@payloadcms/figma 0.1.0-alpha.5 → 0.1.0-alpha.7

package/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2025 Figma
+Copyright (c) 2026 Figma
 
 This source code is protected under international copyright law. All rights
 reserved and protected by the copyright holders.

package/dist/index.d.ts

@@ -4,3 +4,4 @@ export { figmaContentSystem } from './plugin/adapter.js';
 export type { FigmaContentSystemOptions } from './plugin/adapter.js';
 export { buildFigmaConfig } from './plugin/build-config.js';
 export type { FigmaConfig } from './plugin/build-config.js';
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/index.js

@@ -4,3 +4,5 @@ export { contentAPIAdapter } from './db-content-api/index.js';
 export { figmaContentSystem } from './plugin/adapter.js';
 // Export buildConfig wrapper and its config type
 export { buildFigmaConfig } from './plugin/build-config.js';
+// Export the Make permission predicate for slug-specific baseAccess overrides.
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/oauth/defaults.d.ts

@@ -1,7 +1,6 @@
 import type { CollectionConfig, EmailField, TextField } from 'payload';
 import type { VerifyFunction } from './types.js';
 export declare const DEFAULT_USER_INFO_COOKIE_NAME = "figma-user-info";
-export declare const FIGMA_OAUTH_CALLBACK_PATH = "/users/sso/login";
 export declare const defaultScope: string[];
 export declare const defaultUsernameField: TextField;
 export declare const defaultVerify: ({ collection, strategyName, userInfoCookieName, usernameField, }: {

package/dist/oauth/defaults.js

@@ -3,7 +3,6 @@ import { v4 as uuid } from 'uuid';
 import { hasUserTokenPropsChanged } from './utilities/hasUserTokenPropsChanged.js';
 import { isDuplicateKeyError } from './utilities/isDuplicateKeyError.js';
 export const DEFAULT_USER_INFO_COOKIE_NAME = 'figma-user-info';
-export const FIGMA_OAUTH_CALLBACK_PATH = '/users/sso/login';
 function getFigmaUserInfo(headers, cookieName) {
     try {
         const cookies = parseCookies(headers);

package/dist/oauth/endpoints/getLoginEndpoint.js

@@ -6,7 +6,6 @@ import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { establishSession } from '../utilities/establishSession.js';
 import { exchangeCodeForAccessToken } from '../utilities/exchangeCodeForAccessToken.js';
 import { extractOrigin } from '../utilities/extractOrigin.js';
-import { getAdminCollectionSlug } from '../utilities/getAdminCollectionSlug.js';
 import { buildCsrfCookieClearHeader, getOAuthCallbackPath, OAUTH_STATE_CSRF_COOKIE_NAME } from '../utilities/getAuthorizeURL.js';
 import { isAbsoluteURL } from '../utilities/isAbsoluteURL.js';
 export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug, pluginOptions, strategy })=>({
@@ -153,7 +152,6 @@ export const getLoginEndpoint = ({ collection, collectionOptions, endpointSlug,
                 const redirectUri = formatAdminURL({
                     apiRoute: config.routes?.api || '/api',
                     path: getOAuthCallbackPath({
-                        adminCollectionSlug: getAdminCollectionSlug(config),
                         collection,
                         endpointSlug
                     }),

