@payloadcms/figma 0.1.0-alpha.6 → 0.1.0-alpha.7

package/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2025 Figma
+Copyright (c) 2026 Figma
 
 This source code is protected under international copyright law. All rights
 reserved and protected by the copyright holders.

package/dist/index.d.ts

@@ -4,3 +4,4 @@ export { figmaContentSystem } from './plugin/adapter.js';
 export type { FigmaContentSystemOptions } from './plugin/adapter.js';
 export { buildFigmaConfig } from './plugin/build-config.js';
 export type { FigmaConfig } from './plugin/build-config.js';
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/index.js

@@ -4,3 +4,5 @@ export { contentAPIAdapter } from './db-content-api/index.js';
 export { figmaContentSystem } from './plugin/adapter.js';
 // Export buildConfig wrapper and its config type
 export { buildFigmaConfig } from './plugin/build-config.js';
+// Export the Make permission predicate for slug-specific baseAccess overrides.
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,4 @@
-import type { Config, SanitizedConfig } from 'payload';
+import type { Config, SanitizedConfig, UploadInstructionsAccess } from 'payload';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
  * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
@@ -48,7 +48,9 @@ export type FigmaConfig = {
     figma: {
         contentSystemId?: string;
         environmentId?: string;
-        storage?: boolean;
+        storage?: {
+            uploadInstructionsAccess?: UploadInstructionsAccess;
+        } | boolean;
         useContentSystem?: boolean;
     };
 } & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;

package/dist/plugin/build-config.js

@@ -22,6 +22,7 @@ import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { LIMIT_REACHED_VIEW_KEY, LIMIT_REACHED_VIEW_PATH } from './cloud-limits/routes.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+import { passesMakeViewerWriteGate, withMakeViewerWriteBaseAccessDefaults } from './make-permission-access/make-permission-access.js';
 import { createSandboxUploadFetchPlugin } from './sandbox-upload-fetch.js';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
@@ -170,23 +171,26 @@ function messageOf(error) {
 }
 /**
  * Creates storage configuration for upload collections
- */ function createStorageConfig(url, contentSystemId) {
-    const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
-        baseUrl: url,
-        contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
-    } : process.env.FIGMA_DEV_JWT === 'true' ? {
-        auth: {
-            mode: 'devJwt'
-        },
-        baseUrl: url,
-        contentSystemId
-    } : {
-        auth: {
-            mode: 'tokenStore',
-            tokenStore: getTokenStore()
+ */ function createStorageConfig(url, contentSystemId, uploadInstructionsAccess) {
+    const storageConfig = {
+        ...process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+            baseUrl: url,
+            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+        } : process.env.FIGMA_DEV_JWT === 'true' ? {
+            auth: {
+                mode: 'devJwt'
+            },
+            baseUrl: url,
+            contentSystemId
+        } : {
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            baseUrl: url,
+            contentSystemId
         },
-        baseUrl: url,
-        contentSystemId
+        uploadInstructionsAccess
     };
     const adapter = contentApiStorageAdapter(storageConfig);
     const storageClient = createStorageClient(storageConfig);
@@ -198,13 +202,13 @@ function messageOf(error) {
 /**
  * Plugin that applies cloud storage configuration to all upload-enabled collections.
  * Runs at the end of the plugin chain so it sees collections added by user plugins too.
- */ function createStoragePlugin(url, contentSystemId) {
+ */ function createStoragePlugin(url, contentSystemId, uploadInstructionsAccess) {
     return (incomingConfig)=>{
         const uploadCollections = (incomingConfig.collections || []).filter((c)=>c.upload);
         if (uploadCollections.length === 0) {
             return incomingConfig;
         }
-        const { adapter } = createStorageConfig(url, contentSystemId);
+        const { adapter } = createStorageConfig(url, contentSystemId, uploadInstructionsAccess);
         const collectionsMap = uploadCollections.reduce((acc, c)=>{
             acc[c.slug] = {
                 adapter,
@@ -338,9 +342,15 @@ export async function buildFigmaConfig(config) {
                 ]
             }
         },
+        // Payload applies this policy during sanitization, after user plugins and
+        // generated resources have registered their collections and globals.
+        baseAccess: withMakeViewerWriteBaseAccessDefaults(config.baseAccess),
         custom: {
             figma: {
                 ...config.figma,
+                ...typeof config.figma.storage === 'object' ? {
+                    storage: true
+                } : {},
                 contentSystemId,
                 environmentId
             }
@@ -358,8 +368,8 @@ export async function buildFigmaConfig(config) {
         },
         // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
         // sites-worker trust marker so Figma infra job runs never break, defer to the
-        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
-        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        // tenant's jobs.access.run if they set one, otherwise require an authenticated
+        // user who is not a known Make viewer.
         jobs: {
             ...config.jobs ?? {},
             access: {
@@ -371,7 +381,9 @@ export async function buildFigmaConfig(config) {
                     if (userJobsAccessRun) {
                         return userJobsAccessRun(args);
                     }
-                    return !!args.req.user;
+                    // Allow undefined Make permissions during rollout, but fail closed for empty,
+                    // explicit view, and other unrecognized values.
+                    return Boolean(args.req.user) && passesMakeViewerWriteGate(args.req.user);
                 }
             }
         },
@@ -385,7 +397,7 @@ export async function buildFigmaConfig(config) {
         plugins: [
             ...config.plugins ?? [],
             ...config.figma.storage !== false ? [
-                createStoragePlugin(url, contentSystemId)
+                createStoragePlugin(url, contentSystemId, typeof config.figma.storage === 'object' ? config.figma.storage.uploadInstructionsAccess : undefined)
             ] : [],
             oAuth2Plugin({
                 collections: [

