@payloadcms/figma 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/oauth/defaults.d.ts

@@ -1,7 +1,6 @@
 import type { CollectionConfig, EmailField, TextField } from 'payload';
 import type { VerifyFunction } from './types.js';
 export declare const DEFAULT_USER_INFO_COOKIE_NAME = "figma-user-info";
-export declare const FIGMA_OAUTH_CALLBACK_PATH = "/users/sso/login";
 export declare const defaultScope: string[];
 export declare const defaultUsernameField: TextField;
 export declare const defaultVerify: ({ collection, strategyName, userInfoCookieName, usernameField, }: {

package/dist/oauth/defaults.js

@@ -3,7 +3,6 @@ import { v4 as uuid } from 'uuid';
 import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
 import { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js';
 export const DEFAULT_USER_INFO_COOKIE_NAME = 'figma-user-info';
-export const FIGMA_OAUTH_CALLBACK_PATH = '/users/sso/login';
 function getFigmaUserInfo(headers, cookieName) {
     try {
         const cookies = parseCookies(headers);

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -6,7 +6,6 @@ import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { establishSession } from '../utilities/establishSession.js';
 import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminCollectionSlug } from '../utilities/getAdminCollectionSlug.js';
 import { buildCsrfCookieClearHeader, getOAuthCallbackPath, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
@@ -153,7 +152,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 const redirectUri = formatAdminURL({
                     apiRoute: config.routes?.api || '/api',
                     path: getOAuthCallbackPath({
-                        adminCollectionSlug: getAdminCollectionSlug(config),
                         collection,
                         endpointSlug
                     }),

package/dist/oauth/index.js

@@ -1,5 +1,5 @@
 import { fieldAffectsData } from 'payload/shared';
-import { defaultVerify, FIGMA_OAUTH_CALLBACK_PATH } from './defaults.js';
+import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
 import { getMetaEndpoint } from './endpoints/getMetaEndpoint.js';
@@ -50,7 +50,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 path: '@payloadcms/figma/client#DefaultLoginButton'
             };
         }
-        let callbackEndpoint;
         return {
             ...config,
             admin: {
@@ -156,13 +155,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     pluginOptions,
                     strategy
                 });
-                const collectionCallbackPath = `/${existingCollection.slug}/${endpointSlug}/login`;
-                if (existingCollection.slug === adminCollectionSlug && FIGMA_OAUTH_CALLBACK_PATH !== collectionCallbackPath) {
-                    callbackEndpoint = {
-                        ...loginEndpoint,
-                        path: FIGMA_OAUTH_CALLBACK_PATH
-                    };
-                }
                 const authStrategy = {
                     name: `${existingCollection.slug}-${strategyName}`,
                     // Bind 'this' to ensure the authenticate function has the correct context
@@ -246,12 +238,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                         ]
                     }
                 };
-            }),
-            endpoints: [
-                ...config.endpoints ?? [],
-                ...callbackEndpoint ? [
-                    callbackEndpoint
-                ] : []
-            ]
+            })
         };
     };

package/dist/oauth/utilities/getAuthorizeURL.d.ts

@@ -45,9 +45,7 @@ export interface AuthorizeURLResult {
     csrfNonce: string;
     params: AuthorizeURLParams;
 }
-export declare const getOAuthCallbackPath: ({ adminCollectionSlug, collection, endpointSlug, }: {
-    adminCollectionSlug: string;
-} & Pick<Args, "collection" | "endpointSlug">) => `/${string}`;
+export declare const getOAuthCallbackPath: ({ collection, endpointSlug, }: Pick<Args, "collection" | "endpointSlug">) => `/${string}`;
 export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<AuthorizeURLResult>;
 /**
  * Name of the HttpOnly cookie that carries the browser-bound CSRF nonce

