@payloadcms/figma 0.0.1-alpha.7 → 0.0.1-alpha.71

package/dist/oauth/utilities/establishSession.js

@@ -0,0 +1,82 @@
+import { APIError, generateCookie } from 'payload';
+import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
+import { createCookieOptions } from './createCookieOptions.js';
+import { getCookieExpiration } from './getCookieExpiration.js';
+/**
+ * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
+ * project token, and write the main + refresh + user-info cookies to
+ * `req.responseHeaders`. Throws `APIError` if the project token mint fails.
+ */ export const establishSession = async ({ accessToken, collection, collectionOptions, contentSystemId, debugLogger, pluginOptions, refreshTokenExpiresIn, req, strategy })=>{
+    const oauthCredential = {
+        type: 'oauth',
+        token: accessToken
+    };
+    // Non-fatal: user just won't have handle/image on first request.
+    let figmaUserInfo = null;
+    try {
+        figmaUserInfo = await getUserInfo(oauthCredential);
+        debugLogger.info({
+            figmaUserInfo,
+            msg: 'Fetched Figma user info'
+        });
+    } catch (err) {
+        debugLogger.error({
+            err,
+            msg: 'Failed to fetch Figma user info'
+        });
+    }
+    const projectToken = await getProjectToken(oauthCredential, contentSystemId);
+    if (!projectToken.token) {
+        const errMsg = 'No project token returned from Figma API';
+        req.payload.logger.error({
+            msg: errMsg
+        });
+        throw new APIError(errMsg);
+    }
+    const cookieOptions = createCookieOptions({
+        collection,
+        headers: req.headers,
+        pluginOptions
+    });
+    if (!req.responseHeaders) {
+        req.responseHeaders = new Headers();
+    }
+    // The -refresh cookie holds the OAuth access_token so refreshTokens can
+    // re-mint project_tokens from it on JWT expiry.
+    if (!collectionOptions.usePayloadJWT) {
+        const refreshCookie = generateCookie({
+            ...cookieOptions,
+            name: `${strategy.cookieName}-refresh`,
+            expires: getCookieExpiration(cookieOptions?.expires ?? refreshTokenExpiresIn ?? 31_556_952),
+            returnCookieAsObject: false,
+            value: accessToken
+        });
+        req.responseHeaders.append('Set-Cookie', refreshCookie);
+    }
+    const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(projectToken.expiresAt);
+    const tokenCookie = generateCookie({
+        ...cookieOptions,
+        name: strategy.cookieName,
+        expires: tokenExpires,
+        returnCookieAsObject: false,
+        value: projectToken.token
+    });
+    req.responseHeaders.append('Set-Cookie', tokenCookie);
+    // Short-lived handoff cookie consumed by defaultVerify on the next request.
+    if (figmaUserInfo) {
+        const userInfoValue = Buffer.from(JSON.stringify({
+            handle: figmaUserInfo.handle,
+            img_url: figmaUserInfo.img_url
+        })).toString('base64');
+        const userInfoCookie = generateCookie({
+            ...cookieOptions,
+            name: pluginOptions?.userInfoCookieName ?? 'figma-user-info',
+            expires: new Date(Date.now() + 60_000),
+            returnCookieAsObject: false,
+            value: userInfoValue
+        });
+        req.responseHeaders.append('Set-Cookie', userInfoCookie);
+    }
+};
+
+//# sourceMappingURL=establishSession.js.map

package/dist/oauth/utilities/exchangeCodeForAccessToken.d.ts

@@ -0,0 +1,24 @@
+import type { Strategy } from '../strategy/index.js';
+interface Args {
+    /** Authorization code received from the IdP redirect. */
+    code: string;
+    /** PKCE verifier; omit for non-PKCE flows. */
+    codeVerifier?: string;
+    /** Must match the redirect_uri the authorization request used. */
+    redirectUri: string;
+    strategy: Strategy;
+}
+export interface TokenEndpointResponse {
+    access_token?: null | string;
+    error?: string;
+    error_description?: string;
+    expires_in?: number;
+}
+/**
+ * POSTs an authorization code to the IdP's `token_endpoint` and returns the
+ * raw response body. Callers handle error/missing-token logging in their own
+ * style — this helper only owns the request shape.
+ */
+export declare const exchangeCodeForAccessToken: ({ code, codeVerifier, redirectUri, strategy, }: Args) => Promise<TokenEndpointResponse>;
+export {};
+//# sourceMappingURL=exchangeCodeForAccessToken.d.ts.map

