@payloadcms/figma 0.0.1-alpha.70 → 0.0.1-alpha.72

package/dist/api/control-plane.js

@@ -5,6 +5,7 @@
  */ import { getAuthHeaders } from '../auth/credentials.js';
 import { getEnvConfig } from '../constants.js';
 import * as log from '../utils/log.js';
+import { parseControlPlaneApiError } from './error-response.js';
 /**
  * Get the Control Plane API base URL based on environment
  */ function getControlPlaneBaseUrl() {
@@ -330,9 +331,15 @@ async function controlPlaneFetch(params) {
                 return response;
             }
             if (response.status < 500) {
-                throw new ControlPlaneError(`Failed to ${context}: ${response.status} ${response.statusText}`, response.status);
+                throw new ControlPlaneError(await parseControlPlaneApiError({
+                    context,
+                    response
+                }), response.status);
             }
-            lastError = new ControlPlaneError(`Failed to ${context}: ${response.status} ${response.statusText}`, response.status);
+            lastError = new ControlPlaneError(await parseControlPlaneApiError({
+                context,
+                response
+            }), response.status);
         } catch (error) {
             if (error instanceof ControlPlaneError) {
                 throw error;

package/dist/api/error-response.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Extract a human-readable error message from a non-ok control-plane API Response.
+ *
+ * Sinatra's error helpers (api_error, api_reject, api_not_found, api_needs_upgrade)
+ * all serialize the user-facing string under a `message` key. Surfacing it lets the
+ * CLI show the real reason (e.g. "Deployment package is too large...") instead of a
+ * bare status code.
+ *
+ * Scoped to JSON `{ message }` bodies. S3 upload errors arrive as XML and need a
+ * separate parser.
+ *
+ * Only called on the error path, immediately before throwing — the body is never read
+ * again, so consuming it here is safe (no clone needed). Never throws: any parse
+ * failure or missing message falls back to the HTTP status line.
+ */
+export declare function parseControlPlaneApiError(params: {
+    context: string;
+    response: Response;
+}): Promise<string>;
+/**
+ * Extract a human-readable error message from a non-ok S3 upload Response.
+ *
+ * S3 reports failures (e.g. SignatureDoesNotMatch, AccessDenied / expired signatures)
+ * as an XML document whose first `<Code>` and `<Message>` carry the reason — not the
+ * JSON shape {@link parseControlPlaneApiError} expects. The document also includes
+ * sibling tags (StringToSign, CanonicalRequest, RequestId), so we extract only those
+ * two so the CLI can show the real reason instead of a bare status code.
+ *
+ * Only called on the error path, immediately before throwing — the body is never read
+ * again, so consuming it here is safe (no clone needed). Never throws: any parse
+ * failure or missing fields falls back to the HTTP status line.
+ */
+export declare function parseS3Error(params: {
+    context: string;
+    response: Response;
+}): Promise<string>;
+//# sourceMappingURL=error-response.d.ts.map

package/dist/api/error-response.js

@@ -0,0 +1,68 @@
+/**
+ * Extract a human-readable error message from a non-ok control-plane API Response.
+ *
+ * Sinatra's error helpers (api_error, api_reject, api_not_found, api_needs_upgrade)
+ * all serialize the user-facing string under a `message` key. Surfacing it lets the
+ * CLI show the real reason (e.g. "Deployment package is too large...") instead of a
+ * bare status code.
+ *
+ * Scoped to JSON `{ message }` bodies. S3 upload errors arrive as XML and need a
+ * separate parser.
+ *
+ * Only called on the error path, immediately before throwing — the body is never read
+ * again, so consuming it here is safe (no clone needed). Never throws: any parse
+ * failure or missing message falls back to the HTTP status line.
+ */ export async function parseControlPlaneApiError(params) {
+    const { context, response } = params;
+    const fallback = `Failed to ${context}: ${response.status} ${response.statusText}`;
+    try {
+        const body = await response.json();
+        if (typeof body.message === 'string' && body.message.trim().length > 0) {
+            return `Failed to ${context}: ${response.status} ${body.message.trim()}`;
+        }
+    } catch  {
+    // Non-JSON body, empty body, or no .json() — fall back to the status line.
+    }
+    return fallback;
+}
+/**
+ * Extract a human-readable error message from a non-ok S3 upload Response.
+ *
+ * S3 reports failures (e.g. SignatureDoesNotMatch, AccessDenied / expired signatures)
+ * as an XML document whose first `<Code>` and `<Message>` carry the reason — not the
+ * JSON shape {@link parseControlPlaneApiError} expects. The document also includes
+ * sibling tags (StringToSign, CanonicalRequest, RequestId), so we extract only those
+ * two so the CLI can show the real reason instead of a bare status code.
+ *
+ * Only called on the error path, immediately before throwing — the body is never read
+ * again, so consuming it here is safe (no clone needed). Never throws: any parse
+ * failure or missing fields falls back to the HTTP status line.
+ */ export async function parseS3Error(params) {
+    const { context, response } = params;
+    const fallback = `Failed to ${context}: ${response.status} ${response.statusText}`;
+    try {
+        const body = await response.text();
+        const code = extractXmlTag(body, 'Code');
+        const message = extractXmlTag(body, 'Message');
+        if (message) {
+            return `Failed to ${context}: ${response.status} ${code ? `${code}: ` : ''}${message}`;
+        }
+        if (code) {
+            return `Failed to ${context}: ${response.status} ${code}`;
+        }
+    } catch  {
+    // Non-XML body, empty body, or no .text() — fall back to the status line.
+    }
+    return fallback;
+}
+/**
+ * Pull the trimmed text content of a single non-nested XML tag (e.g. `<Code>`).
+ * Returns undefined when the tag is absent or empty. S3 error documents are flat,
+ * so a narrow regex is sufficient — no general XML parsing needed.
+ */ function extractXmlTag(xml, tag) {
+    const match = new RegExp(`<${tag}>([^<]*)</${tag}>`).exec(xml);
+    const value = match?.[1]?.trim();
+    return value && value.length > 0 ? value : undefined;
+}
+
+//# sourceMappingURL=error-response.js.map