package/dist/oauth/index.js

@@ -1,5 +1,5 @@
 import { fieldAffectsData } from 'payload/shared';
-import { defaultVerify, FIGMA_OAUTH_CALLBACK_PATH } from './defaults.js';
+import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
 import { getMetaEndpoint } from './endpoints/getMetaEndpoint.js';
@@ -50,7 +50,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 path: '@payloadcms/figma/client#DefaultLoginButton'
             };
         }
-        let callbackEndpoint;
         return {
             ...config,
             admin: {
@@ -156,13 +155,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                     pluginOptions,
                     strategy
                 });
-                const collectionCallbackPath = `/${existingCollection.slug}/${endpointSlug}/login`;
-                if (existingCollection.slug === adminCollectionSlug && FIGMA_OAUTH_CALLBACK_PATH !== collectionCallbackPath) {
-                    callbackEndpoint = {
-                        ...loginEndpoint,
-                        path: FIGMA_OAUTH_CALLBACK_PATH
-                    };
-                }
                 const authStrategy = {
                     name: `${existingCollection.slug}-${strategyName}`,
                     // Bind 'this' to ensure the authenticate function has the correct context
@@ -246,12 +238,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                         ]
                     }
                 };
-            }),
-            endpoints: [
-                ...config.endpoints ?? [],
-                ...callbackEndpoint ? [
-                    callbackEndpoint
-                ] : []
-            ]
+            })
         };
     };

package/dist/oauth/utilities/getAuthorizeURL.d.ts

@@ -45,9 +45,7 @@ export interface AuthorizeURLResult {
     csrfNonce: string;
     params: AuthorizeURLParams;
 }
-export declare const getOAuthCallbackPath: ({ adminCollectionSlug, collection, endpointSlug, }: {
-    adminCollectionSlug: string;
-} & Pick<Args, "collection" | "endpointSlug">) => `/${string}`;
+export declare const getOAuthCallbackPath: ({ collection, endpointSlug, }: Pick<Args, "collection" | "endpointSlug">) => `/${string}`;
 export declare const getAuthorizeURL: ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy, }: Args) => Promise<AuthorizeURLResult>;
 /**
  * Name of the HttpOnly cookie that carries the browser-bound CSRF nonce

package/dist/oauth/utilities/getAuthorizeURL.js

@@ -1,9 +1,8 @@
 import crypto from 'crypto';
 import * as QueryString from 'qs-esm';
 import { v4 as uuid } from 'uuid';
-import { defaultScope, FIGMA_OAUTH_CALLBACK_PATH } from '../defaults.js';
-import { getAdminCollectionSlug } from './getAdminCollectionSlug.js';
-export const getOAuthCallbackPath = ({ adminCollectionSlug, collection, endpointSlug })=>collection.slug === adminCollectionSlug ? FIGMA_OAUTH_CALLBACK_PATH : `/${collection.slug}/${endpointSlug}/login`;
+import { defaultScope } from '../defaults.js';
+export const getOAuthCallbackPath = ({ collection, endpointSlug })=>`/${collection.slug}/${endpointSlug}/login`;
 export const getAuthorizeURL = async ({ collection, collectionOptions, endpointSlug, existingCsrfNonce, failedRedirect, payload, pluginOptions, redirect, serverURLOverride, strategy })=>{
     const { redirectServerURL } = pluginOptions;
     await strategy.ensureMeta();
@@ -33,7 +32,6 @@ export const getAuthorizeURL = async ({ collection, collectionOptions, endpointS
     }
     const baseRedirectURL = redirectServerURL || payload.config.serverURL || state.serverURL;
     const loginRedirectURL = encodeURI(`${baseRedirectURL}${payload.config.routes?.api || '/api'}${getOAuthCallbackPath({
-        adminCollectionSlug: getAdminCollectionSlug(payload.config),
         collection,
         endpointSlug
     })}`);

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,4 @@
-import type { Config, SanitizedConfig } from 'payload';
+import type { Config, SanitizedConfig, UploadInstructionsAccess } from 'payload';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
  * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
@@ -48,7 +48,9 @@ export type FigmaConfig = {
     figma: {
         contentSystemId?: string;
         environmentId?: string;
-        storage?: boolean;
+        storage?: {
+            uploadInstructionsAccess?: UploadInstructionsAccess;
+        } | boolean;
         useContentSystem?: boolean;
     };
 } & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;

