@payloadcms/figma 0.0.1-alpha.61 → 0.0.1-alpha.63

package/dist/cli.js

@@ -4,6 +4,7 @@ import pc from 'picocolors';
 import { buildLambdaZipCommand } from './commands/build-lambda-zip.js';
 import { debugCommand } from './commands/debug.js';
 import { deployCommand } from './commands/deploy.js';
+import { dumpTokensCommand } from './commands/dump-tokens.js';
 import { envCommand } from './commands/env.js';
 import { initCommand } from './commands/init.js';
 import { listTokensCommand } from './commands/list-tokens.js';
@@ -68,9 +69,11 @@ class Main {
                 setInfraEnvironment('production');
             } else if (infraEnvArg === 'staging') {
                 setInfraEnvironment('staging');
+            } else if (infraEnvArg === 'devbox') {
+                setInfraEnvironment('devbox');
             } else {
                 // eslint-disable-next-line no-console
-                console.error(`Invalid --infra-env value: ${this.args['--infra-env']}. Use 'production' or 'staging'.`);
+                console.error(`Invalid --infra-env value: ${this.args['--infra-env']}. Use 'production', 'staging', or 'devbox'.`);
                 process.exit(1);
             }
         }
@@ -99,6 +102,11 @@ class Main {
                 await debugCommand();
                 process.exit(0);
             }
+            // dump-tokens outputs plain text
+            if (subcommand === 'dump-tokens') {
+                await dumpTokensCommand();
+                process.exit(0);
+            }
             // eslint-disable-next-line no-console
             console.log('\n');
             p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')));

package/dist/commands/debug.js

@@ -36,14 +36,14 @@ function appendSystemSection(lines, env) {
     lines.push('');
 }
 function appendAuthSection(lines, tokenStore, cwd) {
-    const tokens = tokenStore.getTokens();
+    const tokens = tokenStore.getOauthInfo();
     lines.push('Auth:');
     if (!tokens) {
         lines.push('  Status:           Not authenticated');
         lines.push('');
         return;
     }
-    const isValid = tokenStore.hasValidTokens();
+    const isValid = tokenStore.hasValidOauthToken();
     lines.push(`  Status:           ${isValid ? 'Authenticated' : 'Token expired'}`);
     const email = getEmailFromClaims(tokenStore, cwd);
     if (email) {
@@ -62,7 +62,7 @@ function appendTokenStoreDiagnostics(lines, tokenStore) {
     lines.push(`  File:             ${filePath}`);
     lines.push(`  File Exists:      ${fileExists}`);
     lines.push(`  File Size:        ${fileSize}B`);
-    const canRead = tokenStore.getTokens() !== null || tokenStore.getRefreshToken() !== null;
+    const canRead = tokenStore.getOauthInfo() !== null || tokenStore.getCurrentRefreshToken() !== null;
     lines.push(`  Decryption:       ${fileExists ? canRead || fileSize === 0 ? 'OK' : 'FAILED' : 'N/A'}`);
     lines.push(`  Key Hash:         ${getEncryptionKeyHash()}`);
     lines.push('');
@@ -85,7 +85,12 @@ function appendProjectSection(lines, tokenStore, cwd) {
             lines.push(`  Content System ID:  ${bootstrapData.contentSystemId}`);
             lines.push(`  Tenant Instance ID: ${bootstrapData.tenantInstanceId}`);
             lines.push(`  OAuth Client ID:    ${maskToken(bootstrapData.oauthClientId)}`);
-            const projectToken = tokenStore.getProjectToken(bootstrapData.contentSystemId);
+            const projectToken = tokenStore.getProjectToken({
+                projectInfo: {
+                    environmentName,
+                    projectId
+                }
+            });
             if (projectToken) {
                 lines.push(`  Project Token:      ${formatExpiryTime(projectToken.expiresAt)}`);
             }
@@ -103,25 +108,24 @@ async function appendPackagesSection(lines) {
     lines.push(`  payload:            ${payloadVersion}`);
 }
 /**
- * Try resolving email from bootstrap data, then iterate all stored project tokens.
+ * Resolve email from the current project + environment scoped token when available.
  */ function getEmailFromClaims(tokenStore, cwd) {
     const projectId = getEnvVarSync(cwd, 'FIGMA_PROJECT_ID');
     const environmentName = getEnvVarSync(cwd, 'FIGMA_ENVIRONMENT_NAME');
     if (projectId && environmentName) {
         const bootstrapData = tokenStore.getBootstrapData(projectId, environmentName);
         if (bootstrapData) {
-            const email = tokenStore.getProjectTokenClaims(bootstrapData.contentSystemId)?.email;
+            const email = tokenStore.getProjectToken({
+                projectInfo: {
+                    environmentName,
+                    projectId
+                }
+            })?.claims?.email;
             if (email) {
                 return email;
             }
         }
     }
-    for (const id of tokenStore.getAllProjectTokenTenantIds()){
-        const email = tokenStore.getProjectTokenClaims(id)?.email;
-        if (email) {
-            return email;
-        }
-    }
     return null;
 }
 function getPayloadVersion() {