package/dist/oauth/utilities/exchangeCodeForAccessToken.js

@@ -0,0 +1,28 @@
+/**
+ * POSTs an authorization code to the IdP's `token_endpoint` and returns the
+ * raw response body. Callers handle error/missing-token logging in their own
+ * style — this helper only owns the request shape.
+ */ export const exchangeCodeForAccessToken = async ({ code, codeVerifier, redirectUri, strategy })=>{
+    const body = {
+        client_id: strategy.clientID,
+        code,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri
+    };
+    if (codeVerifier) {
+        body.code_verifier = codeVerifier;
+    }
+    if (strategy.collectionOptions.clientSecret) {
+        body.client_secret = strategy.collectionOptions.clientSecret;
+    }
+    const res = await fetch(strategy.meta.token_endpoint, {
+        body: new URLSearchParams(body),
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        method: 'POST'
+    });
+    return await res.json();
+};
+
+//# sourceMappingURL=exchangeCodeForAccessToken.js.map

package/dist/oauth/utilities/figmaHostnames.d.ts

@@ -0,0 +1,3 @@
+export declare const FIGMA_HOSTNAMES: Set<string>;
+export declare const isFigmaOrigin: (origin: string) => boolean;
+//# sourceMappingURL=figmaHostnames.d.ts.map

package/dist/oauth/utilities/figmaHostnames.js

@@ -0,0 +1,26 @@
+// Copied from share/figma-url/src/hostnames.ts.
+// This package is published to npm (@payloadcms/figma) and cannot import from
+// the monorepo's internal share/ tree, so the list is duplicated here.
+export const FIGMA_HOSTNAMES = new Set([
+    'embed.figma.com',
+    'embed.figma-gov.com',
+    'embed.local.figma.engineering',
+    'embed.staging.figma.com',
+    'figma.com',
+    'figma-gov.com',
+    'local.figma.engineering',
+    'localhost',
+    'staging.figma.com',
+    'www.figma.com',
+    'www.figma-gov.com'
+]);
+export const isFigmaOrigin = (origin)=>{
+    try {
+        const { hostname } = new URL(origin);
+        return FIGMA_HOSTNAMES.has(hostname) || hostname.endsWith('.figdev.systems');
+    } catch  {
+        return false;
+    }
+};
+
+//# sourceMappingURL=figmaHostnames.js.map

package/dist/oauth/utilities/getAuthorizeURL.d.ts

@@ -5,6 +5,16 @@ interface Args {
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     endpointSlug: string;
+    /**
+     * If the request already has an `__Host-payload-oauth-state_csrf` cookie,
+     * pass its value here — `getAuthorizeURL` will reuse it as `state.csrf`
+     * instead of minting a fresh nonce. This is what makes `/meta`
+     * idempotent across multiple calls in a single browser session (React
+     * Strict Mode re-mounts, retry-after-failure, multiple tabs) and
+     * prevents the cookie/state mismatch race where one call overwrites
+     * another call's cookie.
+     */
+    existingCsrfNonce?: null | string;
     failedRedirect?: unknown;
     payload: Payload;
     pluginOptions: PluginOptions;
@@ -12,6 +22,60 @@ interface Args {
     serverURLOverride?: unknown;
     strategy: Strategy;
 }
-export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<string>;
+export interface AuthorizeURLParams {
+    [key: string]: string;
+    client_id: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    nonce: string;
+    redirect_uri: string;
+    response_mode: string;
+    response_type: string;
+    scope: string;
+    state: string;
+}
+export interface AuthorizeURLResult {
+    authorizeURL: string;
+    /**
+     * The plaintext CSRF nonce that the caller MUST set as an HttpOnly
+     * cookie on the response (see `OAUTH_STATE_CSRF_COOKIE_NAME`). `/sso/login`
+     * compares this value to the cookie on callback — this is the
+     * browser-binding required by RFC 6749 §10.12.
+     */
+    csrfNonce: string;
+    params: AuthorizeURLParams;
+}
+export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<AuthorizeURLResult>;
+/**
+ * Name of the HttpOnly cookie that carries the browser-bound CSRF nonce
+ * for the OAuth flow. The `__Host-` prefix instructs browsers to enforce:
+ * Secure, no Domain attribute (host-only), and Path=/ — which together
+ * prevent sibling subdomains from setting or overwriting it.
+ */
+export declare const OAUTH_STATE_CSRF_COOKIE_NAME = "__Host-payload-oauth-state_csrf";
+/**
+ * Build the `Set-Cookie` header value for the CSRF cookie. SameSite=None
+ * + Secure so the cookie survives the IdP cross-site redirect back into
+ * /sso/login, AND so the iframe auto-login path works (the iframe is a
+ * third-party context from the top-level Figma page). Path=/ is required
+ * by the `__Host-` prefix.
+ *
+ * `Partitioned` (CHIPS) is required because the Make preview embeds the
+ * admin panel in a cross-site iframe. Under Chrome's third-party-cookie
+ * restrictions a `SameSite=None` cookie set in a third-party context is
+ * NOT sent back unless it is partitioned by the top-level site. Without it
+ * the `__Host-payload-oauth-state_csrf` cookie is dropped on the way back
+ * to /sso/login, the cookie↔state.csrf binding check fails, and login dies
+ * with "CSRF cookie mismatch" (intermittent sign-in loop). `__Host-` and
+ * `Partitioned` are mutually compatible.
+ */
+export declare const buildCsrfCookieHeader: (nonce: string) => string;
+/**
+ * `Set-Cookie` header to clear the CSRF cookie after a successful (or
+ * failed) callback. Same attributes as the set version, plus Max-Age=0.
+ * Must include `Partitioned` so the clear targets the same partitioned
+ * cookie jar the set wrote to (an unpartitioned clear would not match).
+ */
+export declare const buildCsrfCookieClearHeader: () => string;
 export {};
 //# sourceMappingURL=getAuthorizeURL.d.ts.map