package/dist/oauth/utilities/getAuthorizeURL.js

@@ -1,9 +1,8 @@
 import crypto from 'crypto';
 import * as QueryString from 'qs-esm';
 import { v4 as uuid } from 'uuid';
-import { defaultScope, FIGMA_OAUTH_CALLBACK_PATH } from '../defaults.js';
-import { getAdminCollectionSlug } from './getAdminCollectionSlug.js';
-export const getOAuthCallbackPath = ({ adminCollectionSlug, collection, endpointSlug })=>collection.slug === adminCollectionSlug ? FIGMA_OAUTH_CALLBACK_PATH : `/${collection.slug}/${endpointSlug}/login`;
+import { defaultScope } from '../defaults.js';
+export const getOAuthCallbackPath = ({ collection, endpointSlug })=>`/${collection.slug}/${endpointSlug}/login`;
 export const getAuthorizeURL = async ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy })=>{
     const { redirectServerURL } = pluginOptions;
     await strategy.ensureMeta();
@@ -33,7 +32,6 @@ export const getAuthorizeURL = async ({ collection, collectionOptions, endpointS
     }
     const baseRedirectURL = redirectServerURL || payload.config.serverURL || state.serverURL;
     const loginRedirectURL = encodeURI(`${baseRedirectURL}${payload.config.routes?.api || '/api'}${getOAuthCallbackPath({
-        adminCollectionSlug: getAdminCollectionSlug(payload.config),
         collection,
         endpointSlug
     })}`);

package/dist/storage-content-api/buildBaseMediaResponseHeaders.d.ts

@@ -0,0 +1 @@
+export declare const buildBaseMediaResponseHeaders: () => Headers;

package/dist/storage-content-api/buildBaseMediaResponseHeaders.js

@@ -0,0 +1,6 @@
+export const buildBaseMediaResponseHeaders = ()=>new Headers({
+        'Accept-Ranges': 'bytes',
+        'Cache-Control': 'private, no-store',
+        Vary: 'Cookie',
+        'X-Content-Type-Options': 'nosniff'
+    });

package/dist/storage-content-api/buildClientUploadFetchBackHeaders.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Payload's server-side upload fetch-back uses the response Content-Type to decide whether to
+ * inspect image dimensions. For an active image type such as SVG, omit the sanitized type so
+ * Payload falls back to the original upload MIME type. Public file requests never use this helper.
+ */
+export declare const buildClientUploadFetchBackHeaders: ({ fallbackContentType, filename, upstream, }: {
+    fallbackContentType?: string;
+    filename: string;
+    upstream: Headers;
+}) => Headers;

package/dist/storage-content-api/buildClientUploadFetchBackHeaders.js

@@ -0,0 +1,21 @@
+import { buildMediaResponseHeaders } from './buildMediaResponseHeaders.js';
+import { getInlineContentType } from './getInlineContentType.js';
+/**
+ * Payload's server-side upload fetch-back uses the response Content-Type to decide whether to
+ * inspect image dimensions. For an active image type such as SVG, omit the sanitized type so
+ * Payload falls back to the original upload MIME type. Public file requests never use this helper.
+ */ export const buildClientUploadFetchBackHeaders = ({ fallbackContentType, filename, upstream })=>{
+    const effectiveContentType = upstream.get('Content-Type') || fallbackContentType;
+    const upstreamWithFallback = new Headers(upstream);
+    if (effectiveContentType && !upstream.get('Content-Type')) {
+        upstreamWithFallback.set('Content-Type', effectiveContentType);
+    }
+    const headers = buildMediaResponseHeaders({
+        filename,
+        upstream: upstreamWithFallback
+    });
+    if (effectiveContentType && !getInlineContentType(effectiveContentType)) {
+        headers.delete('Content-Type');
+    }
+    return headers;
+};

package/dist/storage-content-api/buildMediaResponseHeaders.d.ts

@@ -0,0 +1,4 @@
+export declare const buildMediaResponseHeaders: ({ filename, upstream, }: {
+    filename: string;
+    upstream: Headers;
+}) => Headers;