package/dist/commands/deploy.js

@@ -241,6 +241,8 @@ import { loginCommand } from './login.js';
             };
         }
         const createResponse = await createDeployment(credential, tenantInstanceId, {
+            adapter: adapter.name,
+            fallback: adapter.fallback,
             pages: pagesPayload,
             staticAssets: assets.uploadKeys
         });

package/dist/commands/dump-tokens.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Handle the `@payloadcms/figma dump-tokens` command
+ *
+ * Exports decrypted versions of encrypted token store files in
+ * `oauth/` and `projects/` subdirectories (new structure) plus any legacy
+ * per-env directories from older package versions. Creates
+ * `.decrypted.json` files next to each encrypted `.json` file.
+ *
+ * Skips the `payloadcms-figma-crypto.json` salt file at the root.
+ */
+export declare function dumpTokensCommand(): Promise<void>;
+//# sourceMappingURL=dump-tokens.d.ts.map

package/dist/commands/dump-tokens.js

@@ -0,0 +1,69 @@
+import * as p from '@clack/prompts';
+import envPaths from 'env-paths';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import pc from 'picocolors';
+import { deriveEncryptionKey, exportDecryptedStoreFiles } from '../auth/crypto-utils.js';
+/**
+ * Handle the `@payloadcms/figma dump-tokens` command
+ *
+ * Exports decrypted versions of encrypted token store files in
+ * `oauth/` and `projects/` subdirectories (new structure) plus any legacy
+ * per-env directories from older package versions. Creates
+ * `.decrypted.json` files next to each encrypted `.json` file.
+ *
+ * Skips the `payloadcms-figma-crypto.json` salt file at the root.
+ */ export async function dumpTokensCommand() {
+    const encryptionKey = deriveEncryptionKey();
+    const newRoot = envPaths('payloadcms-figma').config;
+    const stagingLegacyRoot = envPaths('payloadcms-figma-staging').config;
+    const candidateDirs = [
+        path.join(newRoot, 'oauth'),
+        path.join(newRoot, 'projects'),
+        stagingLegacyRoot
+    ];
+    const targetDirs = Array.from(new Set(candidateDirs)).filter((dir)=>fsSync.existsSync(dir));
+    if (targetDirs.length === 0) {
+        // eslint-disable-next-line no-console
+        console.log('No token store directories found.');
+        return;
+    }
+    // eslint-disable-next-line no-console
+    console.log(pc.yellow('⚠  dump-tokens writes DECRYPTED token files to disk.'));
+    // eslint-disable-next-line no-console
+    console.log('Target directories:');
+    for (const dir of targetDirs){
+        // eslint-disable-next-line no-console
+        console.log(`  ${dir}`);
+    }
+    // eslint-disable-next-line no-console
+    console.log('');
+    const confirmed = await p.confirm({
+        initialValue: false,
+        message: 'Continue? Remember to delete the decrypted files after use.'
+    });
+    if (p.isCancel(confirmed) || !confirmed) {
+        // eslint-disable-next-line no-console
+        console.log('Cancelled.');
+        return;
+    }
+    const decryptedFiles = [];
+    for (const dir of targetDirs){
+        decryptedFiles.push(...exportDecryptedStoreFiles(dir, encryptionKey));
+    }
+    if (decryptedFiles.length === 0) {
+        // eslint-disable-next-line no-console
+        console.log('No encrypted files could be decrypted with the current machine key.');
+        return;
+    }
+    // eslint-disable-next-line no-console
+    console.log(`\nCreated ${decryptedFiles.length} decrypted file(s):`);
+    for (const file of decryptedFiles){
+        // eslint-disable-next-line no-console
+        console.log(`  ${file}`);
+    }
+    // eslint-disable-next-line no-console
+    console.log('\nNote: These files contain sensitive tokens. Delete after use.');
+}
+
+//# sourceMappingURL=dump-tokens.js.map