package/dist/plugin/make-permission-access/make-permission-access.d.ts

@@ -0,0 +1,8 @@
+import type { Access, BaseAccess } from 'payload';
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */
+export declare function passesMakeViewerWriteGate(user: unknown): boolean;
+export declare const makeViewerWriteBaseAccess: Access;
+export declare function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess?: BaseAccess): BaseAccess;

package/dist/plugin/make-permission-access/make-permission-access.js

@@ -0,0 +1,24 @@
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */ export function passesMakeViewerWriteGate(user) {
+    const makePermission = user?.makePermission;
+    return makePermission === undefined || makePermission === null || makePermission === 'edit';
+}
+export const makeViewerWriteBaseAccess = ({ req })=>passesMakeViewerWriteGate(req.user);
+export function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess = {}) {
+    return {
+        ...existingBaseAccess,
+        collections: {
+            ...existingBaseAccess.collections,
+            create: existingBaseAccess.collections?.create ?? makeViewerWriteBaseAccess,
+            delete: existingBaseAccess.collections?.delete ?? makeViewerWriteBaseAccess,
+            unlock: existingBaseAccess.collections?.unlock ?? makeViewerWriteBaseAccess,
+            update: existingBaseAccess.collections?.update ?? makeViewerWriteBaseAccess
+        },
+        globals: {
+            ...existingBaseAccess.globals,
+            update: existingBaseAccess.globals?.update ?? makeViewerWriteBaseAccess
+        }
+    };
+}

package/dist/storage-content-api/client-uploads/generate.js

@@ -1,7 +1,8 @@
 import path from 'path';
 import { APIError, Forbidden } from 'payload';
+import { passesMakeViewerWriteGate } from '../../plugin/make-permission-access/make-permission-access.js';
 import { getSafeFilename } from '../utilities/index.js';
-const defaultAccess = ({ req })=>!!req.user;
+const defaultAccess = ({ req })=>Boolean(req.user) && passesMakeViewerWriteGate(req.user);
 /**
  * v4 client-upload entry point. Payload core calls this from
  * `POST /api/upload-instructions`; we sign a Content API upload URL and hand the

package/dist/storage-content-api/index.js

@@ -28,6 +28,7 @@ export function contentApiStorageAdapter(config) {
             uploadInstructions: {
                 enabled: true,
                 generate: getGenerateUploadInstructions({
+                    access: config.uploadInstructionsAccess,
                     client
                 }),
                 useInAdmin: true