package/dist/plugin/build-config.js

@@ -22,6 +22,7 @@ import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { LIMIT_REACHED_VIEW_KEY, LIMIT_REACHED_VIEW_PATH } from './cloud-limits/routes.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+import { passesMakeViewerWriteGate, withMakeViewerWriteBaseAccessDefaults } from './make-permission-access/make-permission-access.js';
 import { createSandboxUploadFetchPlugin } from './sandbox-upload-fetch.js';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
@@ -170,23 +171,26 @@ function messageOf(error) {
 }
 /**
  * Creates storage configuration for upload collections
- */ function createStorageConfig(url, contentSystemId) {
-    const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
-        baseUrl: url,
-        contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
-    } : process.env.FIGMA_DEV_JWT === 'true' ? {
-        auth: {
-            mode: 'devJwt'
-        },
-        baseUrl: url,
-        contentSystemId
-    } : {
-        auth: {
-            mode: 'tokenStore',
-            tokenStore: getTokenStore()
+ */ function createStorageConfig(url, contentSystemId, uploadInstructionsAccess) {
+    const storageConfig = {
+        ...process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+            baseUrl: url,
+            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+        } : process.env.FIGMA_DEV_JWT === 'true' ? {
+            auth: {
+                mode: 'devJwt'
+            },
+            baseUrl: url,
+            contentSystemId
+        } : {
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            baseUrl: url,
+            contentSystemId
         },
-        baseUrl: url,
-        contentSystemId
+        uploadInstructionsAccess
     };
     const adapter = contentApiStorageAdapter(storageConfig);
     const storageClient = createStorageClient(storageConfig);
@@ -198,13 +202,13 @@ function messageOf(error) {
 /**
  * Plugin that applies cloud storage configuration to all upload-enabled collections.
  * Runs at the end of the plugin chain so it sees collections added by user plugins too.
- */ function createStoragePlugin(url, contentSystemId) {
+ */ function createStoragePlugin(url, contentSystemId, uploadInstructionsAccess) {
     return (incomingConfig)=>{
         const uploadCollections = (incomingConfig.collections || []).filter((c)=>c.upload);
         if (uploadCollections.length === 0) {
             return incomingConfig;
         }
-        const { adapter } = createStorageConfig(url, contentSystemId);
+        const { adapter } = createStorageConfig(url, contentSystemId, uploadInstructionsAccess);
         const collectionsMap = uploadCollections.reduce((acc, c)=>{
             acc[c.slug] = {
                 adapter,
@@ -338,9 +342,15 @@ export async function buildFigmaConfig(config) {
                 ]
             }
         },
+        // Payload applies this policy during sanitization, after user plugins and
+        // generated resources have registered their collections and globals.
+        baseAccess: withMakeViewerWriteBaseAccessDefaults(config.baseAccess),
         custom: {
             figma: {
                 ...config.figma,
+                ...typeof config.figma.storage === 'object' ? {
+                    storage: true
+                } : {},
                 contentSystemId,
                 environmentId
             }
@@ -358,8 +368,8 @@ export async function buildFigmaConfig(config) {
         },
         // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
         // sites-worker trust marker so Figma infra job runs never break, defer to the
-        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
-        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        // tenant's jobs.access.run if they set one, otherwise require an authenticated
+        // user who is not a known Make viewer.
         jobs: {
             ...config.jobs ?? {},
             access: {
@@ -371,7 +381,9 @@ export async function buildFigmaConfig(config) {
                     if (userJobsAccessRun) {
                         return userJobsAccessRun(args);
                     }
-                    return !!args.req.user;
+                    // Allow undefined Make permissions during rollout, but fail closed for empty,
+                    // explicit view, and other unrecognized values.
+                    return Boolean(args.req.user) && passesMakeViewerWriteGate(args.req.user);
                 }
             }
         },
@@ -385,7 +397,7 @@ export async function buildFigmaConfig(config) {
         plugins: [
             ...config.plugins ?? [],
             ...config.figma.storage !== false ? [
-                createStoragePlugin(url, contentSystemId)
+                createStoragePlugin(url, contentSystemId, typeof config.figma.storage === 'object' ? config.figma.storage.uploadInstructionsAccess : undefined)
             ] : [],
             oAuth2Plugin({
                 collections: [