package/dist/commands/init.js

@@ -29,12 +29,16 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
  * @param tokenStore - Token store instance
  * @param contentSystemId - Content System ID to generate token for
  * @param spinner - Clack spinner instance for status updates (only used in debug mode)
- */ async function generateProjectTokenWithFeedback(tokenStore, contentSystemId, spinner) {
+ */ async function generateProjectTokenWithFeedback(tokenStore, contentSystemId, spinner, projectInfo) {
     if (isDebug()) {
         spinner.start('Generating project token...');
     }
     try {
-        const projectToken = await getValidProjectToken(tokenStore, contentSystemId);
+        const projectToken = await getValidProjectToken({
+            projectInfo,
+            tenantId: contentSystemId,
+            tokenStore
+        });
         if (isDebug()) {
             if (projectToken) {
                 spinner.stop(pc.green('✓ Project token generated'));
@@ -67,7 +71,7 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
  *
  * @param options - Command options
  */ export async function initCommand(options) {
-    // Check for outdated version (non-blocking)
+    // Check for mismatched version (non-blocking)
     const currentVersion = await getOwnVersion();
     await checkForUpdates(currentVersion);
     // Check authentication
@@ -78,7 +82,7 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
         p.log.warn(pc.yellow('Skipping authentication (--skip-auth mode)'));
     } else {
         // Check for valid cached tokens first (no API call needed)
-        if (!tokenStore.hasValidTokens()) {
+        if (!tokenStore.hasValidOauthToken()) {
             // Need to refresh or authenticate - show spinner for API call
             s.start('Checking authentication...');
             const credential = await tryGetCredential(tokenStore);

package/dist/commands/list-tokens.js

@@ -26,13 +26,13 @@ const ALL_ENVIRONMENTS = [
 }
 function showTokenDetails(env) {
     const tokenStore = getTokenStore(env);
-    const tokens = tokenStore.getTokens();
+    const tokens = tokenStore.getOauthInfo();
     if (!tokens) {
         p.log.warn(pc.yellow(`No tokens found${formatEnvSuffix(env, ' for ')}. Not authenticated.`));
         p.note(`Run ${pc.cyan('@payloadcms/figma login')} to authenticate`, 'Tip');
         return;
     }
-    const isValid = tokenStore.hasValidTokens();
+    const isValid = tokenStore.hasValidOauthToken();
     const status = isValid ? pc.green('✓ Valid') : pc.red('✗ Expired');
     p.log.step(pc.bold(`Token Status${formatEnvSuffix(env, ' (', ')')}`));
     // Build OAuth token info display

