@payloadcms/figma 0.1.0-alpha.6 → 0.1.0-alpha.8

package/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2025 Figma
+Copyright (c) 2026 Figma
 
 This source code is protected under international copyright law. All rights
 reserved and protected by the copyright holders.

package/dist/index.d.ts

@@ -4,3 +4,4 @@ export { figmaContentSystem } from './plugin/adapter.js';
 export type { FigmaContentSystemOptions } from './plugin/adapter.js';
 export { buildFigmaConfig } from './plugin/build-config.js';
 export type { FigmaConfig } from './plugin/build-config.js';
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/index.js

@@ -4,3 +4,5 @@ export { contentAPIAdapter } from './db-content-api/index.js';
 export { figmaContentSystem } from './plugin/adapter.js';
 // Export buildConfig wrapper and its config type
 export { buildFigmaConfig } from './plugin/build-config.js';
+// Export the Make permission predicate for slug-specific baseAccess overrides.
+export { passesMakeViewerWriteGate } from './plugin/make-permission-access/make-permission-access.js';

package/dist/oauth/components/LoginButton/index.js

@@ -6,6 +6,17 @@ import { getSearchParam } from '../../utils/getSearchParam.js';
 import { resolveParentTargetOrigin, setupIframeAutoLogin } from './iframeAutoLogin.js';
 import './index.scss';
 const baseClass = 'oauth-login';
+const COLLECTION_SKELETON_KEYS = [
+    'collection-1',
+    'collection-2',
+    'collection-3',
+    'collection-4'
+];
+const GLOBAL_SKELETON_KEYS = [
+    'global-1',
+    'global-2',
+    'global-3'
+];
 // Max time we wait for the parent (figma.com) to respond with a code after
 // posting `mint-cms-oauth-code`. If we hit this without a reply, we assume
 // the parent isn't going to respond and fall back to the manual login button.
@@ -49,6 +60,57 @@ const FigmaIcon = ()=>/*#__PURE__*/ _jsx("svg", {
             fillRule: "evenodd"
         })
     });
+const PayloadAdminLoadingShimmer = ()=>/*#__PURE__*/ _jsx("div", {
+        "aria-label": "Signing in",
+        "aria-live": "polite",
+        className: `${baseClass}__admin-shimmer`,
+        role: "status",
+        children: /*#__PURE__*/ _jsxs("div", {
+            "aria-hidden": "true",
+            className: `${baseClass}__admin-shimmer-main`,
+            children: [
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-heading-row`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-heading-icon`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-heading-label`
+                        })
+                    ]
+                }),
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-section`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-section-label`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-card-grid`,
+                            children: COLLECTION_SKELETON_KEYS.map((key)=>/*#__PURE__*/ _jsx("div", {
+                                    className: `${baseClass}__shimmer-block ${baseClass}__shimmer-card`
+                                }, key))
+                        })
+                    ]
+                }),
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-section`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-section-label`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-card-grid`,
+                            children: GLOBAL_SKELETON_KEYS.map((key)=>/*#__PURE__*/ _jsx("div", {
+                                    className: `${baseClass}__shimmer-block ${baseClass}__shimmer-card`
+                                }, key))
+                        })
+                    ]
+                })
+            ]
+        })
+    });
 export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
     const { config: { admin: { user: userSlug }, routes: { api }, serverURL } } = useConfig();
     const [authorizeURL, setAuthorizeURL] = useState('');
@@ -150,26 +212,11 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
         endpointSlug
     ]);
     if (!shouldRenderButton) {
-        // In the iframe auto-login window, show a "Signing in…" hint so the
-        // user sees something is happening instead of a blank slot until the
-        // flow either navigates them away or times out into the manual button.
+        // In the iframe auto-login window, show a Payload admin-shaped shimmer
+        // until the flow either navigates them away or times out into the manual
+        // button.
         if (isInIframe === true && !disabled) {
-            return /*#__PURE__*/ _jsx("div", {
-                className: baseClass,
-                children: /*#__PURE__*/ _jsxs("div", {
-                    className: `${baseClass}__signing-in`,
-                    role: "status",
-                    children: [
-                        /*#__PURE__*/ _jsx("span", {
-                            children: "Signing in"
-                        }),
-                        /*#__PURE__*/ _jsx("div", {
-                            "aria-hidden": "true",
-                            className: `${baseClass}__spinner`
-                        })
-                    ]
-                })
-            });
+            return /*#__PURE__*/ _jsx(PayloadAdminLoadingShimmer, {});
         }
         return null;
     }