package/dist/plugin/make-permission-access/make-permission-access.d.ts

@@ -0,0 +1,8 @@
+import type { Access, BaseAccess } from 'payload';
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */
+export declare function passesMakeViewerWriteGate(user: unknown): boolean;
+export declare const makeViewerWriteBaseAccess: Access;
+export declare function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess?: BaseAccess): BaseAccess;

package/dist/plugin/make-permission-access/make-permission-access.js

@@ -0,0 +1,24 @@
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */ export function passesMakeViewerWriteGate(user) {
+    const makePermission = user?.makePermission;
+    return makePermission === undefined || makePermission === null || makePermission === 'edit';
+}
+export const makeViewerWriteBaseAccess = ({ req })=>passesMakeViewerWriteGate(req.user);
+export function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess = {}) {
+    return {
+        ...existingBaseAccess,
+        collections: {
+            ...existingBaseAccess.collections,
+            create: existingBaseAccess.collections?.create ?? makeViewerWriteBaseAccess,
+            delete: existingBaseAccess.collections?.delete ?? makeViewerWriteBaseAccess,
+            unlock: existingBaseAccess.collections?.unlock ?? makeViewerWriteBaseAccess,
+            update: existingBaseAccess.collections?.update ?? makeViewerWriteBaseAccess
+        },
+        globals: {
+            ...existingBaseAccess.globals,
+            update: existingBaseAccess.globals?.update ?? makeViewerWriteBaseAccess
+        }
+    };
+}

package/dist/storage-content-api/client-uploads/generate.js

@@ -1,7 +1,8 @@
 import path from 'path';
 import { APIError, Forbidden } from 'payload';
+import { passesMakeViewerWriteGate } from '../../plugin/make-permission-access/make-permission-access.js';
 import { getSafeFilename } from '../utilities/index.js';
-const defaultAccess = ({ req })=>!!req.user;
+const defaultAccess = ({ req })=>Boolean(req.user) && passesMakeViewerWriteGate(req.user);
 /**
  * v4 client-upload entry point. Payload core calls this from
  * `POST /api/upload-instructions`; we sign a Content API upload URL and hand the

package/dist/storage-content-api/index.js

@@ -28,6 +28,7 @@ export function contentApiStorageAdapter(config) {
             uploadInstructions: {
                 enabled: true,
                 generate: getGenerateUploadInstructions({
+                    access: config.uploadInstructionsAccess,
                     client
                 }),
                 useInAdmin: true

package/dist/storage-content-api/types.d.ts

@@ -1,9 +1,12 @@
+import type { UploadInstructionsAccess } from 'payload';
 import type { AuthMode } from '../db-content-api/utilities/auth.js';
 export type StorageClientConfig = {
+    uploadInstructionsAccess?: UploadInstructionsAccess;
+} & ({
     auth: AuthMode;
     baseUrl: string;
     contentSystemId: string;
 } | {
     baseUrl: string;
     contentApiKey: string;
-};
+});