package/dist/commands/login.js

@@ -22,7 +22,7 @@ import * as log from '../utils/log.js';
     try {
         const existingCredential = await getValidCredential(tokenStore);
         if (existingCredential) {
-            const tokens = tokenStore.getTokens();
+            const tokens = tokenStore.getOauthInfo();
             p.log.warn(pc.yellow(`Already logged in${formatEnvSuffix(env)}`));
             if (tokens?.userId) {
                 log.info(`User ID: ${tokens.userId}`);

package/dist/commands/logout.js

@@ -2,6 +2,7 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { getTokenStore } from '../auth/token-store.js';
 import { getInfraEnvironment } from '../constants.js';
+import { getEnvVarSync } from '../utils/env-management.js';
 import { formatEnvSuffix } from '../utils/format-env-suffix.js';
 import * as log from '../utils/log.js';
 const ALL_ENVIRONMENTS = [
@@ -23,7 +24,7 @@ const ALL_ENVIRONMENTS = [
 }
 async function logoutSingleEnvironment(env) {
     const tokenStore = getTokenStore(env);
-    const hasTokens = tokenStore.getTokens() !== null;
+    const hasTokens = tokenStore.getOauthInfo() !== null;
     if (!hasTokens) {
         p.log.warn(pc.yellow(`No tokens found${formatEnvSuffix(env, ' for ')}. Already logged out.`));
         return;
@@ -40,7 +41,7 @@ async function logoutSingleEnvironment(env) {
     s.start('Clearing tokens...');
     try {
         tokenStore.clearTokens();
-        tokenStore.clearAllProjectTokens();
+        clearCurrentProjectToken(tokenStore, env);
         s.stop(pc.green(`✓ Logged out${formatEnvSuffix(env, ' from ')}`));
     } catch (error) {
         s.stop(pc.red('✗ Failed to clear tokens'));
@@ -52,7 +53,7 @@ async function logoutAllEnvironments() {
     // Check which environments have tokens
     const envsWithTokens = ALL_ENVIRONMENTS.filter((env)=>{
         const store = getTokenStore(env);
-        return store.getTokens() !== null;
+        return store.getOauthInfo() !== null;
     });
     if (envsWithTokens.length === 0) {
         p.log.warn(pc.yellow('No tokens found in any environment. Already logged out.'));
@@ -73,7 +74,7 @@ async function logoutAllEnvironments() {
         for (const env of envsWithTokens){
             const store = getTokenStore(env);
             store.clearTokens();
-            store.clearAllProjectTokens();
+            clearCurrentProjectToken(store, env);
         }
         s.stop(pc.green('✓ Logged out from all environments'));
     } catch (error) {
@@ -82,5 +83,23 @@ async function logoutAllEnvironments() {
         process.exit(1);
     }
 }
+function clearCurrentProjectToken(store, env) {
+    const projectId = getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID');
+    if (!projectId) {
+        return;
+    }
+    const bootstrapData = store.getBootstrapData(projectId, env);
+    if (!bootstrapData?.contentSystemId) {
+        return;
+    }
+    const projectInfo = {
+        environmentName: env,
+        projectId
+    };
+    // Clear scoped token for this tenant.
+    store.clearProjectToken({
+        projectInfo
+    });
+}
 
 //# sourceMappingURL=logout.js.map

package/dist/config/oauth.d.ts

@@ -1,8 +1,16 @@
 import type { OAuthConfig } from '../auth/types.js';
 export declare const DEFAULT_CALLBACK_PORT = 34462;
 /**
- * Get OAuth configuration for current environment
- * Uses getEnvConfig() to determine staging vs production
+ * Get OAuth configuration for current environment.
+ *
+ * Honors env overrides:
+ *   FIGMA_API_BASE_URL → tokenUrl, refreshUrl
+ *   FIGMA_WEB_BASE_URL → authorizationUrl (appends /oauth)
+ *   FIGMA_CLIENT_ID    → clientId
+ *   FIGMA_REDIRECT_URI → redirectUri
+ *
+ * When FIGMA_INFRA_ENV=devbox, FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL are
+ * required (ENV_CONFIG.devbox has empty URL defaults to fail-closed).
  */
 export declare function getOAuthConfig(): OAuthConfig;
 export declare const TOKEN_EXPIRY_BUFFER_SECONDS = 300;