package/dist/api/figma-api.js

@@ -6,6 +6,7 @@
  */ import { getAuthHeaders } from '../auth/credentials.js';
 import { getEnvConfig } from '../constants.js';
 import * as log from '../utils/log.js';
+import { parseControlPlaneApiError } from './error-response.js';
 /**
  * Error thrown when Figma API calls fail
  */ export class FigmaApiError extends Error {
@@ -92,20 +93,11 @@ import * as log from '../utils/log.js';
             method: 'POST'
         });
         if (!response.ok) {
-            // Handle error responses
-            let errorMessage = `Failed to get project token: ${response.status} ${response.statusText}`;
-            try {
-                const errorBody = await response.json();
-                // Only use string error messages (API may return { error: true })
-                if (typeof errorBody.message === 'string') {
-                    errorMessage = errorBody.message;
-                } else if (typeof errorBody.error === 'string') {
-                    errorMessage = errorBody.error;
-                }
-            } catch  {
-            // Ignore JSON parse errors for error body
-            }
-            // Provide actionable error for common cases
+            let errorMessage = await parseControlPlaneApiError({
+                context: 'get project token',
+                response
+            });
+            // Provide an actionable error for the common misconfiguration case.
             if (response.status === 404) {
                 errorMessage = `Content System ID "${tenantId}" not found. Ensure FIGMA_CONTENT_API_CONTENT_SYSTEM_ID is set to a valid content system ID in your .env file.`;
             }
@@ -204,7 +196,10 @@ import * as log from '../utils/log.js';
             headers: getAuthHeaders(credential)
         });
         if (!response.ok) {
-            throw new FigmaApiError(`Failed to get user info: ${response.status} ${response.statusText}`, response.status);
+            throw new FigmaApiError(await parseControlPlaneApiError({
+                context: 'get user info',
+                response
+            }), response.status);
         }
         const data = await response.json();
         if (!data.id || !data.email || typeof data.handle !== 'string') {

package/dist/auth/oauth-flow.js

@@ -3,7 +3,8 @@ import crypto from 'crypto';
 import { getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 import { buildAuthorizationUrl, openBrowser } from './browser.js';
-import { CallbackServer } from './callback-server.js';
+import { CallbackError, CallbackServer } from './callback-server.js';
+import { parsePastedCode, validatePastedCode } from './paste-code.js';
 import { generatePKCEPair } from './pkce.js';
 import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js';
 /**
@@ -87,28 +88,36 @@ import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './
         // Prompt user to open browser
         const shouldOpenBrowser = await p.confirm({
             initialValue: true,
-            message: 'Authenticate with Figma in your browser?'
+            message: 'Open browser to authenticate with Figma?'
         });
         if (p.isCancel(shouldOpenBrowser)) {
             throw new OAuthFlowError('Authentication cancelled by user');
         }
+        let browserOpened = false;
         if (shouldOpenBrowser) {
-            // Try to open browser, but don't fail if it doesn't work
             try {
                 await openBrowser(authUrl);
+                browserOpened = true;
             } catch (_error) {
-                // Browser opening failed, show URL for manual opening
                 log.warning('Could not open browser automatically.');
-                log.info(`Please open this URL in your browser:`);
-                log.info(`  ${authUrl}`);
             }
+        }
+        let code;
+        if (browserOpened) {
+            // Browser launched locally; the localhost listener receives the callback.
+            code = (await callbackPromise).code;
         } else {
-            // User declined automatic opening, show URL
-            log.info(`Please open this URL manually in your browser:`);
-            log.info(`  ${authUrl}`);
+            // No local browser (user declined, or open() failed — e.g. a remote devbox).
+            // Show the URL to open manually and accept the redirected code pasted back,
+            // while the localhost listener keeps running in case it can still receive it.
+            // p.log.step directly (not log.info) to avoid bolding the URL.
+            p.log.step(`Open this URL to authenticate:\n\n  ${authUrl}`);
+            code = await waitForCallbackOrPastedCode({
+                callbackPromise,
+                callbackServer,
+                expectedState: state
+            });
         }
-        // Wait for callback
-        const { code } = await callbackPromise;
         // Exchange authorization code for tokens
         let tokens;
         try {
@@ -215,6 +224,61 @@ import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './
         return null;
     }
 }
+/**
+ * Race the localhost callback listener against a pasted-code prompt.
+ *
+ * Used when no local browser was opened (remote/headless environments). Whichever
+ * settles first wins: if the listener receives the callback, the paste prompt is
+ * aborted; if the user pastes first, the listener is stopped. The listener's own
+ * timeout is non-fatal here — the user may take a while approving in the browser.
+ *
+ * @returns The authorization code from whichever source won
+ * @throws OAuthFlowError if the user cancels the paste prompt or the pasted value is invalid
+ */ async function waitForCallbackOrPastedCode({ callbackPromise, callbackServer, expectedState }) {
+    const abortController = new AbortController();
+    const listenerBranch = callbackPromise.then((result)=>{
+        // Listener won — tear down the paste prompt.
+        abortController.abort();
+        return result.code;
+    }, (error)=>{
+        // A timeout (or an unreachable listener on a remote box, which surfaces as a
+        // timeout) is non-fatal here — the user can still paste. Any other callback
+        // error means the browser actually reached the listener (denied consent, bad
+        // request, state mismatch), so surface it instead of hanging silently on the
+        // paste prompt.
+        if (error instanceof CallbackError && error.code === 'timeout') {
+            return new Promise(()=>{});
+        }
+        abortController.abort();
+        throw error;
+    });
+    const pasteBranch = (async ()=>{
+        // @clack/prompts TextOptions doesn't expose `signal` in its public type, but the
+        // underlying @clack/core PromptOptions does. Cast to reach the runtime capability.
+        const textOpts = {
+            message: 'Paste the redirect URL or code (optional):',
+            signal: abortController.signal,
+            validate: (value)=>validatePastedCode(value ?? '')
+        };
+        const pasted = await p.text(textOpts);
+        if (p.isCancel(pasted)) {
+            throw new OAuthFlowError('Authentication cancelled by user');
+        }
+        // Paste won — stop the listener before exchanging.
+        callbackServer.stop();
+        try {
+            return parsePastedCode(pasted, expectedState);
+        } catch (error) {
+            throw new OAuthFlowError(error instanceof Error ? error.message : 'Invalid pasted authorization code', error instanceof Error ? error : undefined);
+        }
+    })();
+    // Avoid an unhandled rejection when the paste prompt is aborted after the listener wins.
+    pasteBranch.catch(()=>{});
+    return Promise.race([
+        listenerBranch,
+        pasteBranch
+    ]);
+}
 function replaceRedirectUriPort(redirectUri, port) {
     const url = new URL(redirectUri);
     url.port = String(port);