package/dist/storage-content-api/buildMediaResponseHeaders.js

@@ -0,0 +1,45 @@
+import { buildBaseMediaResponseHeaders } from './buildBaseMediaResponseHeaders.js';
+import { getInlineContentType } from './getInlineContentType.js';
+const FORWARDED_MEDIA_RESPONSE_HEADERS = [
+    'Cache-Control',
+    'Content-Length',
+    'Content-Range',
+    'ETag',
+    'Last-Modified'
+];
+const ATTACHMENT_CSP = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'";
+export const buildMediaResponseHeaders = ({ filename, upstream })=>{
+    const headers = buildBaseMediaResponseHeaders();
+    for (const name of FORWARDED_MEDIA_RESPONSE_HEADERS){
+        const value = upstream.get(name);
+        if (value) {
+            headers.set(name, value);
+        }
+    }
+    const contentType = getInlineContentType(upstream.get('Content-Type'));
+    if (contentType) {
+        headers.set('Content-Type', contentType);
+    } else {
+        headers.set('Content-Type', 'application/octet-stream');
+        headers.set('Content-Disposition', attachmentDisposition(filename));
+        headers.set('Content-Security-Policy', ATTACHMENT_CSP);
+    }
+    return headers;
+};
+const attachmentDisposition = (filename)=>{
+    let decodedName;
+    try {
+        decodedName = decodeURIComponent(filename);
+    } catch  {
+        decodedName = 'download';
+    }
+    const sanitizedName = sanitizeFilename(decodedName);
+    const safeName = Array.from(sanitizedName).slice(0, 255).join('') || 'download';
+    const asciiName = safeName.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+    const utf8Name = encodeURIComponent(safeName).replace(/[!'()*]/g, (character)=>`%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `attachment; filename="${asciiName}"; filename*=UTF-8''${utf8Name}`;
+};
+const sanitizeFilename = (filename)=>Array.from(filename, (character)=>{
+        const codePoint = character.codePointAt(0);
+        return codePoint < 32 || codePoint === 127 || character === '/' || character === '\\' ? '_' : character;
+    }).join('');

package/dist/storage-content-api/getInlineContentType.d.ts

@@ -0,0 +1 @@
+export declare const getInlineContentType: (value: null | string | undefined) => string | null;

package/dist/storage-content-api/getInlineContentType.js

@@ -0,0 +1,33 @@
+// Keep this allowlist aligned with Gatekeeper's presignedMediaHeaders.ts. The plugin cannot
+// import the private Gatekeeper service, but both same-origin media proxies need the same policy.
+const INLINE_CONTENT_TYPES = new Set([
+    'application/font-woff',
+    'audio/aac',
+    'audio/flac',
+    'audio/mp4',
+    'audio/mpeg',
+    'audio/ogg',
+    'audio/wav',
+    'audio/webm',
+    'font/otf',
+    'font/ttf',
+    'font/woff',
+    'font/woff2',
+    'image/avif',
+    'image/bmp',
+    'image/gif',
+    'image/jpeg',
+    'image/png',
+    'image/vnd.microsoft.icon',
+    'image/webp',
+    'image/x-icon',
+    'video/mp4',
+    'video/mpeg',
+    'video/ogg',
+    'video/quicktime',
+    'video/webm'
+]);
+export const getInlineContentType = (value)=>{
+    const normalized = value?.split(';', 1).at(0)?.trim().toLowerCase();
+    return normalized && INLINE_CONTENT_TYPES.has(normalized) ? normalized : null;
+};

package/dist/storage-content-api/hasSupportedContentEncoding.d.ts

@@ -0,0 +1 @@
+export declare const hasSupportedContentEncoding: (headers: Headers) => boolean;

package/dist/storage-content-api/hasSupportedContentEncoding.js

@@ -0,0 +1,4 @@
+export const hasSupportedContentEncoding = (headers)=>{
+    const contentEncoding = headers.get('content-encoding')?.trim().toLowerCase();
+    return contentEncoding == null || contentEncoding === '' || contentEncoding === 'identity';
+};

package/dist/storage-content-api/mediaErrorResponse.d.ts

@@ -0,0 +1 @@
+export declare const mediaErrorResponse: (status: number, body: string, contentRange?: string) => Response;

package/dist/storage-content-api/mediaErrorResponse.js

@@ -0,0 +1,12 @@
+import { buildBaseMediaResponseHeaders } from './buildBaseMediaResponseHeaders.js';
+export const mediaErrorResponse = (status, body, contentRange)=>{
+    const headers = buildBaseMediaResponseHeaders();
+    headers.set('Content-Type', 'text/plain;charset=UTF-8');
+    if (contentRange) {
+        headers.set('Content-Range', contentRange);
+    }
+    return new Response(body, {
+        headers,
+        status
+    });
+};