package/dist/oauth/components/LoginButton/index.scss

@@ -1,3 +1,10 @@
+.oauth-login,
+.oauth-login__admin-shimmer {
+  --oauth-login-shimmer-bg: var(--theme-bg, var(--theme-elevation-0, #ffffff));
+  --oauth-login-shimmer-block: var(--theme-elevation-100, #efefef);
+  --oauth-login-shimmer-highlight: var(--theme-elevation-200, #f7f7f7);
+}
+
 .oauth-login {
   display: flex;
   justify-content: center;
@@ -55,28 +62,127 @@
       Oxygen, Ubuntu, Cantarell, sans-serif;
   }
 
-  &__signing-in {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: 0.75rem;
-    font-size: 1rem;
+  &__admin-shimmer {
+    position: fixed;
+    inset: 0;
+    z-index: 1000;
+    overflow: hidden;
+    background: var(--oauth-login-shimmer-bg);
     font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto,
       Oxygen, Ubuntu, Cantarell, sans-serif;
   }
 
-  &__spinner {
-    width: 24px;
-    height: 24px;
-    border: 2px solid var(--theme-elevation-200, #e5e5e5);
-    border-top-color: currentColor;
-    border-radius: 50%;
-    animation: oauth-login-spin 0.8s linear infinite;
+  &__admin-shimmer-main {
+    padding: 2rem 2.5rem;
+  }
+
+  &__shimmer-block {
+    position: relative;
+    overflow: hidden;
+    border-radius: 0.25rem;
+    background-color: var(--oauth-login-shimmer-block);
+  }
+
+  &__shimmer-block::after {
+    content: '';
+    position: absolute;
+    inset: 0;
+    border-radius: inherit;
+    background-image: linear-gradient(
+      100deg,
+      transparent 0%,
+      transparent 35%,
+      var(--oauth-login-shimmer-highlight) 50%,
+      transparent 65%,
+      transparent 100%
+    );
+    pointer-events: none;
+    transform: translateX(-100%);
+    animation: oauth-login-shimmer 1.45s linear infinite;
+  }
+
+  &__shimmer-heading-row {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    height: 1.75rem;
+    margin-bottom: 1rem;
+  }
+
+  &__shimmer-heading-icon {
+    width: 1.5rem;
+    height: 1.5rem;
+  }
+
+  &__shimmer-heading-label {
+    width: 7.5rem;
+    height: 1.25rem;
+  }
+
+  &__shimmer-section {
+    margin-bottom: 1.5rem;
+  }
+
+  &__shimmer-section-label {
+    width: 7.5rem;
+    height: 1.25rem;
+    margin-bottom: 0.5rem;
+  }
+
+  &__shimmer-card-grid {
+    display: grid;
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+    gap: 1rem;
+    max-width: 51.625rem;
+  }
+
+  &__shimmer-card {
+    height: 4rem;
+  }
+}
+
+@media (prefers-color-scheme: dark) {
+  .oauth-login,
+  .oauth-login__admin-shimmer {
+    --oauth-login-shimmer-bg: var(--theme-bg, var(--theme-elevation-0, #2b2b2b));
+    --oauth-login-shimmer-block: var(--theme-elevation-100, #383838);
+    --oauth-login-shimmer-highlight: var(--theme-elevation-200, #444444);
+  }
+}
+
+@media (max-width: 48rem) {
+  .oauth-login {
+    &__shimmer-card-grid {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
   }
 }
 