package/dist/utils/adapters/nextjs.js

@@ -1,6 +1,6 @@
 import fs from 'fs/promises';
 import path from 'path';
-import { collectSSGAssets, collectStaticAssets } from '../asset-collection.js';
+import { collectSSGAssets, collectStaticAssets, collectStaticMetadataAssets } from '../asset-collection.js';
 import { buildLambdaZip } from '../build-lambda-zip.js';
 import { resolveOutputPath } from '../deploy-output/resolveOutputPath.js';
 import { collectFilesRecursive } from '../fs-utils.js';
@@ -19,10 +19,7 @@ export class NextjsAdapter {
         } catch  {
         // No public directory
         }
-        const allKeys = [
-            ...staticAssets,
-            ...publicAssets
-        ];
+        const metadataAssets = await collectStaticMetadataAssets(projectPath, output);
         const pathMap = {};
         for (const key of staticAssets){
             pathMap[key] = path.relative(projectPath, path.join(outputPath, key.replace(/^_next\//, '')));
@@ -30,29 +27,25 @@ export class NextjsAdapter {
         for (const key of publicAssets){
             pathMap[key] = path.join('public', key);
         }
+        for (const key of metadataAssets.keys){
+            pathMap[key] = metadataAssets.pathMap[key];
+        }
+        const uploadKeys = Object.keys(pathMap);
         return {
             pathMap,
-            routes: allKeys.map((k)=>`/${k}`),
-            uploadKeys: allKeys
+            routes: uploadKeys.map((key)=>`/${key}`),
+            uploadKeys
         };
     }
     async collectPages(projectPath, output) {
         const ssg = await collectSSGAssets(projectPath, output);
-        // Build route → asset keys mapping and extract unique routes
-        const routeAssetMap = {};
-        for (const key of ssg.keys){
-            // Strip extension to get the base, then derive the route
-            const base = key.replace(/\.(?:html|rsc|meta)$/, '');
-            const route = base === 'index' ? '/' : `/${base}`;
-            if (!routeAssetMap[route]) {
-                routeAssetMap[route] = [];
-            }
-            routeAssetMap[route].push(key);
-        }
+        // collectSSGAssets records each key's manifest route while scanning the
+        // output, preserving the existing mapping for HTML/RSC/meta files while
+        // supporting segment keys whose nested names do not encode the page route.
         return {
             pathMap: ssg.pathMap,
-            routeAssetMap,
-            routes: Object.keys(routeAssetMap),
+            routeAssetMap: ssg.routeAssetMap,
+            routes: Object.keys(ssg.routeAssetMap),
             uploadKeys: ssg.keys
         };
     }

package/dist/utils/asset-collection.d.ts

@@ -23,14 +23,18 @@ export type SSGAssets = {
     keys: string[];
     /** Map of S3 key → relative filesystem path from project root */
     pathMap: Record<string, string>;
+    /** Map of page route → S3 keys generated for that page */
+    routeAssetMap: Record<string, string[]>;
 };
+type StaticMetadataAssets = Omit<SSGAssets, 'routeAssetMap'>;
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
+ * - Nested `.segment.rsc` files under {route}.segments (segment-prefetch payloads)
  *
  * S3 keys use the route path without leading slash.
  * Filesystem paths point to .next/server/app/{route}.{ext}
@@ -39,6 +43,14 @@ export type SSGAssets = {
  * @returns SSG asset keys and a pathMap for filesystem resolution
  */
 export declare function collectSSGAssets(projectPath: string, output?: string): Promise<SSGAssets>;
+/**
+ * Collect file-based Next.js metadata icons that were prerendered as static route handlers.
+ *
+ * Maps public asset keys such as `shop/icon1.png` to their raw
+ * `.next/server/app/shop/icon1.png.body` output.
+ * Documentation: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/app-icons
+ */
+export declare function collectStaticMetadataAssets(projectPath: string, output?: string): Promise<StaticMetadataAssets>;
 /**
  * Create Lambda deployment zip
  *
@@ -48,3 +60,4 @@ export declare function collectSSGAssets(projectPath: string, output?: string):
  * @throws Error if build missing or zip creation fails
  */
 export declare function createLambdaZip(projectPath: string): Promise<void>;
+export {};