package/dist/storage-content-api/staticHandler.js

@@ -1,7 +1,29 @@
 import { getFilePrefix } from '@payloadcms/plugin-cloud-storage/utilities';
 import path from 'path';
 import { isImage } from 'payload/shared';
+import { buildClientUploadFetchBackHeaders } from './buildClientUploadFetchBackHeaders.js';
+import { buildMediaResponseHeaders } from './buildMediaResponseHeaders.js';
+import { hasSupportedContentEncoding } from './hasSupportedContentEncoding.js';
+import { mediaErrorResponse } from './mediaErrorResponse.js';
 import { parseUploadReference } from './utilities/index.js';
+const isRunningInLambda = ()=>process.env.AWS_EXECUTION_ENV?.startsWith('AWS_Lambda_') === true;
+const shouldReturnRedirect = ({ uploadReference })=>{
+    if (!isRunningInLambda()) {
+        return false;
+    }
+    if (!uploadReference) {
+        return true;
+    }
+    const { mimeType } = parseUploadReference(uploadReference);
+    return Boolean(mimeType && !isImage(mimeType));
+};
+const cancelResponseBody = async (response)=>{
+    try {
+        await response.body?.cancel();
+    } catch  {
+    // The response will not be consumed after an error; cancellation is best-effort cleanup.
+    }
+};
 export const getHandler = ({ client, collection })=>{
     return async (req, { params: { filename, uploadReference } })=>{
         try {
@@ -25,29 +47,68 @@ export const getHandler = ({ client, collection })=>{
                     status: 500
                 });
             }
-            // On a client-upload fetch-back, core reads this response body into req.file.data to
-            // size the image; a 302's empty body crashes getImageSize. Return real bytes for
-            // images (and unknown mimetypes, to be safe), but keep the redirect otherwise so we
-            // don't download large non-images server-side.
-            if (uploadReference) {
-                const { mimeType } = parseUploadReference(uploadReference);
-                if (!mimeType || isImage(mimeType)) {
-                    const fileResponse = await fetch(data.url);
-                    if (!fileResponse.ok) {
-                        req.payload.logger.error(`Failed to fetch file for client-upload buffer fetch-back: ${fileResponse.status}`);
-                        return new Response('Internal Server Error', {
-                            status: 500
-                        });
-                    }
-                    const contentType = fileResponse.headers.get('Content-Type') ?? mimeType ?? 'application/octet-stream';
-                    return new Response(await fileResponse.arrayBuffer(), {
-                        headers: {
-                            'Content-Type': contentType
-                        }
-                    });
+            // Lambda responses have a 6 MB limit, so deployed apps redirect to Gatekeeper, which
+            // validates the signed URL and streams the file. Other runtimes do not have Gatekeeper
+            // in front of them and must stream the file through Payload instead.
+            // An image uploadReference marks an internal, one-time fetch-back. Payload core consumes
+            // the body to size the image, so a redirect would leave it empty even in Lambda.
+            if (shouldReturnRedirect({
+                uploadReference
+            })) {
+                return Response.redirect(data.url, 302);
+            }
+            const requestHeaders = new Headers({
+                'Accept-Encoding': 'identity'
+            });
+            const range = req.headers.get('Range');
+            if (range) {
+                requestHeaders.set('Range', range);
+                const ifRange = req.headers.get('If-Range');
+                if (ifRange) {
+                    requestHeaders.set('If-Range', ifRange);
                 }
             }
-            return Response.redirect(data.url, 302);
+            let fileResponse;
+            try {
+                fileResponse = await fetch(data.url, {
+                    credentials: 'omit',
+                    headers: requestHeaders,
+                    redirect: 'manual',
+                    referrerPolicy: 'no-referrer',
+                    signal: req.signal
+                });
+            } catch  {
+                req.payload.logger.error('Failed to fetch file from storage');
+                return mediaErrorResponse(500, 'Internal Server Error');
+            }
+            if (fileResponse.status === 416 && range) {
+                await cancelResponseBody(fileResponse);
+                return mediaErrorResponse(416, 'Range Not Satisfiable', fileResponse.headers.get('Content-Range') ?? undefined);
+            }
+            if (!fileResponse.ok) {
+                await cancelResponseBody(fileResponse);
+                req.payload.logger.error(`Failed to fetch file from storage: ${fileResponse.status}`);
+                return mediaErrorResponse(500, 'Internal Server Error');
+            }
+            if (!hasSupportedContentEncoding(fileResponse.headers)) {
+                await cancelResponseBody(fileResponse);
+                req.payload.logger.error('Unsupported Content-Encoding from storage');
+                return mediaErrorResponse(502, 'Bad Gateway');
+            }
+            const clientUploadMimeType = uploadReference ? parseUploadReference(uploadReference).mimeType : undefined;
+            const responseHeaders = uploadReference ? buildClientUploadFetchBackHeaders({
+                fallbackContentType: clientUploadMimeType,
+                filename,
+                upstream: fileResponse.headers
+            }) : buildMediaResponseHeaders({
+                filename,
+                upstream: fileResponse.headers
+            });
+            return new Response(fileResponse.body, {
+                headers: responseHeaders,
+                status: fileResponse.status,
+                statusText: fileResponse.statusText
+            });
         } catch (err) {
             req.payload.logger.error({
                 err,