package/dist/storage-content-api/staticHandler.js

@@ -1,29 +1,7 @@
 import { getFilePrefix } from '@payloadcms/plugin-cloud-storage/utilities';
 import path from 'path';
 import { isImage } from 'payload/shared';
-import { buildClientUploadFetchBackHeaders } from './buildClientUploadFetchBackHeaders.js';
-import { buildMediaResponseHeaders } from './buildMediaResponseHeaders.js';
-import { hasSupportedContentEncoding } from './hasSupportedContentEncoding.js';
-import { mediaErrorResponse } from './mediaErrorResponse.js';
 import { parseUploadReference } from './utilities/index.js';
-const isRunningInLambda = ()=>process.env.AWS_EXECUTION_ENV?.startsWith('AWS_Lambda_') === true;
-const shouldReturnRedirect = ({ uploadReference })=>{
-    if (!isRunningInLambda()) {
-        return false;
-    }
-    if (!uploadReference) {
-        return true;
-    }
-    const { mimeType } = parseUploadReference(uploadReference);
-    return Boolean(mimeType && !isImage(mimeType));
-};
-const cancelResponseBody = async (response)=>{
-    try {
-        await response.body?.cancel();
-    } catch  {
-    // The response will not be consumed after an error; cancellation is best-effort cleanup.
-    }
-};
 export const getHandler = ({ client, collection })=>{
     return async (req, { params: { filename, uploadReference } })=>{
         try {
@@ -47,68 +25,29 @@ export const getHandler = ({ client, collection })=>{
                     status: 500
                 });
             }
-            // Lambda responses have a 6 MB limit, so deployed apps redirect to Gatekeeper, which
-            // validates the signed URL and streams the file. Other runtimes do not have Gatekeeper
-            // in front of them and must stream the file through Payload instead.
-            // An image uploadReference marks an internal, one-time fetch-back. Payload core consumes
-            // the body to size the image, so a redirect would leave it empty even in Lambda.
-            if (shouldReturnRedirect({
-                uploadReference
-            })) {
-                return Response.redirect(data.url, 302);
-            }
-            const requestHeaders = new Headers({
-                'Accept-Encoding': 'identity'
-            });
-            const range = req.headers.get('Range');
-            if (range) {
-                requestHeaders.set('Range', range);
-                const ifRange = req.headers.get('If-Range');
-                if (ifRange) {
-                    requestHeaders.set('If-Range', ifRange);
+            // On a client-upload fetch-back, core reads this response body into req.file.data to
+            // size the image; a 302's empty body crashes getImageSize. Return real bytes for
+            // images (and unknown mimetypes, to be safe), but keep the redirect otherwise so we
+            // don't download large non-images server-side.
+            if (uploadReference) {
+                const { mimeType } = parseUploadReference(uploadReference);
+                if (!mimeType || isImage(mimeType)) {
+                    const fileResponse = await fetch(data.url);
+                    if (!fileResponse.ok) {
+                        req.payload.logger.error(`Failed to fetch file for client-upload buffer fetch-back: ${fileResponse.status}`);
+                        return new Response('Internal Server Error', {
+                            status: 500
+                        });
+                    }
+                    const contentType = fileResponse.headers.get('Content-Type') ?? mimeType ?? 'application/octet-stream';
+                    return new Response(await fileResponse.arrayBuffer(), {
+                        headers: {
+                            'Content-Type': contentType
+                        }
+                    });
                 }
             }
-            let fileResponse;
-            try {
-                fileResponse = await fetch(data.url, {
-                    credentials: 'omit',
-                    headers: requestHeaders,
-                    redirect: 'manual',
-                    referrerPolicy: 'no-referrer',
-                    signal: req.signal
-                });
-            } catch  {
-                req.payload.logger.error('Failed to fetch file from storage');
-                return mediaErrorResponse(500, 'Internal Server Error');
-            }
-            if (fileResponse.status === 416 && range) {
-                await cancelResponseBody(fileResponse);
-                return mediaErrorResponse(416, 'Range Not Satisfiable', fileResponse.headers.get('Content-Range') ?? undefined);
-            }
-            if (!fileResponse.ok) {
-                await cancelResponseBody(fileResponse);
-                req.payload.logger.error(`Failed to fetch file from storage: ${fileResponse.status}`);
-                return mediaErrorResponse(500, 'Internal Server Error');
-            }
-            if (!hasSupportedContentEncoding(fileResponse.headers)) {
-                await cancelResponseBody(fileResponse);
-                req.payload.logger.error('Unsupported Content-Encoding from storage');
-                return mediaErrorResponse(502, 'Bad Gateway');
-            }
-            const clientUploadMimeType = uploadReference ? parseUploadReference(uploadReference).mimeType : undefined;
-            const responseHeaders = uploadReference ? buildClientUploadFetchBackHeaders({
-                fallbackContentType: clientUploadMimeType,
-                filename,
-                upstream: fileResponse.headers
-            }) : buildMediaResponseHeaders({
-                filename,
-                upstream: fileResponse.headers
-            });
-            return new Response(fileResponse.body, {
-                headers: responseHeaders,
-                status: fileResponse.status,
-                statusText: fileResponse.statusText
-            });
+            return Response.redirect(data.url, 302);
         } catch (err) {
             req.payload.logger.error({
                 err,