-@keyframes oauth-login-spin {
+@media (max-width: 30rem) {
+  .oauth-login {
+    &__admin-shimmer-main {
+      padding-right: 0.75rem;
+      padding-left: 0.75rem;
+    }
+
+    &__shimmer-card-grid {
+      grid-template-columns: 1fr;
+    }
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .oauth-login__shimmer-block::after {
+    animation: none;
+  }
+}
+
+@keyframes oauth-login-shimmer {
+  from {
+    transform: translateX(-100%);
+  }
+
   to {
-    transform: rotate(360deg);
+    transform: translateX(100%);
   }
 }

package/dist/plugin/build-config.d.ts

@@ -1,4 +1,4 @@
-import type { Config, SanitizedConfig } from 'payload';
+import type { Config, SanitizedConfig, UploadInstructionsAccess } from 'payload';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
  * X-Figma-Job-Queues-Auth-Bypass secret on a Payload jobs endpoint. The default
@@ -48,7 +48,9 @@ export type FigmaConfig = {
     figma: {
         contentSystemId?: string;
         environmentId?: string;
-        storage?: boolean;
+        storage?: {
+            uploadInstructionsAccess?: UploadInstructionsAccess;
+        } | boolean;
         useContentSystem?: boolean;
     };
 } & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;

package/dist/plugin/build-config.js

@@ -22,6 +22,7 @@ import { logMissingCliAuth } from './auth-preflight.js';
 import { logMissingContentSystemId } from './bootstrap-preflight.js';
 import { LIMIT_REACHED_VIEW_KEY, LIMIT_REACHED_VIEW_PATH } from './cloud-limits/routes.js';
 import { getDevCookieNames } from './dev-cookie-names.js';
+import { passesMakeViewerWriteGate, withMakeViewerWriteBaseAccessDefaults } from './make-permission-access/make-permission-access.js';
 import { createSandboxUploadFetchPlugin } from './sandbox-upload-fetch.js';
 /**
  * Worker-trusted marker injected by Figma's sites-worker after it validates the
@@ -170,23 +171,26 @@ function messageOf(error) {
 }
 /**
  * Creates storage configuration for upload collections
- */ function createStorageConfig(url, contentSystemId) {
-    const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
-        baseUrl: url,
-        contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
-    } : process.env.FIGMA_DEV_JWT === 'true' ? {
-        auth: {
-            mode: 'devJwt'
-        },
-        baseUrl: url,
-        contentSystemId
-    } : {
-        auth: {
-            mode: 'tokenStore',
-            tokenStore: getTokenStore()
+ */ function createStorageConfig(url, contentSystemId, uploadInstructionsAccess) {
+    const storageConfig = {
+        ...process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+            baseUrl: url,
+            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+        } : process.env.FIGMA_DEV_JWT === 'true' ? {
+            auth: {
+                mode: 'devJwt'
+            },
+            baseUrl: url,
+            contentSystemId
+        } : {
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            baseUrl: url,
+            contentSystemId
         },
-        baseUrl: url,
-        contentSystemId
+        uploadInstructionsAccess
     };
     const adapter = contentApiStorageAdapter(storageConfig);
     const storageClient = createStorageClient(storageConfig);
@@ -198,13 +202,13 @@ function messageOf(error) {
 /**
  * Plugin that applies cloud storage configuration to all upload-enabled collections.
  * Runs at the end of the plugin chain so it sees collections added by user plugins too.
- */ function createStoragePlugin(url, contentSystemId) {
+ */ function createStoragePlugin(url, contentSystemId, uploadInstructionsAccess) {
     return (incomingConfig)=>{
         const uploadCollections = (incomingConfig.collections || []).filter((c)=>c.upload);
         if (uploadCollections.length === 0) {
             return incomingConfig;
         }
-        const { adapter } = createStorageConfig(url, contentSystemId);
+        const { adapter } = createStorageConfig(url, contentSystemId, uploadInstructionsAccess);
         const collectionsMap = uploadCollections.reduce((acc, c)=>{
             acc[c.slug] = {
                 adapter,
@@ -338,9 +342,15 @@ export async function buildFigmaConfig(config) {
                 ]
             }
         },
+        // Payload applies this policy during sanitization, after user plugins and
+        // generated resources have registered their collections and globals.
+        baseAccess: withMakeViewerWriteBaseAccessDefaults(config.baseAccess),
         custom: {
             figma: {
                 ...config.figma,
+                ...typeof config.figma.storage === 'object' ? {
+                    storage: true
+                } : {},
                 contentSystemId,
                 environmentId
             }
@@ -358,8 +368,8 @@ export async function buildFigmaConfig(config) {
         },
         // Gate /api/payload-jobs/run and /api/payload-jobs/handle-schedules. Honor the
         // sites-worker trust marker so Figma infra job runs never break, defer to the
-        // tenant's jobs.access.run if they set one, otherwise fall back to Payload's
-        // "logged-in user" default so the admin "Run jobs" UI keeps working.
+        // tenant's jobs.access.run if they set one, otherwise require an authenticated
+        // user who is not a known Make viewer.
         jobs: {
             ...config.jobs ?? {},
             access: {
@@ -371,7 +381,9 @@ export async function buildFigmaConfig(config) {
                     if (userJobsAccessRun) {
                         return userJobsAccessRun(args);
                     }
-                    return !!args.req.user;
+                    // Allow undefined Make permissions during rollout, but fail closed for empty,
+                    // explicit view, and other unrecognized values.
+                    return Boolean(args.req.user) && passesMakeViewerWriteGate(args.req.user);
                 }
             }
         },
@@ -385,7 +397,7 @@ export async function buildFigmaConfig(config) {
         plugins: [
             ...config.plugins ?? [],
             ...config.figma.storage !== false ? [
-                createStoragePlugin(url, contentSystemId)
+                createStoragePlugin(url, contentSystemId, typeof config.figma.storage === 'object' ? config.figma.storage.uploadInstructionsAccess : undefined)
             ] : [],
             oAuth2Plugin({
                 collections: [