package/dist/oauth/utilities/getAuthorizeURL.js

@@ -2,14 +2,21 @@ import crypto from 'crypto';
 import * as QueryString from 'qs-esm';
 import { v4 as uuid } from 'uuid';
 import { defaultScope } from '../defaults.js';
-export const getAuthorizeURL = async ({ collection, collectionOptions, endpointSlug, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy })=>{
+export const getAuthorizeURL = async ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy })=>{
     const { redirectServerURL } = pluginOptions;
     await strategy.ensureMeta();
     // Generate a random code verifier
     const codeVerifier = crypto.randomBytes(32).toString('base64url');
     // Create a code challenge by hashing the code verifier
     const code_challenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+    // Nonce that goes in both `state.csrf` and the `__Host-payload-oauth-state_csrf`
+    // HttpOnly cookie. /sso/login compares the two on callback to defeat
+    // login-CSRF (RFC 6749 §10.12). Reused from the request's existing cookie
+    // when present so `/meta` is idempotent across multiple calls; otherwise
+    // freshly minted.
+    const csrfNonce = existingCsrfNonce || crypto.randomBytes(32).toString('base64url');
     const state = {
+        csrf: csrfNonce,
         sig: payload.encrypt(strategy.name),
         verifier: payload.encrypt(codeVerifier)
     };
@@ -39,7 +46,55 @@ export const getAuthorizeURL = async ({ collection, collectionOptions, endpointS
     const authorizeURL = `${strategy.meta?.authorization_endpoint}?${QueryString.stringify(params, {
         encode: false
     })}`;
-    return authorizeURL;
+    return {
+        authorizeURL,
+        csrfNonce,
+        params
+    };
 };
+/**
+ * Name of the HttpOnly cookie that carries the browser-bound CSRF nonce
+ * for the OAuth flow. The `__Host-` prefix instructs browsers to enforce:
+ * Secure, no Domain attribute (host-only), and Path=/ — which together
+ * prevent sibling subdomains from setting or overwriting it.
+ */ export const OAUTH_STATE_CSRF_COOKIE_NAME = '__Host-payload-oauth-state_csrf';
+/**
+ * Build the `Set-Cookie` header value for the CSRF cookie. SameSite=None
+ * + Secure so the cookie survives the IdP cross-site redirect back into
+ * /sso/login, AND so the iframe auto-login path works (the iframe is a
+ * third-party context from the top-level Figma page). Path=/ is required
+ * by the `__Host-` prefix.
+ *
+ * `Partitioned` (CHIPS) is required because the Make preview embeds the
+ * admin panel in a cross-site iframe. Under Chrome's third-party-cookie
+ * restrictions a `SameSite=None` cookie set in a third-party context is
+ * NOT sent back unless it is partitioned by the top-level site. Without it
+ * the `__Host-payload-oauth-state_csrf` cookie is dropped on the way back
+ * to /sso/login, the cookie↔state.csrf binding check fails, and login dies
+ * with "CSRF cookie mismatch" (intermittent sign-in loop). `__Host-` and
+ * `Partitioned` are mutually compatible.
+ */ export const buildCsrfCookieHeader = (nonce)=>[
+        `${OAUTH_STATE_CSRF_COOKIE_NAME}=${nonce}`,
+        'HttpOnly',
+        'Secure',
+        'SameSite=None',
+        'Partitioned',
+        'Path=/',
+        'Max-Age=600'
+    ].join('; ');
+/**
+ * `Set-Cookie` header to clear the CSRF cookie after a successful (or
+ * failed) callback. Same attributes as the set version, plus Max-Age=0.
+ * Must include `Partitioned` so the clear targets the same partitioned
+ * cookie jar the set wrote to (an unpartitioned clear would not match).
+ */ export const buildCsrfCookieClearHeader = ()=>[
+        `${OAUTH_STATE_CSRF_COOKIE_NAME}=`,
+        'HttpOnly',
+        'Secure',
+        'SameSite=None',
+        'Partitioned',
+        'Path=/',
+        'Max-Age=0'
+    ].join('; ');
 