package/dist/storage-content-api/types.d.ts

@@ -1,9 +1,12 @@
+import type { UploadInstructionsAccess } from 'payload';
 import type { AuthMode } from '../db-content-api/utilities/auth.js';
 export type StorageClientConfig = {
+    uploadInstructionsAccess?: UploadInstructionsAccess;
+} & ({
     auth: AuthMode;
     baseUrl: string;
     contentSystemId: string;
 } | {
     baseUrl: string;
     contentApiKey: string;
-};
+});

package/dist/utils/adapters/nextjs.js

@@ -39,21 +39,13 @@ export class NextjsAdapter {
     }
     async collectPages(projectPath, output) {
         const ssg = await collectSSGAssets(projectPath, output);
-        // Build route → asset keys mapping and extract unique routes
-        const routeAssetMap = {};
-        for (const key of ssg.keys){
-            // Strip extension to get the base, then derive the route
-            const base = key.replace(/\.(?:html|rsc|meta)$/, '');
-            const route = base === 'index' ? '/' : `/${base}`;
-            if (!routeAssetMap[route]) {
-                routeAssetMap[route] = [];
-            }
-            routeAssetMap[route].push(key);
-        }
+        // collectSSGAssets records each key's manifest route while scanning the
+        // output, preserving the existing mapping for HTML/RSC/meta files while
+        // supporting segment keys whose nested names do not encode the page route.
         return {
             pathMap: ssg.pathMap,
-            routeAssetMap,
-            routes: Object.keys(routeAssetMap),
+            routeAssetMap: ssg.routeAssetMap,
+            routes: Object.keys(ssg.routeAssetMap),
             uploadKeys: ssg.keys
         };
     }

package/dist/utils/asset-collection.d.ts

@@ -23,14 +23,18 @@ export type SSGAssets = {
     keys: string[];
     /** Map of S3 key → relative filesystem path from project root */
     pathMap: Record<string, string>;
+    /** Map of page route → S3 keys generated for that page */
+    routeAssetMap: Record<string, string[]>;
 };
+type StaticMetadataAssets = Omit<SSGAssets, 'routeAssetMap'>;
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each page route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
+ * - Nested `.segment.rsc` files under {route}.segments (segment-prefetch payloads)
  *
  * S3 keys use the route path without leading slash.
  * Filesystem paths point to .next/server/app/{route}.{ext}
@@ -46,7 +50,7 @@ export declare function collectSSGAssets(projectPath: string, output?: string):
  * `.next/server/app/shop/icon1.png.body` output.
  * Documentation: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/app-icons
  */
-export declare function collectStaticMetadataAssets(projectPath: string, output?: string): Promise<SSGAssets>;
+export declare function collectStaticMetadataAssets(projectPath: string, output?: string): Promise<StaticMetadataAssets>;
 /**
  * Create Lambda deployment zip
  *
@@ -56,3 +60,4 @@ export declare function collectStaticMetadataAssets(projectPath: string, output?
  * @throws Error if build missing or zip creation fails
  */
 export declare function createLambdaZip(projectPath: string): Promise<void>;
+export {};