package/dist/config/oauth.js

@@ -1,10 +1,24 @@
-import { getEnvConfig } from '../constants.js';
+import { getEnvConfig, getInfraEnvironment } from '../constants.js';
 export const DEFAULT_CALLBACK_PORT = 34462;
 /**
- * Get OAuth configuration for current environment
- * Uses getEnvConfig() to determine staging vs production
+ * Get OAuth configuration for current environment.
+ *
+ * Honors env overrides:
+ *   FIGMA_API_BASE_URL → tokenUrl, refreshUrl
+ *   FIGMA_WEB_BASE_URL → authorizationUrl (appends /oauth)
+ *   FIGMA_CLIENT_ID    → clientId
+ *   FIGMA_REDIRECT_URI → redirectUri
+ *
+ * When FIGMA_INFRA_ENV=devbox, FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL are
+ * required (ENV_CONFIG.devbox has empty URL defaults to fail-closed).
  */ export function getOAuthConfig() {
-    const { apiBaseUrl, authorizationUrl, clientId } = getEnvConfig();
+    const { apiBaseUrl: defaultApi, authorizationUrl: defaultAuth, clientId } = getEnvConfig();
+    const apiBaseUrl = process.env.FIGMA_API_BASE_URL || defaultApi;
+    const webBase = process.env.FIGMA_WEB_BASE_URL;
+    const authorizationUrl = webBase ? `${webBase}/oauth` : defaultAuth;
+    if (getInfraEnvironment() === 'devbox' && (!apiBaseUrl || !authorizationUrl)) {
+        throw new Error('FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL must be set when FIGMA_INFRA_ENV=devbox');
+    }
     return {
         authorizationUrl,
         clientId: process.env.FIGMA_CLIENT_ID || clientId,

package/dist/constants.d.ts

@@ -1,7 +1,9 @@
 /**
- * Figma infrastructure environment (production or staging)
+ * Figma infrastructure environment (production, staging, or devbox).
+ * devbox is a local-dev mode that requires FIGMA_API_BASE_URL and
+ * FIGMA_WEB_BASE_URL env overrides to point at a Coder devbox.
  */
-export type Environment = 'production' | 'staging';
+export type Environment = 'devbox' | 'production' | 'staging';
 type EnvironmentConfig = {
     /** Figma API base URL. Override: FIGMA_API_BASE_URL */
     apiBaseUrl: string;

package/dist/constants.js

@@ -18,6 +18,17 @@ import { getEnvVarSync } from './utils/env-management.js';
         contentApiUrl: 'https://us-east-1.cms-tenants-001-staging.figmacontentstaging.com',
         identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',
         jwksUri: 'https://static.figmacontentstaging.com/.well_known/jwks.json'
+    },
+    // Empty URLs are intentional: devbox mode requires FIGMA_API_BASE_URL and
+    // FIGMA_WEB_BASE_URL to be set, validated at getOAuthConfig() time.
+    // clientId defaults to the dev seed value in sinatra/db/seeds.rb.
+    devbox: {
+        apiBaseUrl: '',
+        authorizationUrl: '',
+        clientId: 'rNZBcf3xBDmI76mQ9603su',
+        contentApiUrl: '',
+        identityMetadata: '',
+        jwksUri: ''
     }
 };
 /**
@@ -58,9 +69,13 @@ export function getInfraEnvironment() {
         return envOverride;
     }
     // Check process.env first (case-insensitive)
-    if (process.env.FIGMA_INFRA_ENV?.toLowerCase() === 'staging') {
+    const processEnv = process.env.FIGMA_INFRA_ENV?.toLowerCase();
+    if (processEnv === 'staging') {
         return 'staging';
     }
+    if (processEnv === 'devbox') {
+        return 'devbox';
+    }
     // Fall back to .env file in cwd (check both new and old env var names)
     const envFileValue = getEnvVarSync(process.cwd(), 'FIGMA_INFRA_ENV') ?? getEnvVarSync(process.cwd(), 'FIGMA_ENV');
     if (envFileValue) {
@@ -68,6 +83,9 @@ export function getInfraEnvironment() {
         if (env === 'staging') {
             return 'staging';
         }
+        if (env === 'devbox') {
+            return 'devbox';
+        }
         if (env !== 'production') {
             // eslint-disable-next-line no-console
             console.warn(`Warning: Invalid FIGMA_INFRA_ENV value "${envFileValue}" in .env file. Using production.`);