package/dist/plugin/make-permission-access/make-permission-access.d.ts

@@ -0,0 +1,8 @@
+import type { Access, BaseAccess } from 'payload';
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */
+export declare function passesMakeViewerWriteGate(user: unknown): boolean;
+export declare const makeViewerWriteBaseAccess: Access;
+export declare function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess?: BaseAccess): BaseAccess;

package/dist/plugin/make-permission-access/make-permission-access.js

@@ -0,0 +1,24 @@
+/**
+ * we will still let a user edit if makePermission is null or undefined, because we are
+ * specifically restricting users for a figma cloud project backed by make
+ */ export function passesMakeViewerWriteGate(user) {
+    const makePermission = user?.makePermission;
+    return makePermission === undefined || makePermission === null || makePermission === 'edit';
+}
+export const makeViewerWriteBaseAccess = ({ req })=>passesMakeViewerWriteGate(req.user);
+export function withMakeViewerWriteBaseAccessDefaults(existingBaseAccess = {}) {
+    return {
+        ...existingBaseAccess,
+        collections: {
+            ...existingBaseAccess.collections,
+            create: existingBaseAccess.collections?.create ?? makeViewerWriteBaseAccess,
+            delete: existingBaseAccess.collections?.delete ?? makeViewerWriteBaseAccess,
+            unlock: existingBaseAccess.collections?.unlock ?? makeViewerWriteBaseAccess,
+            update: existingBaseAccess.collections?.update ?? makeViewerWriteBaseAccess
+        },
+        globals: {
+            ...existingBaseAccess.globals,
+            update: existingBaseAccess.globals?.update ?? makeViewerWriteBaseAccess
+        }
+    };
+}