package/dist/utils/asset-collection.js

@@ -77,10 +77,11 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
+ * - Nested `.segment.rsc` files under {route}.segments (segment-prefetch payloads)
  *
  * S3 keys use the route path without leading slash.
  * Filesystem paths point to .next/server/app/{route}.{ext}
@@ -97,30 +98,106 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
     } catch  {
         return {
             keys: [],
-            pathMap: {}
+            pathMap: {},
+            routeAssetMap: {}
         };
     }
     if (!manifest.routes || typeof manifest.routes !== 'object') {
         return {
             keys: [],
-            pathMap: {}
+            pathMap: {},
+            routeAssetMap: {}
         };
     }
     const keys = [];
     const pathMap = {};
+    const routeAssetMap = {};
     const extensions = [
         '.html',
         '.rsc',
         '.meta'
     ];
-    for (const routeKey of Object.keys(manifest.routes)){
+    const appDir = path.join(outputPath, 'server', 'app');
+    for (const [routeKey, route] of Object.entries(manifest.routes)){
+        // Current manifests classify app pages explicitly. Older App Router manifests
+        // can be identified by their RSC data route. Other entries may be route handlers.
+        const isPageRoute = route.routeType === 'page' || route.routeType === undefined && typeof route.dataRoute === 'string' && route.dataRoute.endsWith('.rsc');
+        if (!isPageRoute) {
+            continue;
+        }
         // Strip leading slash for S3 key; handle root "/" → "index"
         const stripped = routeKey === '/' ? 'index' : routeKey.replace(/^\//, '');
+        const routeAssets = [];
         for (const ext of extensions){
             const s3Key = `${stripped}${ext}`;
             keys.push(s3Key);
-            pathMap[s3Key] = path.relative(projectPath, path.join(outputPath, 'server', 'app', `${stripped}${ext}`));
+            routeAssets.push(s3Key);
+            pathMap[s3Key] = path.relative(projectPath, path.join(appDir, s3Key));
+        }
+        // Next.js stores segment-prefetch payloads beside each prerendered page in a
+        // `<page>.segments` tree. Scan the generated tree instead of reconstructing
+        // its opaque, potentially nested segment names from route information.
+        const segmentFiles = await collectFiles(path.join(appDir, `${stripped}.segments`), appDir);
+        for (const segmentFile of segmentFiles.filter((file)=>file.endsWith('.segment.rsc'))){
+            const s3Key = segmentFile.split(path.sep).join('/');
+            keys.push(s3Key);
+            routeAssets.push(s3Key);
+            pathMap[s3Key] = path.relative(projectPath, path.join(appDir, segmentFile));
         }
+        // Preserve the manifest route association for the original HTML/RSC/meta
+        // files and the new segment files; segment keys cannot be mapped back to a
+        // page reliably from their filename in NextjsAdapter.
+        routeAssetMap[routeKey] = routeAssets;
+    }
+    return {
+        keys,
+        pathMap,
+        routeAssetMap
+    };
+}
+/**
+ * Collect file-based Next.js metadata icons that were prerendered as static route handlers.
+ *
+ * Maps public asset keys such as `shop/icon1.png` to their raw
+ * `.next/server/app/shop/icon1.png.body` output.
+ * Documentation: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/app-icons
+ */ export async function collectStaticMetadataAssets(projectPath, output) {
+    const outputPath = resolveOutputPath(projectPath, 'nextjs', output);
+    const manifestPath = path.join(outputPath, 'prerender-manifest.json');
+    let manifest;
+    try {
+        const raw = await fs.readFile(manifestPath, 'utf-8');
+        manifest = JSON.parse(raw);
+    } catch  {
+        return {
+            keys: [],
+            pathMap: {}
+        };
+    }
+    if (!manifest.routes || typeof manifest.routes !== 'object') {
+        return {
+            keys: [],
+            pathMap: {}
+        };
+    }
+    const keys = [];
+    const pathMap = {};
+    for (const [routeKey, route] of Object.entries(manifest.routes)){
+        if (route.routeType !== 'route' || route.compute !== 'static' || route.response !== 'complete' || !isFileBasedMetadataIconRoute(routeKey)) {
+            continue;
+        }
+        const assetKey = routeKey.replace(/^\/+/, '');
+        const bodyPath = path.join(outputPath, 'server', 'app', `${assetKey}.body`);
+        try {
+            const bodyStat = await fs.stat(bodyPath);
+            if (!bodyStat.isFile()) {
+                continue;
+            }
+        } catch  {
+            continue;
+        }
+        keys.push(assetKey);
+        pathMap[assetKey] = path.relative(projectPath, bodyPath);
     }
     return {
         keys,
@@ -137,3 +214,10 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
  */ export async function createLambdaZip(projectPath) {
     await buildLambdaZip(projectPath);
 }
+function isFileBasedMetadataIconRoute(routeKey) {
+    const basename = path.posix.basename(routeKey);
+    if (routeKey === '/favicon.ico') {
+        return true;
+    }
+    return /^icon\d*(?:-[0-9a-z]{6})?\.(?:ico|jpe?g|png|svg)$/.test(basename) || /^apple-icon\d*(?:-[0-9a-z]{6})?\.(?:jpe?g|png)$/.test(basename);
+}