package/dist/utils/adapters/nextjs.js

@@ -1,6 +1,6 @@
 import fs from 'fs/promises';
 import path from 'path';
-import { collectSSGAssets, collectStaticAssets } from '../asset-collection.js';
+import { collectSSGAssets, collectStaticAssets, collectStaticMetadataAssets } from '../asset-collection.js';
 import { buildLambdaZip } from '../build-lambda-zip.js';
 import { resolveOutputPath } from '../deploy-output/resolveOutputPath.js';
 import { collectFilesRecursive } from '../fs-utils.js';
@@ -19,10 +19,7 @@ export class NextjsAdapter {
         } catch  {
         // No public directory
         }
-        const allKeys = [
-            ...staticAssets,
-            ...publicAssets
-        ];
+        const metadataAssets = await collectStaticMetadataAssets(projectPath, output);
         const pathMap = {};
         for (const key of staticAssets){
             pathMap[key] = path.relative(projectPath, path.join(outputPath, key.replace(/^_next\//, '')));
@@ -30,10 +27,14 @@ export class NextjsAdapter {
         for (const key of publicAssets){
             pathMap[key] = path.join('public', key);
         }
+        for (const key of metadataAssets.keys){
+            pathMap[key] = metadataAssets.pathMap[key];
+        }
+        const uploadKeys = Object.keys(pathMap);
         return {
             pathMap,
-            routes: allKeys.map((k)=>`/${k}`),
-            uploadKeys: allKeys
+            routes: uploadKeys.map((key)=>`/${key}`),
+            uploadKeys
         };
     }
     async collectPages(projectPath, output) {

package/dist/utils/asset-collection.d.ts

@@ -27,7 +27,7 @@ export type SSGAssets = {
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects three files:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
@@ -39,6 +39,14 @@ export type SSGAssets = {
  * @returns SSG asset keys and a pathMap for filesystem resolution
  */
 export declare function collectSSGAssets(projectPath: string, output?: string): Promise<SSGAssets>;
+/**
+ * Collect file-based Next.js metadata icons that were prerendered as static route handlers.
+ *
+ * Maps public asset keys such as `shop/icon1.png` to their raw
+ * `.next/server/app/shop/icon1.png.body` output.
+ * Documentation: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/app-icons
+ */
+export declare function collectStaticMetadataAssets(projectPath: string, output?: string): Promise<SSGAssets>;
 /**
  * Create Lambda deployment zip
  *