package/dist/auth/paste-code.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Error parsing a pasted authorization code or redirect URL.
+ */
+export declare class PastedCodeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Parse a value the user pasted back after completing OAuth in their browser.
+ *
+ * Accepts either the full redirect URL (e.g.
+ * `http://localhost:34462/callback?code=...&state=...`) or a bare authorization
+ * code. When a URL is pasted, the `state` is validated against the value the CLI
+ * generated (CSRF protection); when a bare code is pasted, no state check is
+ * possible and PKCE alone gates the subsequent token exchange.
+ *
+ * @param input - Raw pasted text
+ * @param expectedState - The state value the CLI generated for this flow
+ * @returns The authorization code
+ * @throws PastedCodeError if the input is empty, is a URL without a code, or has a mismatched state
+ */
+export declare function parsePastedCode(input: string, expectedState: string): string;
+/**
+ * Structural validation for use as a `@clack/prompts` `text` validator.
+ *
+ * Returns `undefined` when the input could yield a code (so the prompt accepts it),
+ * or a human-readable message to re-prompt. Intentionally does NOT validate `state`
+ * — a state mismatch is a hard failure handled after the prompt resolves, not a
+ * re-prompt condition.
+ *
+ * @param input - Current prompt value
+ * @returns Error message string, or undefined if structurally valid
+ */
+export declare function validatePastedCode(input: string): string | undefined;
+//# sourceMappingURL=paste-code.d.ts.map

package/dist/auth/paste-code.js

@@ -0,0 +1,89 @@
+/**
+ * Error parsing a pasted authorization code or redirect URL.
+ */ export class PastedCodeError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'PastedCodeError';
+    }
+}
+const NO_CODE_MESSAGE = 'That URL has no "code" parameter. Paste the full redirect URL or just the code.';
+function parsePasteInput(input) {
+    const trimmed = input.trim();
+    if (!trimmed) {
+        return {
+            kind: 'empty'
+        };
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    } catch  {
+        return {
+            code: trimmed,
+            kind: 'bare-code'
+        };
+    }
+    const code = url.searchParams.get('code');
+    if (!code) {
+        return {
+            kind: 'url-missing-code'
+        };
+    }
+    return {
+        code,
+        kind: 'url',
+        state: url.searchParams.get('state')
+    };
+}
+/**
+ * Parse a value the user pasted back after completing OAuth in their browser.
+ *
+ * Accepts either the full redirect URL (e.g.
+ * `http://localhost:34462/callback?code=...&state=...`) or a bare authorization
+ * code. When a URL is pasted, the `state` is validated against the value the CLI
+ * generated (CSRF protection); when a bare code is pasted, no state check is
+ * possible and PKCE alone gates the subsequent token exchange.
+ *
+ * @param input - Raw pasted text
+ * @param expectedState - The state value the CLI generated for this flow
+ * @returns The authorization code
+ * @throws PastedCodeError if the input is empty, is a URL without a code, or has a mismatched state
+ */ export function parsePastedCode(input, expectedState) {
+    const parsed = parsePasteInput(input);
+    switch(parsed.kind){
+        case 'empty':
+            throw new PastedCodeError('No value provided.');
+        case 'bare-code':
+            return parsed.code;
+        case 'url-missing-code':
+            throw new PastedCodeError(NO_CODE_MESSAGE);
+        case 'url':
+            if (parsed.state !== null && parsed.state !== expectedState) {
+                throw new PastedCodeError('State mismatch — possible CSRF. Run login again.');
+            }
+            return parsed.code;
+    }
+}
+/**
+ * Structural validation for use as a `@clack/prompts` `text` validator.
+ *
+ * Returns `undefined` when the input could yield a code (so the prompt accepts it),
+ * or a human-readable message to re-prompt. Intentionally does NOT validate `state`
+ * — a state mismatch is a hard failure handled after the prompt resolves, not a
+ * re-prompt condition.
+ *
+ * @param input - Current prompt value
+ * @returns Error message string, or undefined if structurally valid
+ */ export function validatePastedCode(input) {
+    const parsed = parsePasteInput(input);
+    switch(parsed.kind){
+        case 'empty':
+            return 'Paste the redirect URL or the code.';
+        case 'url-missing-code':
+            return NO_CODE_MESSAGE;
+        default:
+            return undefined;
+    }
+}
+
+//# sourceMappingURL=paste-code.js.map