package/dist/storage-content-api/client-uploads/generate.js

@@ -1,7 +1,8 @@
 import path from 'path';
 import { APIError, Forbidden } from 'payload';
+import { passesMakeViewerWriteGate } from '../../plugin/make-permission-access/make-permission-access.js';
 import { getSafeFilename } from '../utilities/index.js';
-const defaultAccess = ({ req })=>!!req.user;
+const defaultAccess = ({ req })=>Boolean(req.user) && passesMakeViewerWriteGate(req.user);
 /**
  * v4 client-upload entry point. Payload core calls this from
  * `POST /api/upload-instructions`; we sign a Content API upload URL and hand the

package/dist/storage-content-api/index.js

@@ -28,6 +28,7 @@ export function contentApiStorageAdapter(config) {
             uploadInstructions: {
                 enabled: true,
                 generate: getGenerateUploadInstructions({
+                    access: config.uploadInstructionsAccess,
                     client
                 }),
                 useInAdmin: true

package/dist/storage-content-api/staticHandler.js

@@ -1,29 +1,7 @@
 import { getFilePrefix } from '@payloadcms/plugin-cloud-storage/utilities';
 import path from 'path';
 import { isImage } from 'payload/shared';
-import { buildClientUploadFetchBackHeaders } from './buildClientUploadFetchBackHeaders.js';
-import { buildMediaResponseHeaders } from './buildMediaResponseHeaders.js';
-import { hasSupportedContentEncoding } from './hasSupportedContentEncoding.js';
-import { mediaErrorResponse } from './mediaErrorResponse.js';
 import { parseUploadReference } from './utilities/index.js';
-const isRunningInLambda = ()=>process.env.AWS_EXECUTION_ENV?.startsWith('AWS_Lambda_') === true;
-const shouldReturnRedirect = ({ uploadReference })=>{
-    if (!isRunningInLambda()) {
-        return false;
-    }
-    if (!uploadReference) {
-        return true;
-    }
-    const { mimeType } = parseUploadReference(uploadReference);
-    return Boolean(mimeType && !isImage(mimeType));
-};
-const cancelResponseBody = async (response)=>{
-    try {
-        await response.body?.cancel();
-    } catch  {
-    // The response will not be consumed after an error; cancellation is best-effort cleanup.
-    }
-};
 export const getHandler = ({ client, collection })=>{
     return async (req, { params: { filename, uploadReference } })=>{
         try {
@@ -47,68 +25,29 @@ export const getHandler = ({ client, collection })=>{
                     status: 500
                 });
             }
-            // Lambda responses have a 6 MB limit, so deployed apps redirect to Gatekeeper, which
-            // validates the signed URL and streams the file. Other runtimes do not have Gatekeeper
-            // in front of them and must stream the file through Payload instead.
-            // An image uploadReference marks an internal, one-time fetch-back. Payload core consumes
-            // the body to size the image, so a redirect would leave it empty even in Lambda.
-            if (shouldReturnRedirect({
-                uploadReference
-            })) {
-                return Response.redirect(data.url, 302);
-            }
-            const requestHeaders = new Headers({
-                'Accept-Encoding': 'identity'
-            });
-            const range = req.headers.get('Range');
-            if (range) {
-                requestHeaders.set('Range', range);
-                const ifRange = req.headers.get('If-Range');
-                if (ifRange) {
-                    requestHeaders.set('If-Range', ifRange);
+            // On a client-upload fetch-back, core reads this response body into req.file.data to
+            // size the image; a 302's empty body crashes getImageSize. Return real bytes for
+            // images (and unknown mimetypes, to be safe), but keep the redirect otherwise so we
+            // don't download large non-images server-side.
+            if (uploadReference) {
+                const { mimeType } = parseUploadReference(uploadReference);
+                if (!mimeType || isImage(mimeType)) {
+                    const fileResponse = await fetch(data.url);
+                    if (!fileResponse.ok) {
+                        req.payload.logger.error(`Failed to fetch file for client-upload buffer fetch-back: ${fileResponse.status}`);
+                        return new Response('Internal Server Error', {
+                            status: 500
+                        });
+                    }
+                    const contentType = fileResponse.headers.get('Content-Type') ?? mimeType ?? 'application/octet-stream';
+                    return new Response(await fileResponse.arrayBuffer(), {
+                        headers: {
+                            'Content-Type': contentType
+                        }
+                    });
                 }
             }
-            let fileResponse;
-            try {
-                fileResponse = await fetch(data.url, {
-                    credentials: 'omit',
-                    headers: requestHeaders,
-                    redirect: 'manual',
-                    referrerPolicy: 'no-referrer',
-                    signal: req.signal
-                });
-            } catch  {
-                req.payload.logger.error('Failed to fetch file from storage');
-                return mediaErrorResponse(500, 'Internal Server Error');
-            }
-            if (fileResponse.status === 416 && range) {
-                await cancelResponseBody(fileResponse);
-                return mediaErrorResponse(416, 'Range Not Satisfiable', fileResponse.headers.get('Content-Range') ?? undefined);
-            }
-            if (!fileResponse.ok) {
-                await cancelResponseBody(fileResponse);
-                req.payload.logger.error(`Failed to fetch file from storage: ${fileResponse.status}`);
-                return mediaErrorResponse(500, 'Internal Server Error');
-            }
-            if (!hasSupportedContentEncoding(fileResponse.headers)) {
-                await cancelResponseBody(fileResponse);
-                req.payload.logger.error('Unsupported Content-Encoding from storage');
-                return mediaErrorResponse(502, 'Bad Gateway');
-            }
-            const clientUploadMimeType = uploadReference ? parseUploadReference(uploadReference).mimeType : undefined;
-            const responseHeaders = uploadReference ? buildClientUploadFetchBackHeaders({
-                fallbackContentType: clientUploadMimeType,
-                filename,
-                upstream: fileResponse.headers
-            }) : buildMediaResponseHeaders({
-                filename,
-                upstream: fileResponse.headers
-            });
-            return new Response(fileResponse.body, {
-                headers: responseHeaders,
-                status: fileResponse.status,
-                statusText: fileResponse.statusText
-            });
+            return Response.redirect(data.url, 302);
         } catch (err) {
             req.payload.logger.error({
                 err,