package/dist/utils/asset-collection.js

@@ -77,7 +77,7 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects three files:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
@@ -113,7 +113,13 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
         '.rsc',
         '.meta'
     ];
-    for (const routeKey of Object.keys(manifest.routes)){
+    for (const [routeKey, route] of Object.entries(manifest.routes)){
+        // Current manifests classify app pages explicitly. Older App Router manifests
+        // can be identified by their RSC data route. Other entries may be route handlers.
+        const isPageRoute = route.routeType === 'page' || route.routeType === undefined && typeof route.dataRoute === 'string' && route.dataRoute.endsWith('.rsc');
+        if (!isPageRoute) {
+            continue;
+        }
         // Strip leading slash for S3 key; handle root "/" → "index"
         const stripped = routeKey === '/' ? 'index' : routeKey.replace(/^\//, '');
         for (const ext of extensions){
@@ -127,6 +133,55 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
         pathMap
     };
 }
+/**
+ * Collect file-based Next.js metadata icons that were prerendered as static route handlers.
+ *
+ * Maps public asset keys such as `shop/icon1.png` to their raw
+ * `.next/server/app/shop/icon1.png.body` output.
+ * Documentation: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/app-icons
+ */ export async function collectStaticMetadataAssets(projectPath, output) {
+    const outputPath = resolveOutputPath(projectPath, 'nextjs', output);
+    const manifestPath = path.join(outputPath, 'prerender-manifest.json');
+    let manifest;
+    try {
+        const raw = await fs.readFile(manifestPath, 'utf-8');
+        manifest = JSON.parse(raw);
+    } catch  {
+        return {
+            keys: [],
+            pathMap: {}
+        };
+    }
+    if (!manifest.routes || typeof manifest.routes !== 'object') {
+        return {
+            keys: [],
+            pathMap: {}
+        };
+    }
+    const keys = [];
+    const pathMap = {};
+    for (const [routeKey, route] of Object.entries(manifest.routes)){
+        if (route.routeType !== 'route' || route.compute !== 'static' || route.response !== 'complete' || !isFileBasedMetadataIconRoute(routeKey)) {
+            continue;
+        }
+        const assetKey = routeKey.replace(/^\/+/, '');
+        const bodyPath = path.join(outputPath, 'server', 'app', `${assetKey}.body`);
+        try {
+            const bodyStat = await fs.stat(bodyPath);
+            if (!bodyStat.isFile()) {
+                continue;
+            }
+        } catch  {
+            continue;
+        }
+        keys.push(assetKey);
+        pathMap[assetKey] = path.relative(projectPath, bodyPath);
+    }
+    return {
+        keys,
+        pathMap
+    };
+}
 /**
  * Create Lambda deployment zip
  *
@@ -137,3 +192,10 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
  */ export async function createLambdaZip(projectPath) {
     await buildLambdaZip(projectPath);
 }
+function isFileBasedMetadataIconRoute(routeKey) {
+    const basename = path.posix.basename(routeKey);
+    if (routeKey === '/favicon.ico') {
+        return true;
+    }
+    return /^icon\d*(?:-[0-9a-z]{6})?\.(?:ico|jpe?g|png|svg)$/.test(basename) || /^apple-icon\d*(?:-[0-9a-z]{6})?\.(?:jpe?g|png)$/.test(basename);
+}

package/dist/utils/s3-upload.js

@@ -141,16 +141,19 @@ const INITIAL_RETRY_DELAY = 1000 // 1 second
                 const fsPath = pathMap?.[assetPath] ?? assetPath.replace(/^_next\//, '.next/');
                 const fullPath = path.join(projectPath, fsPath);
                 const signedUrl = assetUrls[assetPath];
-                await uploadFile(fullPath, signedUrl);
+                const contentType = MIME_TYPES[path.extname(assetPath).toLowerCase()];
+                await uploadFile(fullPath, signedUrl, contentType);
                 results.assetsUploaded++;
                 // Track bytes uploaded
                 const stats = await fs.stat(fullPath);
                 results.totalBytesUploaded += stats.size;
                 // Report progress
                 onProgress?.(results.assetsUploaded, assetPaths.length);
+                return undefined;
             } catch (error) {
                 results.assetsFailed++;
                 log.debug(`Failed to upload ${assetPath}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                return undefined;
             }
         }));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.6",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -47,6 +47,8 @@
     "open": "^10.2.0",
     "openapi-fetch": "0.15.0",
     "picocolors": "1.1.1",
+    "qs-esm": "^8.0.1",
+    "sanitize-filename": "^1.6.4",
     "skills": "1.4.4",
     "tar": "^7.5.13",
     "terminal-link": "^5.0.0",
@@ -75,7 +77,10 @@
   "peerDependencies": {
     "@payloadcms/plugin-cloud-storage": ">=4.0.0-canary.24 <4.0.0-internal",
     "@payloadcms/richtext-lexical": ">=4.0.0-canary.24 <4.0.0-internal",
-    "payload": ">=4.0.0-canary.24 <4.0.0-internal"
+    "@payloadcms/translations": ">=4.0.0-canary.24 <4.0.0-internal",
+    "@payloadcms/ui": ">=4.0.0-canary.24 <4.0.0-internal",
+    "payload": ">=4.0.0-canary.24 <4.0.0-internal",
+    "react": "^19.0.1 || ^19.1.2 || ^19.2.1"
   },
   "peerDependenciesMeta": {
     "@payloadcms/plugin-cloud-storage": {