package/dist/cli.js

@@ -49,6 +49,7 @@ class Main {
             '--payload-version': String,
             '--skip-auth': Boolean,
             '--skip-build': Boolean,
+            '--skip-size-check': Boolean,
             '--template': String,
             '--version': Boolean,
             '--yes': Boolean,
@@ -135,6 +136,7 @@ class Main {
                         debug: this.args['--debug'],
                         env: this.args['--env'],
                         skipBuild: this.args['--skip-build'],
+                        skipSizeCheck: this.args['--skip-size-check'],
                         yes: this.args['--yes']
                     });
                     break;

package/dist/commands/deploy.d.ts

@@ -13,6 +13,8 @@ export interface DeployCommandOptions {
     id?: string;
     /** Skip the build step (use existing build) */
     skipBuild?: boolean;
+    /** Skip the client-side unzipped bundle size pre-flight check */
+    skipSizeCheck?: boolean;
     /** Skip confirmation prompts */
     yes?: boolean;
 }

package/dist/commands/deploy.js

@@ -7,6 +7,7 @@ import { getTokenStore } from '../auth/token-store.js';
 import { getInfraEnvironment, getProjectNotFoundMessage } from '../constants.js';
 import { getFileSize } from '../utils/asset-collection.js';
 import { detectBuild, getBuildCommand } from '../utils/build-detection.js';
+import { LAMBDA_MAX_UNZIPPED_BYTES } from '../utils/build-lambda-zip.js';
 import { detectAdapter } from '../utils/deploy-adapter.js';
 import { getEnvVar } from '../utils/env-management.js';
 import * as log from '../utils/log.js';
@@ -201,12 +202,15 @@ import { loginCommand } from './login.js';
         // Create deployment package (if server adapter)
         let zipPath = null;
         let zipSize = 0;
+        let unzippedBytes = 0;
         spinner.start('Creating deployment package...');
         try {
-            zipPath = await adapter.prepareLambdaBundle(projectPath);
-            if (zipPath) {
+            const bundle = await adapter.prepareLambdaBundle(projectPath);
+            if (bundle) {
+                zipPath = bundle.zipPath;
+                unzippedBytes = bundle.unzippedBytes;
                 zipSize = await getFileSize(zipPath);
-                spinner.stop(pc.green(`✓ Deployment package created (${formatBytes(zipSize)})`));
+                spinner.stop(pc.green(`✓ Deployment package created (${formatBytes(zipSize)} zipped, ${formatBytes(unzippedBytes)} unzipped)`));
             } else {
                 spinner.stop(pc.green('✓ Static site — no server package needed'));
             }
@@ -214,6 +218,15 @@ import { loginCommand } from './login.js';
             spinner.stop(pc.red('✗ Failed to create deployment package'));
             throw error;
         }
+        // Pre-flight: fail fast before the long upload when the unzipped bundle exceeds
+        // AWS Lambda's limit. The server enforces this too (and now returns a clear
+        // message), so --skip-size-check is a safe escape hatch if this client-side
+        // value ever drifts below the real limit.
+        if (zipPath && !options.skipSizeCheck && unzippedBytes >= LAMBDA_MAX_UNZIPPED_BYTES) {
+            spinner.stop(pc.red(`✗ Unzipped deployment size (${formatBytes(unzippedBytes)}) is at or over the ${formatBytes(LAMBDA_MAX_UNZIPPED_BYTES)} limit.`));
+            p.note('Reduce your deployment size (remove unused dependencies or large assets) and try again.\n' + 'To bypass this client-side check, re-run with --skip-size-check.', 'Deployment too large');
+            process.exit(1);
+        }
         log.debug(`Adapter: ${adapter.name}`);
         if (zipPath) {
             log.debug(`Lambda zip size: ${formatBytes(zipSize)}`);
@@ -225,7 +238,7 @@ import { loginCommand } from './login.js';
             p.note([
                 `${pc.cyan('Adapter:')} ${adapter.name}`,
                 `${pc.cyan('Build ID:')} ${buildInfo.buildId}`,
-                zipPath ? `${pc.cyan('Code size:')} ${formatBytes(zipSize)}` : `${pc.cyan('Code:')} No server`,
+                zipPath ? `${pc.cyan('Code size:')} ${formatBytes(zipSize)} zipped, ${formatBytes(unzippedBytes)} unzipped` : `${pc.cyan('Code:')} No server`,
                 `${pc.cyan('Pages:')} ${pages.routes.length} routes (${pages.uploadKeys.length} files)`,
                 `${pc.cyan('Assets:')} ${assets.uploadKeys.length} files`
             ].join('\n'), 'Details');