package/dist/db-content-api/index.js

@@ -8,6 +8,7 @@ import { addFallbackSort } from './temp-utilities/sorting.js';
 import { unwrapDocument, unwrapFindResponse } from './temp-utilities/unwrapDocument.js';
 import { createAuthMiddleware, createErrorMiddleware } from './utilities/auth.js';
 import { dataToContentAPI, resolveVersionContent } from './utilities/data/index.js';
+import { validateRelationshipIds } from './utilities/data/validateRelationships.js';
 import { convertPayloadJoinsToContentAPI } from './utilities/joins.js';
 import { addFallbackLocale } from './utilities/locale/index.js';
 import { buildMeta } from './utilities/meta/buildMeta.js';
@@ -353,6 +354,11 @@ async function findDistinct(args) {
 }
 async function updateMany(args) {
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,
@@ -394,6 +400,11 @@ async function updateOne(args) {
             equals: args.id
         }
     };
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,
@@ -498,6 +509,11 @@ async function create(args) {
         id = uuid();
     }
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:create', {
         body: {
             collection: args.collection,
@@ -611,6 +627,11 @@ async function upsert(args) {
         documentId = uuid();
     }
     const locale = addFallbackLocale(args.locale, this.payload);
+    validateRelationshipIds({
+        collectionSlug: args.collection,
+        data: args.data,
+        payload: this.payload
+    });
     const { data: response, error } = await this.client.POST('/api/v0/documents:update', {
         body: {
             collection: args.collection,

package/dist/db-content-api/utilities/auth.js

@@ -25,7 +25,10 @@ export function createAuthMiddleware(opts) {
             if (opts.auth.mode === 'apiKey') {
                 request.headers.set('X-Api-Key', opts.auth.apiKey);
             } else if (opts.auth.mode === 'tokenStore') {
-                const token = await getValidProjectToken(opts.auth.tokenStore, opts.contentSystemId);
+                const token = await getValidProjectToken({
+                    tenantId: opts.contentSystemId,
+                    tokenStore: opts.auth.tokenStore
+                });
                 if (!token) {
                     throw new Error('Authentication required. Run `npx @payloadcms/figma login` to authenticate.');
                 }

package/dist/db-content-api/utilities/data/validateRelationships.d.ts

@@ -0,0 +1,7 @@
+import type { Payload } from 'payload';
+export declare function validateRelationshipIds({ collectionSlug, data, payload, }: {
+    collectionSlug: string;
+    data: Record<string, unknown>;
+    payload: Payload;
+}): void;
+//# sourceMappingURL=validateRelationships.d.ts.map