package/dist/utils/asset-collection.js

@@ -77,10 +77,11 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each page route in the manifest's `routes` object, collects three files:
+ * For each page route in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
+ * - Nested `.segment.rsc` files under {route}.segments (segment-prefetch payloads)
  *
  * S3 keys use the route path without leading slash.
  * Filesystem paths point to .next/server/app/{route}.{ext}
@@ -97,22 +98,26 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
     } catch  {
         return {
             keys: [],
-            pathMap: {}
+            pathMap: {},
+            routeAssetMap: {}
         };
     }
     if (!manifest.routes || typeof manifest.routes !== 'object') {
         return {
             keys: [],
-            pathMap: {}
+            pathMap: {},
+            routeAssetMap: {}
         };
     }
     const keys = [];
     const pathMap = {};
+    const routeAssetMap = {};
     const extensions = [
         '.html',
         '.rsc',
         '.meta'
     ];
+    const appDir = path.join(outputPath, 'server', 'app');
     for (const [routeKey, route] of Object.entries(manifest.routes)){
         // Current manifests classify app pages explicitly. Older App Router manifests
         // can be identified by their RSC data route. Other entries may be route handlers.
@@ -122,15 +127,32 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
         }
         // Strip leading slash for S3 key; handle root "/" → "index"
         const stripped = routeKey === '/' ? 'index' : routeKey.replace(/^\//, '');
+        const routeAssets = [];
         for (const ext of extensions){
             const s3Key = `${stripped}${ext}`;
             keys.push(s3Key);
-            pathMap[s3Key] = path.relative(projectPath, path.join(outputPath, 'server', 'app', `${stripped}${ext}`));
+            routeAssets.push(s3Key);
+            pathMap[s3Key] = path.relative(projectPath, path.join(appDir, s3Key));
         }
+        // Next.js stores segment-prefetch payloads beside each prerendered page in a
+        // `<page>.segments` tree. Scan the generated tree instead of reconstructing
+        // its opaque, potentially nested segment names from route information.
+        const segmentFiles = await collectFiles(path.join(appDir, `${stripped}.segments`), appDir);
+        for (const segmentFile of segmentFiles.filter((file)=>file.endsWith('.segment.rsc'))){
+            const s3Key = segmentFile.split(path.sep).join('/');
+            keys.push(s3Key);
+            routeAssets.push(s3Key);
+            pathMap[s3Key] = path.relative(projectPath, path.join(appDir, segmentFile));
+        }
+        // Preserve the manifest route association for the original HTML/RSC/meta
+        // files and the new segment files; segment keys cannot be mapped back to a
+        // page reliably from their filename in NextjsAdapter.
+        routeAssetMap[routeKey] = routeAssets;
     }
     return {
         keys,
-        pathMap
+        pathMap,
+        routeAssetMap
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.6",
+  "version": "0.1.0-alpha.7",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -58,7 +58,11 @@
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
     "@payloadcms/eslint-plugin": "3.28.0",
-    "@payloadcms/next": "4.0.0-canary.24",
+    "@payloadcms/next": "4.0.0-canary.28",
+    "@payloadcms/plugin-cloud-storage": "4.0.0-canary.28",
+    "@payloadcms/richtext-lexical": "4.0.0-canary.28",
+    "@payloadcms/translations": "4.0.0-canary.28",
+    "@payloadcms/ui": "4.0.0-canary.28",
     "@swc/cli": "0.7.7",
     "@types/archiver": "7.0.0",
     "@types/cross-spawn": "6.0.6",
@@ -69,17 +73,18 @@
     "eslint": "9.22.0",
     "next": "^16.2.6",
     "openapi-typescript": "^7.13.0",
+    "payload": "4.0.0-canary.28",
     "rimraf": "^6.1.3",
     "tsx": "4.20.6",
     "typescript": "5.7.3",
     "vitest": "4.0.15"
   },
   "peerDependencies": {
-    "@payloadcms/plugin-cloud-storage": ">=4.0.0-canary.24 <4.0.0-internal",
-    "@payloadcms/richtext-lexical": ">=4.0.0-canary.24 <4.0.0-internal",
-    "@payloadcms/translations": ">=4.0.0-canary.24 <4.0.0-internal",
-    "@payloadcms/ui": ">=4.0.0-canary.24 <4.0.0-internal",
-    "payload": ">=4.0.0-canary.24 <4.0.0-internal",
+    "@payloadcms/plugin-cloud-storage": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/richtext-lexical": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/translations": ">=4.0.0-canary.28 <4.0.0-internal",
+    "@payloadcms/ui": ">=4.0.0-canary.28 <4.0.0-internal",
+    "payload": ">=4.0.0-canary.28 <4.0.0-internal",
     "react": "^19.0.1 || ^19.1.2 || ^19.2.1"
   },
   "peerDependenciesMeta": {