package/dist/oauth/components/LoginButton/index.js

@@ -86,9 +86,13 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
         // unspoofable) where supported; undefined on browsers that don't implement
         // the non-standard Location.ancestorOrigins (older Firefox, pre-148).
         const ancestorOrigins = window.location.ancestorOrigins;
+        // encodeURIComponent is required on Coder devbox: there a proxy hop rewrites
+        // an unencoded `serverURL=https://<host>` to http before it reaches the
+        // server, which then flows into state.serverURL / the OAuth redirect_uri and
+        // breaks login with an https→http navigation. Encoding the `://` avoids it.
         const cleanup = setupIframeAutoLogin({
             doFetch: window.fetch.bind(window),
-            metaUrl: `${serverURL}${api}/${userSlug}/${endpointSlug}/meta?serverURL=${window.location.origin}`,
+            metaUrl: `${serverURL}${api}/${userSlug}/${endpointSlug}/meta?serverURL=${encodeURIComponent(window.location.origin)}`,
             navigate: (url)=>{
                 window.location.href = url;
             },
@@ -115,8 +119,10 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
     ]);
     useEffect(()=>{
         if (payloadRedirect && !disabled) {
-            // set cookie to redirect to the original page
-            document.cookie = `payloadRedirect=${payloadRedirect}; path=/`;
+            // set cookie to redirect to the original page. SameSite=None; Secure;
+            // Partitioned so it round-trips to /sso/login from the cross-site Make
+            // iframe (a Lax/unmarked cookie isn't sent, dropping the deep-link redirect).
+            document.cookie = `payloadRedirect=${payloadRedirect}; path=/; Secure; SameSite=None; Partitioned`;
         }
     }, [
         payloadRedirect,
@@ -130,7 +136,8 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
             return;
         }
         const getAuthorizeURL = async ()=>{
-            const serverURLFromWindow = window.location.origin;
+            // Encoded for the same reason as the auto-login metaUrl above.
+            const serverURLFromWindow = encodeURIComponent(window.location.origin);
             const data = await fetch(`${serverURL}${api}/${userSlug}/${endpointSlug}/meta?serverURL=${serverURLFromWindow}`).then((res)=>res.json());
             setAuthorizeURL(data.authorizeURL);
         };

package/dist/oauth/components/LogoutButton/index.js

@@ -45,7 +45,7 @@ export const LogoutButton = ({ disabled, endpointSlug })=>{
         className: baseClass,
         children: /*#__PURE__*/ _jsx("a", {
             "aria-label": "Logout",
-            href: `${serverURL}${api}/${userSlug}/${endpointSlug}/logout?redirect=${redirect}`,
+            href: `${serverURL}${api}/${userSlug}/${endpointSlug}/logout?redirect=${encodeURIComponent(redirect)}`,
             children: /*#__PURE__*/ _jsxs("svg", {
                 className: "icon icon--logout",
                 fill: "none",

package/dist/oauth/defaults.js

@@ -44,7 +44,10 @@ export const defaultVerify = ({ collection, strategyName, userInfoCookieName = D
         // Clear the cookie after reading
         if (figmaUserInfo) {
             responseHeaders = new Headers();
-            responseHeaders.append('Set-Cookie', `${userInfoCookieName}=; Max-Age=0; Path=/;`);
+            // SameSite=None; Secure; Partitioned so the clear matches the attributes
+            // the cookie was set with (establishSession) and actually removes it in the
+            // cross-site Make iframe.
+            responseHeaders.append('Set-Cookie', `${userInfoCookieName}=; Max-Age=0; Path=/; Secure; SameSite=None; Partitioned`);
         }
         let user = null;
         const depth = typeof collection.auth === 'object' ? collection.auth.depth : undefined;

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -198,7 +198,9 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                     } else {
                         redirectToUse += payloadRedirect;
                     }
-                    req.responseHeaders.append('Set-Cookie', `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/;`);
+                    req.responseHeaders.append('Set-Cookie', // Match the attributes the cookie was set with so the clear removes it
+                    // in the cross-site Make iframe.
+                    `payloadRedirect=${redirectToUse}; Max-Age=0; Path=/; Secure; SameSite=None; Partitioned`);
                 }
                 await establishSession({
                     accessToken: access_token,

package/dist/oauth/hooks/refresh.js

@@ -6,6 +6,7 @@ import { getCookieExpiration } from '../utilities/getCookieExpiration.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
+import { withPartitionedCookie } from '../utilities/withPartitionedCookie.js';
 export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user })=>{
         if (!args.req.responseHeaders) {
             args.req.responseHeaders = new Headers();
@@ -47,7 +48,7 @@ export const getRefreshHook = ({ pluginOptions, strategy })=>async ({ args, user
                     }) ?? 31_556_952),
                     value: refreshedToken
                 });
-                args.req.responseHeaders.append('Set-Cookie', refreshCookie);
+                args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
                 const newDecoded = jwt.decode(refreshedToken);
                 strategy.debugLog('usePayloadJWT: true - Received new refresh token', {
                     newDecoded,

package/dist/oauth/utilities/clearCookie.js

@@ -1,5 +1,6 @@
 import { generateCookie } from 'payload';
 import { getCookieExpiration } from './getCookieExpiration.js';
+import { withPartitionedCookie } from './withPartitionedCookie.js';
 export const clearCookie = (args)=>{
     const options = {
         ...args.cookieOptions,
@@ -15,7 +16,10 @@ export const clearCookie = (args)=>{
     if (!args.req.responseHeaders) {
         args.req.responseHeaders = new Headers();
     }
-    args.req.responseHeaders.append('Set-Cookie', clearedCookie);
+    // Match the Partitioned attribute the cookie was set with — a Max-Age=0 clear
+    // without it targets the unpartitioned jar and won't delete the partitioned
+    // cookie, so logout wouldn't clear the session in the cross-site Make iframe.
+    args.req.responseHeaders.append('Set-Cookie', withPartitionedCookie(clearedCookie));
 };
 