package/dist/utils/s3-upload.js

@@ -141,16 +141,19 @@ const INITIAL_RETRY_DELAY = 1000 // 1 second
                 const fsPath = pathMap?.[assetPath] ?? assetPath.replace(/^_next\//, '.next/');
                 const fullPath = path.join(projectPath, fsPath);
                 const signedUrl = assetUrls[assetPath];
-                await uploadFile(fullPath, signedUrl);
+                const contentType = MIME_TYPES[path.extname(assetPath).toLowerCase()];
+                await uploadFile(fullPath, signedUrl, contentType);
                 results.assetsUploaded++;
                 // Track bytes uploaded
                 const stats = await fs.stat(fullPath);
                 results.totalBytesUploaded += stats.size;
                 // Report progress
                 onProgress?.(results.assetsUploaded, assetPaths.length);
+                return undefined;
             } catch (error) {
                 results.assetsFailed++;
                 log.debug(`Failed to upload ${assetPath}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                return undefined;
             }
         }));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.7",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -47,6 +47,8 @@
     "open": "^10.2.0",
     "openapi-fetch": "0.15.0",
     "picocolors": "1.1.1",
+    "qs-esm": "^8.0.1",
+    "sanitize-filename": "^1.6.4",
     "skills": "1.4.4",
     "tar": "^7.5.13",
     "terminal-link": "^5.0.0",
@@ -56,7 +58,11 @@
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
     "@payloadcms/eslint-plugin": "3.28.0",
-    "@payloadcms/next": "4.0.0-canary.24",
+    "@payloadcms/next": "4.0.0-canary.28",
+    "@payloadcms/plugin-cloud-storage": "4.0.0-canary.28",
+    "@payloadcms/richtext-lexical": "4.0.0-canary.28",
+    "@payloadcms/translations": "4.0.0-canary.28",
+    "@payloadcms/ui": "4.0.0-canary.28",
     "@swc/cli": "0.7.7",
     "@types/archiver": "7.0.0",
     "@types/cross-spawn": "6.0.6",
@@ -67,15 +73,19 @@
     "eslint": "9.22.0",
     "next": "^16.2.6",
     "openapi-typescript": "^7.13.0",
+    "payload": "4.0.0-canary.28",
     "rimraf": "^6.1.3",
     "tsx": "4.20.6",
     "typescript": "5.7.3",
     "vitest": "4.0.15"
   },
   "peerDependencies": {
-    "@payloadcms/plugin-cloud-storage": ">=4.0.0-canary.24 <4.0.0-internal",
-    "@payloadcms/richtext-lexical": ">=4.0.0-canary.24 <4.0.0-internal",
-    "payload": ">=4.0.0-canary.24 <4.0.0-internal"
+    "@payloadcms/plugin-cloud-storage": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/richtext-lexical": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/translations": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/ui": ">=4.0.0-canary.28 <4.0.0-internal",
+    "payload": ">=4.0.0-canary.28 <4.0.0-internal",
+    "react": "^19.0.1 || ^19.1.2 || ^19.2.1"
   },
   "peerDependenciesMeta": {
     "@payloadcms/plugin-cloud-storage": {