package/dist/db-content-api/utilities/data/validateRelationships.js

@@ -0,0 +1,102 @@
+import { traverseFields } from 'payload';
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function collectRelationshipValues({ data, fields }) {
+    const relationships = [];
+    const callback = ({ field, ref })=>{
+        if (!('name' in field) || !field.name) {
+            return;
+        }
+        if (field.type !== 'relationship' && field.type !== 'upload') {
+            return;
+        }
+        if (!ref || typeof ref !== 'object') {
+            return;
+        }
+        const rawValue = ref[field.name];
+        if (rawValue == null || rawValue === '') {
+            return;
+        }
+        // For localized fields, the value is a locale map (e.g. { en: "uuid", fr: "uuid" }).
+        // Iterate locale values instead of treating the map as an ID.
+        if ('localized' in field && field.localized) {
+            if (typeof rawValue === 'object' && !Array.isArray(rawValue)) {
+                for (const localeValue of Object.values(rawValue)){
+                    if (localeValue != null && localeValue !== '') {
+                        parseRelationshipValues(localeValue, field.relationTo, relationships);
+                    }
+                }
+            }
+            return;
+        }
+        parseRelationshipValues(rawValue, field.relationTo, relationships);
+    };
+    traverseFields({
+        callback,
+        fields,
+        fillEmpty: false,
+        ref: data
+    });
+    return relationships;
+}
+function parseRelationshipValues(value, relationTo, relationships) {
+    if (Array.isArray(relationTo)) {
+        // Polymorphic (single or hasMany): value is { relationTo, value } or array of them
+        const values = Array.isArray(value) ? value : [
+            value
+        ];
+        for (const v of values){
+            if (v && typeof v === 'object' && 'relationTo' in v && 'value' in v) {
+                const obj = v;
+                if (obj.value != null && obj.value !== '') {
+                    relationships.push({
+                        collection: obj.relationTo,
+                        value: obj.value
+                    });
+                }
+            }
+        }
+    } else {
+        // Non-polymorphic (single or hasMany): value is a bare ID or array of IDs
+        const values = Array.isArray(value) ? value : [
+            value
+        ];
+        for (const v of values){
+            if (v != null && v !== '') {
+                relationships.push({
+                    collection: relationTo,
+                    value: v
+                });
+            }
+        }
+    }
+}
+function isValidId(value, customIDType) {
+    if (customIDType === 'number') {
+        const num = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+        return Number.isFinite(num);
+    }
+    if (customIDType === 'text') {
+        return typeof value === 'string' && value.length > 0;
+    }
+    return typeof value === 'string' && UUID_REGEX.test(value);
+}
+export function validateRelationshipIds({ collectionSlug, data, payload }) {
+    const isGlobal = collectionSlug.startsWith('_global-');
+    const actualSlug = isGlobal ? collectionSlug.substring(8) : collectionSlug;
+    const config = isGlobal ? payload.config.globals?.find((g)=>g.slug === actualSlug) : payload.config.collections.find((c)=>c.slug === actualSlug);
+    if (!config?.fields) {
+        return;
+    }
+    const relationships = collectRelationshipValues({
+        data,
+        fields: config.fields
+    });
+    for (const { collection, value } of relationships){
+        const customIDType = payload.collections?.[collection]?.customIDType;
+        if (!isValidId(value, customIDType)) {
+            throw new Error(`Invalid relationship ID "${String(value)}" for collection "${collection}". Expected ${customIDType === 'number' ? 'a number' : customIDType === 'text' ? 'a non-empty string' : 'a valid UUID'}.`);
+        }
+    }
+}
+
+//# sourceMappingURL=validateRelationships.js.map

package/dist/oauth/defaults.d.ts

@@ -1,10 +1,12 @@
 import type { CollectionConfig, EmailField, TextField } from 'payload';
 import type { VerifyFunction } from './types.js';
+export declare const DEFAULT_USER_INFO_COOKIE_NAME = "figma-user-info";
 export declare const defaultScope: string[];
 export declare const defaultUsernameField: TextField;
-export declare const defaultVerify: ({ collection, strategyName, usernameField, }: {
+export declare const defaultVerify: ({ collection, strategyName, userInfoCookieName, usernameField, }: {
     collection: CollectionConfig;
     strategyName: string;
+    userInfoCookieName?: string;
     usernameField: EmailField | TextField;
 }) => VerifyFunction;
 //# sourceMappingURL=defaults.d.ts.map