package/dist/storage-content-api/buildBaseMediaResponseHeaders.d.ts

@@ -1 +0,0 @@
-export declare const buildBaseMediaResponseHeaders: () => Headers;

package/dist/storage-content-api/buildBaseMediaResponseHeaders.js

@@ -1,6 +0,0 @@
-export const buildBaseMediaResponseHeaders = ()=>new Headers({
-        'Accept-Ranges': 'bytes',
-        'Cache-Control': 'private, no-store',
-        Vary: 'Cookie',
-        'X-Content-Type-Options': 'nosniff'
-    });

package/dist/storage-content-api/buildClientUploadFetchBackHeaders.d.ts

@@ -1,10 +0,0 @@
-/**
- * Payload's server-side upload fetch-back uses the response Content-Type to decide whether to
- * inspect image dimensions. For an active image type such as SVG, omit the sanitized type so
- * Payload falls back to the original upload MIME type. Public file requests never use this helper.
- */
-export declare const buildClientUploadFetchBackHeaders: ({ fallbackContentType, filename, upstream, }: {
-    fallbackContentType?: string;
-    filename: string;
-    upstream: Headers;
-}) => Headers;

package/dist/storage-content-api/buildClientUploadFetchBackHeaders.js

@@ -1,21 +0,0 @@
-import { buildMediaResponseHeaders } from './buildMediaResponseHeaders.js';
-import { getInlineContentType } from './getInlineContentType.js';
-/**
- * Payload's server-side upload fetch-back uses the response Content-Type to decide whether to
- * inspect image dimensions. For an active image type such as SVG, omit the sanitized type so
- * Payload falls back to the original upload MIME type. Public file requests never use this helper.
- */ export const buildClientUploadFetchBackHeaders = ({ fallbackContentType, filename, upstream })=>{
-    const effectiveContentType = upstream.get('Content-Type') || fallbackContentType;
-    const upstreamWithFallback = new Headers(upstream);
-    if (effectiveContentType && !upstream.get('Content-Type')) {
-        upstreamWithFallback.set('Content-Type', effectiveContentType);
-    }
-    const headers = buildMediaResponseHeaders({
-        filename,
-        upstream: upstreamWithFallback
-    });
-    if (effectiveContentType && !getInlineContentType(effectiveContentType)) {
-        headers.delete('Content-Type');
-    }
-    return headers;
-};

package/dist/storage-content-api/buildMediaResponseHeaders.d.ts

@@ -1,4 +0,0 @@
-export declare const buildMediaResponseHeaders: ({ filename, upstream, }: {
-    filename: string;
-    upstream: Headers;
-}) => Headers;