package/dist/storage-content-api/types.d.ts

@@ -1,9 +1,12 @@
+import type { UploadInstructionsAccess } from 'payload';
 import type { AuthMode } from '../db-content-api/utilities/auth.js';
 export type StorageClientConfig = {
+    uploadInstructionsAccess?: UploadInstructionsAccess;
+} & ({
     auth: AuthMode;
     baseUrl: string;
     contentSystemId: string;
 } | {
     baseUrl: string;
     contentApiKey: string;
-};
+});

package/dist/utils/adapters/nextjs.js

@@ -39,21 +39,13 @@ export class NextjsAdapter {
     }
     async collectPages(projectPath, output) {
         const ssg = await collectSSGAssets(projectPath, output);
-        // Build route → asset keys mapping and extract unique routes
-        const routeAssetMap = {};
-        for (const key of ssg.keys){
-            // Strip extension to get the base, then derive the route
-            const base = key.replace(/\.(?:html|rsc|meta)$/, '');
-            const route = base === 'index' ? '/' : `/${base}`;
-            if (!routeAssetMap[route]) {
-                routeAssetMap[route] = [];
-            }
-            routeAssetMap[route].push(key);
-        }
+        // collectSSGAssets records each key's manifest route while scanning the
+        // output, preserving the existing mapping for HTML/RSC/meta files while
+        // supporting segment keys whose nested names do not encode the page route.
         return {
             pathMap: ssg.pathMap,
-            routeAssetMap,
-            routes: Object.keys(routeAssetMap),
+            routeAssetMap: ssg.routeAssetMap,
+            routes: Object.keys(ssg.routeAssetMap),
             uploadKeys: ssg.keys
         };
     }