 //# sourceMappingURL=clearCookie.js.map

package/dist/oauth/utilities/createCookieOptions.js

@@ -1,10 +1,17 @@
 export const createCookieOptions = ({ collection, headers, pluginOptions })=>{
+    // Default to SameSite=None + Secure (and `Partitioned`, appended in
+    // establishSession via withPartitionedCookie) so the session cookies survive
+    // the cross-site Make-preview iframe — the admin panel runs on a different
+    // site from the top-level figma.com page, and a Lax/unmarked cookie is not
+    // sent back, looping the login. Mirrors the CSRF cookie (buildCsrfCookieHeader).
+    // Self-hosters on a same-site setup can override via collection.auth.cookies
+    // or pluginOptions.createCookieOptions below.
     let cookieOptions = {
         domain: undefined,
         httpOnly: true,
         path: '/',
-        sameSite: undefined,
-        secure: false
+        sameSite: 'None',
+        secure: true
     };
     if (typeof collection.auth === 'object' && typeof collection.auth.cookies === 'object') {
         const { domain, sameSite, secure } = collection.auth.cookies;

package/dist/oauth/utilities/establishSession.js

@@ -2,6 +2,7 @@ import { APIError, generateCookie } from 'payload';
 import { getProjectToken, getUserInfo } from '../../api/figma-api.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
+import { withPartitionedCookie } from './withPartitionedCookie.js';
 /**
  * Given a valid OAuth access_token: fetch user info (non-fatal), mint a
  * project token, and write the main + refresh + user-info cookies to
@@ -51,7 +52,7 @@ import { getCookieExpiration } from './getCookieExpiration.js';
             returnCookieAsObject: false,
             value: accessToken
         });
-        req.responseHeaders.append('Set-Cookie', refreshCookie);
+        req.responseHeaders.append('Set-Cookie', withPartitionedCookie(refreshCookie));
     }
     const tokenExpires = cookieOptions?.expires ? getCookieExpiration(cookieOptions.expires) : new Date(projectToken.expiresAt);
     const tokenCookie = generateCookie({
@@ -61,7 +62,7 @@ import { getCookieExpiration } from './getCookieExpiration.js';
         returnCookieAsObject: false,
         value: projectToken.token
     });
-    req.responseHeaders.append('Set-Cookie', tokenCookie);
+    req.responseHeaders.append('Set-Cookie', withPartitionedCookie(tokenCookie));
     // Short-lived handoff cookie consumed by defaultVerify on the next request.
     if (figmaUserInfo) {
         const userInfoValue = Buffer.from(JSON.stringify({
@@ -75,7 +76,7 @@ import { getCookieExpiration } from './getCookieExpiration.js';
             returnCookieAsObject: false,
             value: userInfoValue
         });
-        req.responseHeaders.append('Set-Cookie', userInfoCookie);
+        req.responseHeaders.append('Set-Cookie', withPartitionedCookie(userInfoCookie));
     }
 };
 

package/dist/oauth/utilities/refreshTokens.js

@@ -5,6 +5,7 @@ import { getInfraEnvironment } from '../../constants.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { createDebugLogger } from './createDebugLogger.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
+import { withPartitionedCookie } from './withPartitionedCookie.js';
 export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     const debugLogger = createDebugLogger(payload, strategy.debug);
     debugLogger.info({
@@ -50,7 +51,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
                 returnCookieAsObject: false,
                 value: token
             });
-            headers.append('Set-Cookie', tokenCookie);
+            headers.append('Set-Cookie', withPartitionedCookie(tokenCookie));
             const decodedOauthToken = await validateProjectToken(token, getInfraEnvironment());
             return {
                 decodedOauthToken,

package/dist/oauth/utilities/withPartitionedCookie.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Append the `Partitioned` (CHIPS) attribute to a `Set-Cookie` header string.
+ *
+ * Payload's `generateCookie` cannot emit `Partitioned`, but Chrome requires it
+ * for a `SameSite=None` cookie set inside the cross-site Make-preview iframe
+ * (top-level `figma.com`, app on a different site) to be stored and sent back.
+ * Without it the session cookies are dropped, `/api/users/me` sees no token,
+ * and the admin login loops forever. The CSRF cookie avoids this by
+ * hand-building its header (`buildCsrfCookieHeader`); the session cookies go
+ * through `generateCookie`, so we add the attribute here to match.
+ *
+ * Only applied to `Secure` cookies: `Partitioned` requires `Secure`, and a
+ * partitioned non-secure cookie is rejected outright. Idempotent. The presence
+ * check matches a bare `Secure` or `generateCookie`'s `Secure=true` form, but
+ * deliberately NOT `Secure=false` — `generateCookie` never emits that today
+ * (it only writes `Secure` when truthy), but the check stays defensive so a
+ * future/hand-built `Secure=false` can't get `Partitioned` (which requires Secure).
+ */
+export declare const withPartitionedCookie: (cookie: string) => string;
+//# sourceMappingURL=withPartitionedCookie.d.ts.map

package/dist/oauth/utilities/withPartitionedCookie.js

@@ -0,0 +1,28 @@
+/**
+ * Append the `Partitioned` (CHIPS) attribute to a `Set-Cookie` header string.
+ *
+ * Payload's `generateCookie` cannot emit `Partitioned`, but Chrome requires it
+ * for a `SameSite=None` cookie set inside the cross-site Make-preview iframe
+ * (top-level `figma.com`, app on a different site) to be stored and sent back.
+ * Without it the session cookies are dropped, `/api/users/me` sees no token,
+ * and the admin login loops forever. The CSRF cookie avoids this by
+ * hand-building its header (`buildCsrfCookieHeader`); the session cookies go
+ * through `generateCookie`, so we add the attribute here to match.
+ *
+ * Only applied to `Secure` cookies: `Partitioned` requires `Secure`, and a
+ * partitioned non-secure cookie is rejected outright. Idempotent. The presence
+ * check matches a bare `Secure` or `generateCookie`'s `Secure=true` form, but
+ * deliberately NOT `Secure=false` — `generateCookie` never emits that today
+ * (it only writes `Secure` when truthy), but the check stays defensive so a
+ * future/hand-built `Secure=false` can't get `Partitioned` (which requires Secure).
+ */ export const withPartitionedCookie = (cookie)=>{
+    if (!/;\s*Secure(?:=true)?(?:;|$)/i.test(cookie)) {
+        return cookie;
+    }
+    if (/;\s*Partitioned(?:=|;|$)/i.test(cookie)) {
+        return cookie;
+    }
+    return `${cookie}; Partitioned`;
+};
+
+//# sourceMappingURL=withPartitionedCookie.js.map