 //# sourceMappingURL=getAuthorizeURL.js.map

package/dist/oauth/utilities/isAbsoluteURL.d.ts

@@ -0,0 +1,2 @@
+export declare const isAbsoluteURL: (url: string) => boolean;
+//# sourceMappingURL=isAbsoluteURL.d.ts.map

package/dist/oauth/utilities/isAbsoluteURL.js

@@ -0,0 +1,3 @@
+export const isAbsoluteURL = (url)=>/^[a-z][a-z\d+.-]*:/.test(url);
+
+//# sourceMappingURL=isAbsoluteURL.js.map

package/dist/oauth/utilities/isDuplicateKeyError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */
+export declare function isDuplicateKeyError(error: unknown): boolean;
+//# sourceMappingURL=isDuplicateKeyError.d.ts.map

package/dist/oauth/utilities/isDuplicateKeyError.js

@@ -0,0 +1,14 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */ export function isDuplicateKeyError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const err = error;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return message.includes('409') || message.toLowerCase().includes('conflict') || message.toLowerCase().includes('already exists');
+}
+
+//# sourceMappingURL=isDuplicateKeyError.js.map

package/dist/oauth/utilities/refreshTokens.js

@@ -1,7 +1,7 @@
 import { generateCookie } from 'payload';
 import { getProjectToken } from '../../api/figma-api.js';
 import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { createDebugLogger } from './createDebugLogger.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
@@ -16,7 +16,10 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // so we will refresh both tokens
     try {
         // Get another project token
-        const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject');
+        const { expiresAt, token } = await getProjectToken({
+            type: 'oauth',
+            token: refreshToken
+        }, payload.config.custom.figma.contentSystemId);
         debugLogger.info({
             expiresAt,
             msg: 'Received new tokens from Figma API',
@@ -48,7 +51,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
                 value: token
             });
             headers.append('Set-Cookie', tokenCookie);
-            const decodedOauthToken = await validateProjectToken(token, getEnvironment());
+            const decodedOauthToken = await validateProjectToken(token, getInfraEnvironment());
             return {
                 decodedOauthToken,
                 headers,

package/dist/plugin/auth-preflight.d.ts

@@ -0,0 +1,8 @@
+import type { TokenStore } from '../auth/token-store.js';
+/**
+ * Print a one-shot banner when the plugin is about to use `tokenStore`
+ * auth but no valid OAuth credential is present. Keeps the dev loop
+ * actionable instead of relying on per-request middleware errors.
+ */
+export declare function logMissingCliAuth(tokenStore: TokenStore): void;
+//# sourceMappingURL=auth-preflight.d.ts.map

package/dist/plugin/auth-preflight.js

@@ -0,0 +1,20 @@
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+/**
+ * Print a one-shot banner when the plugin is about to use `tokenStore`
+ * auth but no valid OAuth credential is present. Keeps the dev loop
+ * actionable instead of relying on per-request middleware errors.
+ */ export function logMissingCliAuth(tokenStore) {
+    if (tokenStore.hasValidOauthToken()) {
+        return;
+    }
+    const lines = [
+        'Not logged in to the Figma CLI.',
+        'Content API requests will fail until you authenticate.',
+        '',
+        `Run ${pc.cyan('npx @payloadcms/figma login')} to log in, then restart the dev server.`
+    ];
+    p.note(lines.join('\n'), pc.yellow('Figma authentication required'));
+}
+
+//# sourceMappingURL=auth-preflight.js.map