package/dist/storage-content-api/buildMediaResponseHeaders.js

@@ -1,45 +0,0 @@
-import { buildBaseMediaResponseHeaders } from './buildBaseMediaResponseHeaders.js';
-import { getInlineContentType } from './getInlineContentType.js';
-const FORWARDED_MEDIA_RESPONSE_HEADERS = [
-    'Cache-Control',
-    'Content-Length',
-    'Content-Range',
-    'ETag',
-    'Last-Modified'
-];
-const ATTACHMENT_CSP = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'";
-export const buildMediaResponseHeaders = ({ filename, upstream })=>{
-    const headers = buildBaseMediaResponseHeaders();
-    for (const name of FORWARDED_MEDIA_RESPONSE_HEADERS){
-        const value = upstream.get(name);
-        if (value) {
-            headers.set(name, value);
-        }
-    }
-    const contentType = getInlineContentType(upstream.get('Content-Type'));
-    if (contentType) {
-        headers.set('Content-Type', contentType);
-    } else {
-        headers.set('Content-Type', 'application/octet-stream');
-        headers.set('Content-Disposition', attachmentDisposition(filename));
-        headers.set('Content-Security-Policy', ATTACHMENT_CSP);
-    }
-    return headers;
-};
-const attachmentDisposition = (filename)=>{
-    let decodedName;
-    try {
-        decodedName = decodeURIComponent(filename);
-    } catch  {
-        decodedName = 'download';
-    }
-    const sanitizedName = sanitizeFilename(decodedName);
-    const safeName = Array.from(sanitizedName).slice(0, 255).join('') || 'download';
-    const asciiName = safeName.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
-    const utf8Name = encodeURIComponent(safeName).replace(/[!'()*]/g, (character)=>`%${character.charCodeAt(0).toString(16).toUpperCase()}`);
-    return `attachment; filename="${asciiName}"; filename*=UTF-8''${utf8Name}`;
-};
-const sanitizeFilename = (filename)=>Array.from(filename, (character)=>{
-        const codePoint = character.codePointAt(0);
-        return codePoint < 32 || codePoint === 127 || character === '/' || character === '\\' ? '_' : character;
-    }).join('');

package/dist/storage-content-api/getInlineContentType.d.ts

@@ -1 +0,0 @@
-export declare const getInlineContentType: (value: null | string | undefined) => string | null;

package/dist/storage-content-api/getInlineContentType.js

@@ -1,33 +0,0 @@
-// Keep this allowlist aligned with Gatekeeper's presignedMediaHeaders.ts. The plugin cannot
-// import the private Gatekeeper service, but both same-origin media proxies need the same policy.
-const INLINE_CONTENT_TYPES = new Set([
-    'application/font-woff',
-    'audio/aac',
-    'audio/flac',
-    'audio/mp4',
-    'audio/mpeg',
-    'audio/ogg',
-    'audio/wav',
-    'audio/webm',
-    'font/otf',
-    'font/ttf',
-    'font/woff',
-    'font/woff2',
-    'image/avif',
-    'image/bmp',
-    'image/gif',
-    'image/jpeg',
-    'image/png',
-    'image/vnd.microsoft.icon',
-    'image/webp',
-    'image/x-icon',
-    'video/mp4',
-    'video/mpeg',
-    'video/ogg',
-    'video/quicktime',
-    'video/webm'
-]);
-export const getInlineContentType = (value)=>{
-    const normalized = value?.split(';', 1).at(0)?.trim().toLowerCase();
-    return normalized && INLINE_CONTENT_TYPES.has(normalized) ? normalized : null;
-};

package/dist/storage-content-api/hasSupportedContentEncoding.d.ts

@@ -1 +0,0 @@
-export declare const hasSupportedContentEncoding: (headers: Headers) => boolean;

package/dist/storage-content-api/hasSupportedContentEncoding.js

@@ -1,4 +0,0 @@
-export const hasSupportedContentEncoding = (headers)=>{
-    const contentEncoding = headers.get('content-encoding')?.trim().toLowerCase();
-    return contentEncoding == null || contentEncoding === '' || contentEncoding === 'identity';
-};

package/dist/storage-content-api/mediaErrorResponse.d.ts

@@ -1 +0,0 @@
-export declare const mediaErrorResponse: (status: number, body: string, contentRange?: string) => Response;

package/dist/storage-content-api/mediaErrorResponse.js

@@ -1,12 +0,0 @@
-import { buildBaseMediaResponseHeaders } from './buildBaseMediaResponseHeaders.js';
-export const mediaErrorResponse = (status, body, contentRange)=>{
-    const headers = buildBaseMediaResponseHeaders();
-    headers.set('Content-Type', 'text/plain;charset=UTF-8');
-    if (contentRange) {
-        headers.set('Content-Range', contentRange);
-    }
-    return new Response(body, {
-        headers,
-        status
-    });
-};