClaims(fetchedToken.token);
     } else {
         // REAL: Validate JWT signature against JWKS
         try {
-            validatedClaims = await validateProjectToken(projectToken.token, getInfraEnvironment());
+            validatedClaims = await validateProjectToken(fetchedToken.token, getInfraEnvironment());
         } catch (validationError) {
             // Handle validation errors
             if (validationError instanceof JWTValidationError) {
@@ -108,13 +119,16 @@ import { getValidCredential } from './oauth-flow.js';
         throw new ProjectTokenError('Project token missing expiration (exp) claim');
     }
     // Store the project token with validated expiration and claims
-    tokenStore.setProjectToken(tenantId, {
-        claims: validatedClaims,
-        expiresAt: validatedClaims.exp * 1000,
-        tenantId,
-        token: projectToken.token
+    tokenStore.setProjectToken({
+        projectInfo,
+        token: {
+            claims: validatedClaims,
+            expiresAt: validatedClaims.exp * 1000,
+            tenantId: resolvedTenantId,
+            token: fetchedToken.token
+        }
     });
-    return projectToken.token;
+    return fetchedToken.token;
 }
 /**
  * Refresh a project token for a tenant
@@ -122,15 +136,19 @@ import { getValidCredential } from './oauth-flow.js';
  * Forces a refresh of the project token even if the current one is still valid.
  * Useful for testing or when you want to ensure you have the freshest token.
  *
- * @param tokenStore - Token store for persisting tokens
- * @param tenantId - The tenant/CMS ID to refresh token for
+ * @param params.tokenStore - Token store for persisting tokens
+ * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
+ * @param params.projectInfo - Optional project scope (defaults to env vars)
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
- */ export async function refreshProjectToken(tokenStore, tenantId) {
+ */ export async function refreshProjectToken(params) {
+    const { projectInfo, tokenStore } = params;
     // Clear the existing project token to force a refresh
-    tokenStore.clearProjectToken(tenantId);
+    tokenStore.clearProjectToken({
+        projectInfo
+    });
     // Get a new token (which will fetch from API since we just cleared it)
-    return getValidProjectToken(tokenStore, tenantId);
+    return getValidProjectToken(params);
 }
 
 //# sourceMappingURL=project-token.js.map

package/dist/auth/token-store-migration.d.ts

@@ -0,0 +1,58 @@
+import type { BootstrapData, FigmaTokens, ProjectToken } from './types.js';
+export type LegacyStoreSchema = {
+    bootstrapData?: Record<string, BootstrapData>;
+    projectTokens?: Record<string, ProjectToken>;
+    tokens?: FigmaTokens;
+};
+export type MigrationCheckParams = {
+    checkFileExists?: (filePath: string) => boolean;
+    legacyFilePath: string;
+    newOAuthFilePath: string;
+};
+export type MigrateOAuthParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    newOAuthConfigName: string;
+    newOAuthCwd: string;
+    projectName: string;
+};
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */
+export declare function needsMigration(params: MigrationCheckParams): boolean;
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */
+export declare function migrateOAuth(params: MigrateOAuthParams): void;
+export type ResolveProjectStorePath = (scope: {
+    environmentName: string;
+    projectId: string;
+}) => {
+    configName: string;
+    cwd: string;
+};
+export type MigrateProjectDataParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    projectName: string;
+    resolveProjectStorePath: ResolveProjectStorePath;
+};
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */
+export declare function migrateProjectData(params: MigrateProjectDataParams): void;
+//# sourceMappingURL=token-store-migration.d.ts.map

package/dist/auth/token-store-migration.js

@@ -0,0 +1,156 @@
+import Conf from 'conf';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import * as log from '../utils/log.js';
+const OAUTH_STORE_SCHEMA_VERSION = 1;
+const PROJECT_STORE_SCHEMA_VERSION = 1;
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */ export function needsMigration(params) {
+    const checkExists = params.checkFileExists ?? fsSync.existsSync;
+    const newExists = checkExists(params.newOAuthFilePath);
+    if (newExists) {
+        return false;
+    }
+    return checkExists(params.legacyFilePath);
+}
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */ export function migrateOAuth(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const legacyTokens = safeGet(legacyConfig, 'tokens');
+    if (!legacyTokens) {
+        return;
+    }
+    // Ensure target directory exists
+    if (!fsSync.existsSync(params.newOAuthCwd)) {
+        fsSync.mkdirSync(params.newOAuthCwd, {
+            recursive: true
+        });
+    }
+    const newOAuthConfig = new Conf({
+        configName: params.newOAuthConfigName,
+        cwd: params.newOAuthCwd,
+        encryptionKey: params.encryptionKey,
+        projectName: params.projectName
+    });
+    // Write root-level keys
+    newOAuthConfig.set('_schemaVersion', OAUTH_STORE_SCHEMA_VERSION);
+    newOAuthConfig.set('accessToken', legacyTokens.accessToken);
+    newOAuthConfig.set('expiresAt', legacyTokens.expiresAt);
+    newOAuthConfig.set('refreshToken', legacyTokens.refreshToken);
+    if (legacyTokens.scopes) {
+        newOAuthConfig.set('scopes', legacyTokens.scopes);
+    }
+    if (legacyTokens.tokenType) {
+        newOAuthConfig.set('tokenType', legacyTokens.tokenType);
+    }
+    if (legacyTokens.userId) {
+        newOAuthConfig.set('userId', legacyTokens.userId);
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */ export function migrateProjectData(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const bootstrapData = safeGet(legacyConfig, 'bootstrapData') || {};
+    const projectTokens = safeGet(legacyConfig, 'projectTokens') || {};
+    if (Object.keys(bootstrapData).length === 0 && Object.keys(projectTokens).length === 0) {
+        return;
+    }
+    for (const [key, bootstrap] of Object.entries(bootstrapData)){
+        const separatorIdx = key.indexOf(':');
+        if (separatorIdx === -1) {
+            continue;
+        }
+        const projectId = key.slice(0, separatorIdx);
+        const environmentName = key.slice(separatorIdx + 1);
+        if (!projectId || !environmentName) {
+            continue;
+        }
+        const { configName, cwd } = params.resolveProjectStorePath({
+            environmentName,
+            projectId
+        });
+        const targetPath = path.join(cwd, `${configName}.json`);
+        if (fsSync.existsSync(targetPath)) {
+            continue;
+        }
+        if (!fsSync.existsSync(cwd)) {
+            fsSync.mkdirSync(cwd, {
+                recursive: true
+            });
+        }
+        const projectConfig = new Conf({
+            configName,
+            cwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+        projectConfig.set('_schemaVersion', PROJECT_STORE_SCHEMA_VERSION);
+        projectConfig.set('bootstrapData', bootstrap);
+        const legacyProjectToken = bootstrap.contentSystemId ? projectTokens[bootstrap.contentSystemId] : undefined;
+        if (legacyProjectToken) {
+            projectConfig.set('projectToken', legacyProjectToken);
+        }
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+function safeGet(config, key) {
+    try {
+        return config.get(key);
+    } catch (error) {
+        log.warning(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return undefined;
+    }
+}
+/**
+ * Open the legacy Conf store without `clearInvalidConfig`, so a decrypt
+ * error does not destroy the file. Returns null when the file cannot be
+ * opened — callers treat that as "nothing to migrate, leave file alone".
+ */ function openLegacyConfig(params) {
+    try {
+        return new Conf({
+            configName: params.legacyConfigName,
+            cwd: params.legacyCwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+    } catch (error) {
+        log.warning(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return null;
+    }
+}
+
+//# sourceMappingURL=token-store-migration.js.map