package/dist/utils/adapters/nextjs.d.ts

@@ -1,9 +1,9 @@
-import type { AssetCollection, DeployAdapter, PageCollection } from '../deploy-adapter.js';
+import type { AssetCollection, DeployAdapter, LambdaBundle, PageCollection } from '../deploy-adapter.js';
 export declare class NextjsAdapter implements DeployAdapter {
     name: "nextjs";
     collectAssets(projectPath: string): Promise<AssetCollection>;
     collectPages(projectPath: string): Promise<PageCollection>;
-    prepareLambdaBundle(projectPath: string): Promise<string>;
+    prepareLambdaBundle(projectPath: string): Promise<LambdaBundle>;
 }
 export declare const nextjsAdapter: NextjsAdapter;
 //# sourceMappingURL=nextjs.d.ts.map

package/dist/utils/adapters/nextjs.js

@@ -55,8 +55,7 @@ export class NextjsAdapter {
         };
     }
     async prepareLambdaBundle(projectPath) {
-        await buildLambdaZip(projectPath);
-        return path.join(projectPath, 'lambda.zip');
+        return buildLambdaZip(projectPath);
     }
 }
 export const nextjsAdapter = new NextjsAdapter();

package/dist/utils/adapters/nitro.d.ts

@@ -1,9 +1,9 @@
-import type { AssetCollection, DeployAdapter, PageCollection } from '../deploy-adapter.js';
+import type { AssetCollection, DeployAdapter, LambdaBundle, PageCollection } from '../deploy-adapter.js';
 export declare class NitroAdapter implements DeployAdapter {
     name: "nitro";
     collectAssets(projectPath: string): Promise<AssetCollection>;
     collectPages(projectPath: string): Promise<PageCollection>;
-    prepareLambdaBundle(projectPath: string): Promise<string>;
+    prepareLambdaBundle(projectPath: string): Promise<LambdaBundle>;
 }
 export declare const nitroAdapter: NitroAdapter;
 //# sourceMappingURL=nitro.d.ts.map

package/dist/utils/adapters/nitro.js

@@ -2,7 +2,7 @@ import archiver from 'archiver';
 import { createWriteStream, statSync } from 'fs';
 import fs from 'fs/promises';
 import path from 'path';
-import { collectFilesRecursive } from '../fs-utils.js';
+import { collectFilesRecursive, getDirectorySize } from '../fs-utils.js';
 const RUN_SCRIPT = `#!/bin/bash -x
 [ ! -d '/tmp/cache' ] && mkdir -p /tmp/cache
 NODE_ENV=production exec node server/index.mjs
@@ -99,11 +99,16 @@ export class NitroAdapter {
                 source: runShPath
             }
         ]);
+        const runShStat = await fs.stat(runShPath);
+        const unzippedBytes = await getDirectorySize(serverDir) + await getDirectorySize(publicDir) + runShStat.size;
         // Clean up temp run.sh
         await fs.rm(runShPath, {
             force: true
         });
-        return zipPath;
+        return {
+            unzippedBytes,
+            zipPath
+        };
     }
 }
 export const nitroAdapter = new NitroAdapter();

package/dist/utils/adapters/vite.d.ts

@@ -1,10 +1,10 @@
-import type { AssetCollection, DeployAdapter, PageCollection } from '../deploy-adapter.js';
+import type { AssetCollection, DeployAdapter, LambdaBundle, PageCollection } from '../deploy-adapter.js';
 export declare class ViteAdapter implements DeployAdapter {
     fallback: string;
     name: "vite";
     collectAssets(projectPath: string): Promise<AssetCollection>;
     collectPages(): Promise<PageCollection>;
-    prepareLambdaBundle(): Promise<null>;
+    prepareLambdaBundle(): Promise<LambdaBundle | null>;
 }
 export declare const viteAdapter: ViteAdapter;
 //# sourceMappingURL=vite.d.ts.map

package/dist/utils/build-lambda-zip.d.ts

@@ -1,3 +1,12 @@
+import type { LambdaBundle } from './deploy-adapter.js';
+/**
+ * AWS Lambda's hard limit on unzipped deployment code size (250 MB). The unzipped
+ * total must be strictly less than this value, so a bundle exactly equal to it is
+ * rejected. The server enforces this too and now returns a clear message, so a
+ * client-side check against this value is an early-exit convenience, not the
+ * source of truth.
+ */
+export declare const LAMBDA_MAX_UNZIPPED_BYTES: number;
 /**
  * Build Lambda deployment zip using pure Node.js
  *
@@ -10,7 +19,8 @@
  * as static assets and served via CDN, not from the Lambda function.
  *
  * @param projectPath - Path to project root
+ * @returns The built bundle: its unzipped byte size and the absolute zip path.
  * @throws Error if standalone directory missing or zip creation fails
  */
-export declare function buildLambdaZip(projectPath: string): Promise<void>;
+export declare function buildLambdaZip(projectPath: string): Promise<LambdaBundle>;
 //# sourceMappingURL=build-lambda-zip.d.ts.map