package/dist/plugin/bootstrap-preflight.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Reason the Content System ID could not be resolved. Drives the
+ * banner's copy so the dev sees the specific remediation step.
+ */
+export type MissingContentSystemIdReason = {
+    environmentName: string;
+    kind: 'environment-not-found';
+    projectId: string;
+} | {
+    kind: 'network';
+    message: string;
+} | {
+    kind: 'no-config';
+} | {
+    kind: 'unauthenticated';
+};
+/**
+ * Print a banner explaining why Content System ID resolution failed and
+ * what to run next. Called just before `buildFigmaConfig` throws, so the
+ * actionable step is visible above the stack trace.
+ */
+export declare function logMissingContentSystemId(reason: MissingContentSystemIdReason): void;
+//# sourceMappingURL=bootstrap-preflight.d.ts.map

package/dist/plugin/bootstrap-preflight.js

@@ -0,0 +1,45 @@
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+/**
+ * Print a banner explaining why Content System ID resolution failed and
+ * what to run next. Called just before `buildFigmaConfig` throws, so the
+ * actionable step is visible above the stack trace.
+ */ export function logMissingContentSystemId(reason) {
+    const lines = buildBody(reason);
+    p.note(lines.join('\n'), pc.yellow('Figma project not configured'));
+}
+function buildBody(reason) {
+    const loginCmd = pc.cyan('npx @payloadcms/figma login');
+    const initCmd = pc.cyan('npx @payloadcms/figma init');
+    const initForceCmd = pc.cyan('npx @payloadcms/figma init --force');
+    if (reason.kind === 'no-config') {
+        return [
+            'No Figma project configuration found.',
+            '',
+            `Run ${initCmd} to set up this project.`
+        ];
+    }
+    if (reason.kind === 'unauthenticated') {
+        return [
+            'Project config found, but you are not logged in.',
+            'Cannot fetch bootstrap data without a valid session.',
+            '',
+            `Run ${loginCmd}, then restart the dev server.`
+        ];
+    }
+    if (reason.kind === 'network') {
+        return [
+            'Could not reach the Figma API to fetch bootstrap data.',
+            `Error: ${reason.message}`,
+            '',
+            'Check your network, then restart the dev server.'
+        ];
+    }
+    return [
+        `Environment ${pc.bold(reason.environmentName)} not found for project ${pc.bold(reason.projectId)}.`,
+        '',
+        `Run ${initForceCmd} to reconfigure, or set FIGMA_ENVIRONMENT_NAME to a valid environment.`
+    ];
+}
+
+//# sourceMappingURL=bootstrap-preflight.js.map

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,13 @@
 import type { Config, SanitizedConfig } from 'payload';
+/**
+ * Worker-trusted marker injected by Figma's sites-worker after it validates the
+ * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
+ * `jobs.access.run` below honors this marker so Sinatra (async-job-workflow)
+ * can drive job runs without the bypass secret ever reaching tenant code.
+ *
+ * KEEP_IN_SYNC(cloudflare/wrangler/sites-worker/src/auth.ts): FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER
+ */
+export declare const FIGMA_INTERNAL_FORWARDED_HAS_AUTH_BYPASS_HEADER = "figma-internal-forwarded-has-auth-bypass";
 /**
  * Configuration type for Payload projects on the Figma platform.
  *
@@ -6,38 +15,41 @@ import type { Config, SanitizedConfig } from 'payload';
  * - `db`: Omitted (auto-injected by Figma platform)
  * - `secret`: Omitted (auto-injected by Figma platform)
  * - `editor`: Optional (defaults to lexicalEditor() if not provided)
+ * - `contentSystemId`: Optional (resolved automatically from env vars or bootstrap cache)
  *
  * @example
- * // Minimal config
+ * // Minimal config (contentSystemId resolved automatically)
  * const config: FigmaConfig = {
+ *   figma: {},
  *   collections: [...]
  * }
  *
  * @example
  * // With custom editor
  * const config: FigmaConfig = {
+ *   figma: {},
  *   collections: [...],
  *   editor: lexicalEditor({ features: [...] })
  * }
+ *
+ * @example
+ * // Disable Content System (use custom db)
+ * const config: FigmaConfig = {
+ *   figma: {
+ *     useContentSystem: false
+ *   },
+ *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),
+ *   collections: [...]
+ * }
  */
 export type FigmaConfig = {
     editor?: Config['editor'];
 } & {
     figma: {
-        region: string;
-        tenantId: string;
+        contentSystemId?: string;
+        storage?: boolean;
         useContentSystem?: boolean;
     };
-} & Omit<Config, 'editor' | 'secret' | 'db'> & Partial<Pick<Config, 'db'>>;
-/**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
- *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */
-export declare function buildConfig(config: FigmaConfig): Promise<SanitizedConfig>;
+} & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;
+export declare function buildFigmaConfig(config: FigmaConfig): Promise<SanitizedConfig>;
 //# sourceMappingURL=build-config.d.ts.map