package/dist/utils/build-lambda-zip.js

@@ -2,6 +2,14 @@ import archiver from 'archiver';
 import { createWriteStream } from 'fs';
 import fs from 'fs/promises';
 import path from 'path';
+import { getDirectorySize } from './fs-utils.js';
+/**
+ * AWS Lambda's hard limit on unzipped deployment code size (250 MB). The unzipped
+ * total must be strictly less than this value, so a bundle exactly equal to it is
+ * rejected. The server enforces this too and now returns a clear message, so a
+ * client-side check against this value is an early-exit convenience, not the
+ * source of truth.
+ */ export const LAMBDA_MAX_UNZIPPED_BYTES = 250 * 1024 * 1024;
 /**
  * Build Lambda deployment zip using pure Node.js
  *
@@ -14,6 +22,7 @@ import path from 'path';
  * as static assets and served via CDN, not from the Lambda function.
  *
  * @param projectPath - Path to project root
+ * @returns The built bundle: its unzipped byte size and the absolute zip path.
  * @throws Error if standalone directory missing or zip creation fails
  */ export async function buildLambdaZip(projectPath) {
     const standalonePath = path.join(projectPath, '.next', 'standalone');
@@ -32,7 +41,12 @@ import path from 'path';
     } catch  {
     // run.sh may not exist in all setups
     }
+    const unzippedBytes = await getDirectorySize(standalonePath);
     await createZip(standalonePath, zipPath);
+    return {
+        unzippedBytes,
+        zipPath
+    };
 }
 async function isDirectory(dirPath) {
     try {

package/dist/utils/deploy-adapter.d.ts

@@ -17,14 +17,20 @@ export interface AssetCollection {
     uploadKeys: string[];
 }
 export type AdapterName = 'nextjs' | 'nitro' | 'vite';
+export interface LambdaBundle {
+    /** Total size in bytes of the bundle contents before compression. */
+    unzippedBytes: number;
+    /** Absolute path to the built lambda.zip. */
+    zipPath: string;
+}
 export interface DeployAdapter {
     collectAssets(projectPath: string): Promise<AssetCollection>;
     collectPages(projectPath: string): Promise<PageCollection>;
     /** SPA fallback path (e.g., "/index.html"). Undefined for SSR/SSG apps. */
     fallback?: string;
     name: AdapterName;
-    /** Assembles and zips the server bundle. Returns path to zip, or null if no server (e.g., Vite SPA). */
-    prepareLambdaBundle(projectPath: string): Promise<null | string>;
+    /** Assembles and zips the server bundle. Returns the bundle, or null if no server (e.g., Vite SPA). */
+    prepareLambdaBundle(projectPath: string): Promise<LambdaBundle | null>;
 }
 /**
  * Auto-detect the framework adapter based on build output.

package/dist/utils/fs-utils.d.ts

@@ -3,4 +3,11 @@
  * returned as forward-slash-separated paths relative to baseDir.
  */
 export declare function collectFilesRecursive(dir: string, baseDir: string): Promise<string[]>;
+/**
+ * Recursively sum the byte size of all files under a directory.
+ * Returns 0 for a missing or unreadable directory. Symlinks are not
+ * followed. Files that disappear or become unreadable between readdir
+ * and stat are skipped (treated as 0 bytes).
+ */
+export declare function getDirectorySize(dir: string): Promise<number>;
 //# sourceMappingURL=fs-utils.d.ts.map

package/dist/utils/fs-utils.js

@@ -23,5 +23,35 @@ import path from 'path';
     }
     return files;
 }
+/**
+ * Recursively sum the byte size of all files under a directory.
+ * Returns 0 for a missing or unreadable directory. Symlinks are not
+ * followed. Files that disappear or become unreadable between readdir
+ * and stat are skipped (treated as 0 bytes).
+ */ export async function getDirectorySize(dir) {
+    let entries;
+    try {
+        entries = await fs.readdir(dir, {
+            withFileTypes: true
+        });
+    } catch  {
+        return 0;
+    }
+    let total = 0;
+    for (const entry of entries){
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            total += await getDirectorySize(fullPath);
+        } else if (entry.isFile()) {
+            try {
+                const stats = await fs.stat(fullPath);
+                total += stats.size;
+            } catch  {
+            // File vanished or is unreadable between readdir and stat — skip it.
+            }
+        }
+    }
+    return total;
+}
 
 //# sourceMappingURL=fs-utils.js.map

package/dist/utils/messages.js

@@ -61,6 +61,7 @@ export function helpMessage() {
       ${pc.dim('--env <environment>')}                   Override FIGMA_ENVIRONMENT_NAME
       ${pc.dim('--yes, -y')}                             Skip confirmation prompts
       ${pc.dim('--skip-build')}                          Skip building and use existing build
+      ${pc.dim('--skip-size-check')}                     Skip the client-side bundle size check
 
   ${pc.bold('UPGRADE COMMAND')}
 

package/dist/utils/s3-upload.js

@@ -1,5 +1,6 @@
 import fs from 'fs/promises';
 import path from 'path';
+import { parseS3Error } from '../api/error-response.js';
 import * as log from './log.js';
 /**
  * Retry configuration
@@ -87,7 +88,10 @@ const INITIAL_RETRY_DELAY = 1000 // 1 second
             if (response.ok) {
                 return; // Success
             }
-            lastError = new Error(`Upload failed: ${response.status} ${response.statusText}`);
+            lastError = new Error(await parseS3Error({
+                context: `upload ${path.basename(filePath)}`,
+                response
+            }));
         } catch (error) {
             lastError = error instanceof Error ? error : new Error('Unknown error');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.0.1-alpha.70",
+  "version": "0.0.1-alpha.72",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {