@payloadcms/figma 0.1.0-alpha.7 → 0.1.0-alpha.8

package/dist/oauth/components/LoginButton/index.js

@@ -6,6 +6,17 @@ import { getSearchParam } from '../../utils/getSearchParam.js';
 import { resolveParentTargetOrigin, setupIframeAutoLogin } from './iframeAutoLogin.js';
 import './index.scss';
 const baseClass = 'oauth-login';
+const COLLECTION_SKELETON_KEYS = [
+    'collection-1',
+    'collection-2',
+    'collection-3',
+    'collection-4'
+];
+const GLOBAL_SKELETON_KEYS = [
+    'global-1',
+    'global-2',
+    'global-3'
+];
 // Max time we wait for the parent (figma.com) to respond with a code after
 // posting `mint-cms-oauth-code`. If we hit this without a reply, we assume
 // the parent isn't going to respond and fall back to the manual login button.
@@ -49,6 +60,57 @@ const FigmaIcon = ()=>/*#__PURE__*/ _jsx("svg", {
             fillRule: "evenodd"
         })
     });
+const PayloadAdminLoadingShimmer = ()=>/*#__PURE__*/ _jsx("div", {
+        "aria-label": "Signing in",
+        "aria-live": "polite",
+        className: `${baseClass}__admin-shimmer`,
+        role: "status",
+        children: /*#__PURE__*/ _jsxs("div", {
+            "aria-hidden": "true",
+            className: `${baseClass}__admin-shimmer-main`,
+            children: [
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-heading-row`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-heading-icon`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-heading-label`
+                        })
+                    ]
+                }),
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-section`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-section-label`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-card-grid`,
+                            children: COLLECTION_SKELETON_KEYS.map((key)=>/*#__PURE__*/ _jsx("div", {
+                                    className: `${baseClass}__shimmer-block ${baseClass}__shimmer-card`
+                                }, key))
+                        })
+                    ]
+                }),
+                /*#__PURE__*/ _jsxs("div", {
+                    className: `${baseClass}__shimmer-section`,
+                    children: [
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-block ${baseClass}__shimmer-section-label`
+                        }),
+                        /*#__PURE__*/ _jsx("div", {
+                            className: `${baseClass}__shimmer-card-grid`,
+                            children: GLOBAL_SKELETON_KEYS.map((key)=>/*#__PURE__*/ _jsx("div", {
+                                    className: `${baseClass}__shimmer-block ${baseClass}__shimmer-card`
+                                }, key))
+                        })
+                    ]
+                })
+            ]
+        })
+    });
 export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
     const { config: { admin: { user: userSlug }, routes: { api }, serverURL } } = useConfig();
     const [authorizeURL, setAuthorizeURL] = useState('');
@@ -150,26 +212,11 @@ export const DefaultLoginButton = ({ disabled, endpointSlug })=>{
         endpointSlug
     ]);
     if (!shouldRenderButton) {
-        // In the iframe auto-login window, show a "Signing in…" hint so the
-        // user sees something is happening instead of a blank slot until the
-        // flow either navigates them away or times out into the manual button.
+        // In the iframe auto-login window, show a Payload admin-shaped shimmer
+        // until the flow either navigates them away or times out into the manual
+        // button.
         if (isInIframe === true && !disabled) {
-            return /*#__PURE__*/ _jsx("div", {
-                className: baseClass,
-                children: /*#__PURE__*/ _jsxs("div", {
-                    className: `${baseClass}__signing-in`,
-                    role: "status",
-                    children: [
-                        /*#__PURE__*/ _jsx("span", {
-                            children: "Signing in"
-                        }),
-                        /*#__PURE__*/ _jsx("div", {
-                            "aria-hidden": "true",
-                            className: `${baseClass}__spinner`
-                        })
-                    ]
-                })
-            });
+            return /*#__PURE__*/ _jsx(PayloadAdminLoadingShimmer, {});
         }
         return null;
     }

package/dist/oauth/components/LoginButton/index.scss

@@ -1,3 +1,10 @@
+.oauth-login,
+.oauth-login__admin-shimmer {
+  --oauth-login-shimmer-bg: var(--theme-bg, var(--theme-elevation-0, #ffffff));
+  --oauth-login-shimmer-block: var(--theme-elevation-100, #efefef);
+  --oauth-login-shimmer-highlight: var(--theme-elevation-200, #f7f7f7);
+}
+
 .oauth-login {
   display: flex;
   justify-content: center;
@@ -55,28 +62,127 @@
       Oxygen, Ubuntu, Cantarell, sans-serif;
   }
 
-  &__signing-in {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: 0.75rem;
-    font-size: 1rem;
+  &__admin-shimmer {
+    position: fixed;
+    inset: 0;
+    z-index: 1000;
+    overflow: hidden;
+    background: var(--oauth-login-shimmer-bg);
     font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto,
       Oxygen, Ubuntu, Cantarell, sans-serif;
   }
 
-  &__spinner {
-    width: 24px;
-    height: 24px;
-    border: 2px solid var(--theme-elevation-200, #e5e5e5);
-    border-top-color: currentColor;
-    border-radius: 50%;
-    animation: oauth-login-spin 0.8s linear infinite;
+  &__admin-shimmer-main {
+    padding: 2rem 2.5rem;
+  }
+
+  &__shimmer-block {
+    position: relative;
+    overflow: hidden;
+    border-radius: 0.25rem;
+    background-color: var(--oauth-login-shimmer-block);
+  }
+
+  &__shimmer-block::after {
+    content: '';
+    position: absolute;
+    inset: 0;
+    border-radius: inherit;
+    background-image: linear-gradient(
+      100deg,
+      transparent 0%,
+      transparent 35%,
+      var(--oauth-login-shimmer-highlight) 50%,
+      transparent 65%,
+      transparent 100%
+    );
+    pointer-events: none;
+    transform: translateX(-100%);
+    animation: oauth-login-shimmer 1.45s linear infinite;
+  }
+
+  &__shimmer-heading-row {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    height: 1.75rem;
+    margin-bottom: 1rem;
+  }
+
+  &__shimmer-heading-icon {
+    width: 1.5rem;
+    height: 1.5rem;
+  }
+
+  &__shimmer-heading-label {
+    width: 7.5rem;
+    height: 1.25rem;
+  }
+
+  &__shimmer-section {
+    margin-bottom: 1.5rem;
+  }
+
+  &__shimmer-section-label {
+    width: 7.5rem;
+    height: 1.25rem;
+    margin-bottom: 0.5rem;
+  }
+
+  &__shimmer-card-grid {
+    display: grid;
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+    gap: 1rem;
+    max-width: 51.625rem;
+  }
+
+  &__shimmer-card {
+    height: 4rem;
+  }
+}
+
+@media (prefers-color-scheme: dark) {
+  .oauth-login,
+  .oauth-login__admin-shimmer {
+    --oauth-login-shimmer-bg: var(--theme-bg, var(--theme-elevation-0, #2b2b2b));
+    --oauth-login-shimmer-block: var(--theme-elevation-100, #383838);
+    --oauth-login-shimmer-highlight: var(--theme-elevation-200, #444444);
+  }
+}
+
+@media (max-width: 48rem) {
+  .oauth-login {
+    &__shimmer-card-grid {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
   }
 }
 
-@keyframes oauth-login-spin {
+@media (max-width: 30rem) {
+  .oauth-login {
+    &__admin-shimmer-main {
+      padding-right: 0.75rem;
+      padding-left: 0.75rem;
+    }
+
+    &__shimmer-card-grid {
+      grid-template-columns: 1fr;
+    }
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .oauth-login__shimmer-block::after {
+    animation: none;
+  }
+}
+
+@keyframes oauth-login-shimmer {
+  from {
+    transform: translateX(-100%);
+  }
+
   to {
-    transform: rotate(360deg);
+    transform: translateX(100%);
   }
 }

package/dist/utils/adapters/nitro.js

@@ -1,10 +1,10 @@
 import archiver from 'archiver';
-import { createWriteStream, statSync } from 'fs';
+import { createWriteStream } from 'fs';
 import fs from 'fs/promises';
 import path from 'path';
 import { resolveNitroOutputLayout } from '../deploy-output/resolveNitroOutputLayout.js';
 import { resolveOutputPath } from '../deploy-output/resolveOutputPath.js';
-import { collectFilesRecursive, getDirectorySize } from '../fs-utils.js';
+import { collectFilesRecursive, EscapingSymlinkError, walkBundleFiles } from '../fs-utils.js';
 /** Framework asset directories that are not pre-rendered pages. */ const NON_PAGE_DIRS = new Set([
     '_build',
     '_nuxt',
@@ -57,8 +57,8 @@ export class NitroAdapter {
             throw new Error(`Nitro server build not found at ${layout.outputPath}`);
         }
         const serverDir = path.dirname(layout.serverEntryPath);
-        const serverPrefix = path.relative(layout.outputPath, serverDir).split(path.sep).join('/');
-        const publicPrefix = path.relative(layout.outputPath, layout.publicPath).split(path.sep).join('/');
+        const serverPrefix = zipPrefix(path.relative(layout.outputPath, serverDir).split(path.sep).join('/'));
+        const publicPrefix = zipPrefix(path.relative(layout.outputPath, layout.publicPath).split(path.sep).join('/'));
         const serverEntry = path.relative(layout.outputPath, layout.serverEntryPath).split(path.sep).join('/');
         const runShPath = path.join(layout.outputPath, 'run.sh');
         await fs.writeFile(runShPath, createRunScript(serverEntry), {
@@ -66,22 +66,32 @@ export class NitroAdapter {
         });
         const zipPath = path.join(projectPath, 'lambda.zip');
         try {
+            const runShStat = await fs.stat(runShPath);
+            const [serverFiles, publicFiles] = await Promise.all([
+                walkBundleFiles(serverDir),
+                walkPublicBundleFiles(layout.publicPath)
+            ]);
+            const unzippedBytes = serverFiles.reduce((total, file)=>total + file.size, 0) + publicFiles.reduce((total, file)=>total + file.size, 0) + runShStat.size;
             await createZip(zipPath, [
                 {
-                    prefix: `${serverPrefix}/`,
-                    source: serverDir
+                    files: serverFiles,
+                    prefix: serverPrefix
                 },
                 {
-                    prefix: `${publicPrefix}/`,
-                    source: layout.publicPath
+                    files: publicFiles,
+                    prefix: publicPrefix
                 },
                 {
-                    prefix: '',
-                    source: runShPath
+                    files: [
+                        {
+                            relativePath: 'run.sh',
+                            size: runShStat.size,
+                            sourcePath: runShPath
+                        }
+                    ],
+                    prefix: ''
                 }
             ]);
-            const runShStat = await fs.stat(runShPath);
-            const unzippedBytes = await getDirectorySize(serverDir) + await getDirectorySize(layout.publicPath) + runShStat.size;
             return {
                 unzippedBytes,
                 zipPath
@@ -135,9 +145,22 @@ NODE_ENV=production exec node '${escapedEntry}'
     }
     return pages;
 }
+function zipPrefix(relativeDir) {
+    return relativeDir ? `${relativeDir}/` : '';
+}
 function toPageUploadKey(page) {
     return page === 'index' ? 'index.html' : `${page}/index.html`;
 }
+async function walkPublicBundleFiles(publicPath) {
+    try {
+        return await walkBundleFiles(publicPath);
+    } catch (error) {
+        if (error instanceof EscapingSymlinkError) {
+            throw error;
+        }
+        return [];
+    }
+}
 async function createZip(zipPath, entries) {
     return new Promise((resolve, reject)=>{
         const output = createWriteStream(zipPath);
@@ -150,17 +173,10 @@ async function createZip(zipPath, entries) {
         archive.on('error', (err)=>reject(err));
         archive.pipe(output);
         for (const entry of entries){
-            try {
-                const stat = statSync(entry.source);
-                if (stat.isDirectory()) {
-                    archive.directory(entry.source, entry.prefix.replace(/\/$/, '') || false);
-                } else {
-                    archive.file(entry.source, {
-                        name: entry.prefix + path.basename(entry.source)
-                    });
-                }
-            } catch  {
-            // Skip missing entries
+            for (const file of entry.files){
+                archive.file(file.sourcePath, {
+                    name: entry.prefix + file.relativePath
+                });
             }
         }
         void archive.finalize();

package/dist/utils/adapters/vite.js

@@ -1,12 +1,26 @@
 import path from 'path';
 import { resolveOutputPath } from '../deploy-output/resolveOutputPath.js';
 import { collectFilesRecursive } from '../fs-utils.js';
+/**
+ * A buildless static deploy points `--output` at the project root, so local
+ * secrets and private history sit beside the intended web assets. Every
+ * collected file becomes a publicly reachable route, so never publish these.
+ */ const EXCLUDED_ASSET_NAMES = new Set([
+    '.git',
+    '.netrc',
+    '.npmrc',
+    '.ssh',
+    'node_modules'
+]);
+function isPublishableAsset(key) {
+    return key.split('/').every((segment)=>!EXCLUDED_ASSET_NAMES.has(segment) && !segment.startsWith('.env'));
+}
 export class ViteAdapter {
     fallback = '/index.html';
     name = 'vite';
     async collectAssets(projectPath, output) {
         const outputPath = resolveOutputPath(projectPath, 'vite', output);
-        const files = await collectFilesRecursive(outputPath, outputPath);
+        const files = (await collectFilesRecursive(outputPath, outputPath)).filter(isPublishableAsset);
         const pathMap = Object.fromEntries(files.map((file)=>[
                 file,
                 path.relative(projectPath, path.join(outputPath, file))

package/dist/utils/asset-collection.d.ts

@@ -30,7 +30,7 @@ type StaticMetadataAssets = Omit<SSGAssets, 'routeAssetMap'>;
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each page route in the manifest's `routes` object, collects:
+ * For each page route without revalidation in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)

package/dist/utils/asset-collection.js

@@ -77,7 +77,7 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
 /**
  * Collect SSG asset paths by parsing .next/prerender-manifest.json
  *
- * For each page route in the manifest's `routes` object, collects:
+ * For each page route without revalidation in the manifest's `routes` object, collects:
  * - {route}.html  (full HTML)
  * - {route}.rsc   (React Server Components payload)
  * - {route}.meta  (response headers JSON)
@@ -112,11 +112,6 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
     const keys = [];
     const pathMap = {};
     const routeAssetMap = {};
-    const extensions = [
-        '.html',
-        '.rsc',
-        '.meta'
-    ];
     const appDir = path.join(outputPath, 'server', 'app');
     for (const [routeKey, route] of Object.entries(manifest.routes)){
         // Current manifests classify app pages explicitly. Older App Router manifests
@@ -125,9 +120,26 @@ const MAX_ASSET_SIZE = 50 * 1024 * 1024 // 50MB
         if (!isPageRoute) {
             continue;
         }
+        // ISR prerenders are seeds for the Next.js runtime, not permanent S3 pages.
+        // Keep legacy manifests without this field; only false explicitly disables revalidation.
+        if (route.initialRevalidateSeconds !== undefined && route.initialRevalidateSeconds !== false) {
+            continue;
+        }
         // Strip leading slash for S3 key; handle root "/" → "index"
         const stripped = routeKey === '/' ? 'index' : routeKey.replace(/^\//, '');
         const routeAssets = [];
+        // For partially static routes, dataRoute can name a runtime endpoint even
+        // when the build has no full RSC file. Next.js sets prefetchDataRoute only
+        // when it emits that static payload.
+        const hasFullRSC = route.renderingMode !== 'PARTIALLY_STATIC' || typeof route.prefetchDataRoute === 'string';
+        const extensions = hasFullRSC ? [
+            '.html',
+            '.rsc',
+            '.meta'
+        ] : [
+            '.html',
+            '.meta'
+        ];
         for (const ext of extensions){
             const s3Key = `${stripped}${ext}`;
             keys.push(s3Key);

package/dist/utils/build-lambda-zip.js

@@ -1,10 +1,10 @@
 import archiver from 'archiver';
 import { createWriteStream } from 'fs';
-import fs from 'fs/promises';
 import path from 'path';
+import { configureNextjsCache } from './configureNextjsCache.js';
 import { inspectNextjsOutput } from './deploy-output/inspectNextjsOutput.js';
 import { resolveOutputPath } from './deploy-output/resolveOutputPath.js';
-import { getDirectorySize } from './fs-utils.js';
+import { walkBundleFiles } from './fs-utils.js';
 /**
  * AWS Lambda's hard limit on unzipped deployment code size (250 MB). The unzipped
  * total must be strictly less than this value, so a bundle exactly equal to it is
@@ -31,17 +31,43 @@ import { getDirectorySize } from './fs-utils.js';
     if (!layout) {
         throw new Error(`Standalone build not found at ${outputPath}`);
     }
-    const serverEntry = path.relative(layout.standalonePath, layout.serverEntryPath).split(path.sep).join('/');
-    const runScript = createRunScript(serverEntry);
+    const files = await walkBundleFiles(layout.standalonePath);
+    // Override archive entries in memory without changing Next's standalone output.
+    const bundleFileOverrides = await createBundleFileOverrides(layout.standalonePath, layout.serverEntryPath);
     const zipPath = path.join(projectPath, 'lambda.zip');
-    const existingRunScriptBytes = await getFileSize(path.join(layout.standalonePath, 'run.sh'));
-    const unzippedBytes = await getDirectorySize(layout.standalonePath) - existingRunScriptBytes + Buffer.byteLength(runScript);
-    await createZip(layout.standalonePath, zipPath, runScript);
+    let unzippedBytes = files.reduce((total, file)=>total + file.size, 0);
+    for (const [name, contents] of bundleFileOverrides){
+        const existingBytes = files.find((file)=>file.relativePath === name)?.size ?? 0;
+        unzippedBytes += contents.byteLength - existingBytes;
+    }
+    await createZip(files, zipPath, bundleFileOverrides);
     return {
         unzippedBytes,
         zipPath
     };
 }
+/**
+ * Returns files that replace or extend the standalone output in the Lambda zip:
+ * the generated launcher, the cache-configured server entry, and its optional
+ * cache handler. All paths are relative to the zip root.
+ */ async function createBundleFileOverrides(standalonePath, serverEntryPath) {
+    const serverEntry = path.relative(standalonePath, serverEntryPath).split(path.sep).join('/');
+    const cacheConfiguration = await configureNextjsCache(serverEntryPath);
+    const bundleFileOverrides = new Map([
+        [
+            'run.sh',
+            Buffer.from(createRunScript(serverEntry))
+        ],
+        [
+            serverEntry,
+            Buffer.from(cacheConfiguration.server)
+        ]
+    ]);
+    if (cacheConfiguration.handler) {
+        bundleFileOverrides.set(path.posix.join(path.posix.dirname(serverEntry), cacheConfiguration.handler.name), cacheConfiguration.handler.data);
+    }
+    return bundleFileOverrides;
+}
 function createRunScript(serverEntry) {
     const escapedEntry = serverEntry.replaceAll("'", "'\\''");
     return `#!/bin/bash -x
@@ -49,10 +75,7 @@ function createRunScript(serverEntry) {
 NODE_ENV=production exec node '${escapedEntry}'
 `;
 }
-async function getFileSize(filePath) {
-    return fs.stat(filePath).then((stat)=>stat.isFile() ? stat.size : 0).catch(()=>0);
-}
-function createZip(sourceDir, zipPath, runScript) {
+function createZip(files, zipPath, bundleFileOverrides) {
     return new Promise((resolve, reject)=>{
         const output = createWriteStream(zipPath);
         const archive = archiver('zip', {
@@ -63,11 +86,20 @@ function createZip(sourceDir, zipPath, runScript) {
         output.on('close', ()=>resolve());
         archive.on('error', (err)=>reject(err));
         archive.pipe(output);
-        archive.directory(sourceDir, false, (entry)=>entry.name === 'run.sh' ? false : entry);
-        archive.append(runScript, {
-            name: 'run.sh',
-            mode: 0o755
-        });
+        for (const file of files){
+            if (bundleFileOverrides.has(file.relativePath)) {
+                continue;
+            }
+            archive.file(file.sourcePath, {
+                name: file.relativePath
+            });
+        }
+        for (const [name, contents] of bundleFileOverrides){
+            archive.append(contents, {
+                name,
+                mode: name === 'run.sh' ? 0o755 : 0o644
+            });
+        }
         void archive.finalize();
     });
 }

package/dist/utils/configureNextjsCache.d.ts

@@ -0,0 +1,7 @@
+export declare function configureNextjsCache(serverEntryPath: string): Promise<{
+    handler?: {
+        data: Buffer;
+        name: string;
+    };
+    server: string;
+}>;

package/dist/utils/configureNextjsCache.js

@@ -0,0 +1,55 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { Node, Project } from 'ts-morph';
+import { info } from './log.js';
+const CACHE_HANDLER_FILE = '__figma_nextjs_cache.mjs';
+export async function configureNextjsCache(serverEntryPath) {
+    const original = await fs.readFile(serverEntryPath, 'utf8');
+    const project = new Project({
+        useInMemoryFileSystem: true
+    });
+    const source = project.createSourceFile('server.js', original);
+    const initializer = source.getVariableDeclaration('nextConfig')?.getInitializer();
+    if (!initializer || !Node.isObjectLiteralExpression(initializer)) {
+        throw new Error('Unsupported Next.js standalone server: expected a nextConfig object');
+    }
+    // Only accept Next's generated JSON, not arbitrary application code.
+    let config;
+    try {
+        config = JSON.parse(initializer.getText());
+    } catch  {
+        throw new Error('Unsupported Next.js standalone server: expected generated JSON config');
+    }
+    const experimental = config.experimental;
+    // cacheHandler is the stable name; older Next.js builds use the experimental path.
+    if (config.cacheHandler || experimental?.incrementalCacheHandlerPath) {
+        info('Using the application cacheHandler; Figma fresh-only caching is not enabled.');
+        return {
+            server: original
+        };
+    }
+    const reservedPath = path.join(path.dirname(serverEntryPath), CACHE_HANDLER_FILE);
+    const exists = await fs.lstat(reservedPath).then(()=>true, (error)=>{
+        if (error.code === 'ENOENT') {
+            return false;
+        }
+        throw error;
+    });
+    if (exists) {
+        throw new Error(`Standalone output contains reserved file ${CACHE_HANDLER_FILE}`);
+    }
+    initializer.getProperty('"cacheHandler"')?.remove();
+    initializer.addPropertyAssignments([
+        {
+            name: 'cacheHandler',
+            initializer: `require.resolve('./${CACHE_HANDLER_FILE}')`
+        }
+    ]);
+    return {
+        handler: {
+            name: CACHE_HANDLER_FILE,
+            data: await fs.readFile(new URL('./lambda-runtime/nextjs-cache.js', import.meta.url))
+        },
+        server: source.getFullText()
+    };
+}

package/dist/utils/fs-utils.d.ts

@@ -3,10 +3,37 @@
  * returned as forward-slash-separated paths relative to baseDir.
  */
 export declare function collectFilesRecursive(dir: string, baseDir: string): Promise<string[]>;
+export declare class EscapingSymlinkError extends Error {
+    readonly symlinkPath: string;
+    readonly targetPath: string;
+    constructor(symlinkPath: string, targetPath: string, root: string);
+}
+export interface BundleFile {
+    /** Forward-slash path relative to the walk root; used as the zip entry name. */
+    relativePath: string;
+    /**
+     * Bytes this entry contributes to unzipped size. Regular files use content
+     * size; in-tree symlinks use `lstat` size (the stored link path).
+     */
+    size: number;
+    /** Path passed to the archiver; may be an in-tree symlink. */
+    sourcePath: string;
+}
 /**
- * Recursively sum the byte size of all files under a directory.
- * Returns 0 for a missing or unreadable directory. Symlinks are not
- * followed. Files that disappear or become unreadable between readdir
- * and stat are skipped (treated as 0 bytes).
+ * Recursively list files under `root` for Lambda bundle sizing and archiving.
+ *
+ * Regular files and directories are included. Symlinks are included (not
+ * followed) only when the resolved target stays within `root`; otherwise an
+ * {@link EscapingSymlinkError} is thrown. This matches `archiver.directory`,
+ * which stores zip symlink entries rather than copying target contents.
+ * Broken or unreadable files are skipped.
+ */
+export declare function walkBundleFiles(root: string): Promise<BundleFile[]>;
+/**
+ * Recursively sum the byte size of all files under a directory using the same
+ * symlink policy as {@link walkBundleFiles}. Returns 0 for a missing or
+ * unreadable directory. Escaping symlinks throw {@link EscapingSymlinkError}.
+ * Files that disappear or become unreadable between readdir and stat are
+ * skipped (treated as 0 bytes).
  */
 export declare function getDirectorySize(dir: string): Promise<number>;

package/dist/utils/fs-utils.js

@@ -23,33 +23,113 @@ import path from 'path';
     }
     return files;
 }
+export class EscapingSymlinkError extends Error {
+    symlinkPath;
+    targetPath;
+    constructor(symlinkPath, targetPath, root){
+        super(`Symlink '${symlinkPath}' points outside ${root} (${targetPath})`), this.symlinkPath = symlinkPath, this.targetPath = targetPath;
+        this.name = 'EscapingSymlinkError';
+    }
+}
+/**
+ * Recursively list files under `root` for Lambda bundle sizing and archiving.
+ *
+ * Regular files and directories are included. Symlinks are included (not
+ * followed) only when the resolved target stays within `root`; otherwise an
+ * {@link EscapingSymlinkError} is thrown. This matches `archiver.directory`,
+ * which stores zip symlink entries rather than copying target contents.
+ * Broken or unreadable files are skipped.
+ */ export async function walkBundleFiles(root) {
+    const rootReal = await fs.realpath(root);
+    const files = [];
+    await walkBundleDir(root, root, rootReal, files);
+    return files;
+}
 /**
- * Recursively sum the byte size of all files under a directory.
- * Returns 0 for a missing or unreadable directory. Symlinks are not
- * followed. Files that disappear or become unreadable between readdir
- * and stat are skipped (treated as 0 bytes).
+ * Recursively sum the byte size of all files under a directory using the same
+ * symlink policy as {@link walkBundleFiles}. Returns 0 for a missing or
+ * unreadable directory. Escaping symlinks throw {@link EscapingSymlinkError}.
+ * Files that disappear or become unreadable between readdir and stat are
+ * skipped (treated as 0 bytes).
  */ export async function getDirectorySize(dir) {
+    try {
+        const files = await walkBundleFiles(dir);
+        return files.reduce((total, file)=>total + file.size, 0);
+    } catch (error) {
+        if (error instanceof EscapingSymlinkError) {
+            throw error;
+        }
+        return 0;
+    }
+}
+function isPathWithin(rootReal, targetReal) {
+    const relative = path.relative(rootReal, targetReal);
+    return relative === '' || relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+async function walkBundleDir(dir, root, rootReal, files) {
     let entries;
     try {
         entries = await fs.readdir(dir, {
             withFileTypes: true
         });
     } catch  {
-        return 0;
+        return;
     }
-    let total = 0;
     for (const entry of entries){
         const fullPath = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-            total += await getDirectorySize(fullPath);
+        if (entry.isSymbolicLink()) {
+            await addSymlinkEntry(fullPath, root, rootReal, files);
+        } else if (entry.isDirectory()) {
+            await walkBundleDir(fullPath, root, rootReal, files);
         } else if (entry.isFile()) {
-            try {
-                const stats = await fs.stat(fullPath);
-                total += stats.size;
-            } catch  {
-            // File vanished or is unreadable between readdir and stat — skip it.
-            }
+            await addRegularFile(fullPath, root, files);
+        }
+    }
+}
+async function addSymlinkEntry(fullPath, root, rootReal, files) {
+    const relativePath = toRelativePath(root, fullPath);
+    const targetPath = await resolveSymlinkTarget(fullPath);
+    if (targetPath === null) {
+        return;
+    }
+    if (!isPathWithin(rootReal, targetPath)) {
+        throw new EscapingSymlinkError(relativePath, targetPath, root);
+    }
+    try {
+        const stats = await fs.lstat(fullPath);
+        files.push({
+            relativePath,
+            size: stats.size,
+            sourcePath: fullPath
+        });
+    } catch  {
+    // Symlink vanished between readdir and lstat — skip it.
+    }
+}
+async function resolveSymlinkTarget(fullPath) {
+    try {
+        return await fs.realpath(fullPath);
+    } catch  {
+        try {
+            const link = await fs.readlink(fullPath);
+            return path.resolve(path.dirname(fullPath), link);
+        } catch  {
+            return null;
         }
     }
-    return total;
+}
+async function addRegularFile(fullPath, root, files) {
+    try {
+        const stats = await fs.stat(fullPath);
+        files.push({
+            relativePath: toRelativePath(root, fullPath),
+            size: stats.size,
+            sourcePath: fullPath
+        });
+    } catch  {
+    // File vanished or is unreadable between readdir and stat — skip it.
+    }
+}
+function toRelativePath(root, fullPath) {
+    return path.relative(root, fullPath).split(path.sep).join('/');
 }

package/dist/utils/lambda-runtime/nextjs-cache.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A process-local, fresh-only Next.js cacheHandler. The CDN owns stale serving.
+ * No filesystem access: Lambda's code directory is read-only. Each cold process
+ * starts empty; Gatekeeper serves the separately uploaded static assets.
+ */
+export default class NextjsCacheHandler {
+    tagVersion: number;
+    get(key: any, context?: {}): Promise<{
+        value: any;
+        lastModified: any;
+    } | null>;
+    set(key: any, value: any, context?: {}): Promise<void>;
+    /**
+     * The revalidateTag function allows invalidating cached data on-demand based
+     * on the specified tags. For our purposes, since we are currently doing a
+     * local in-memory, per-process lambda cache, we can just go ahead and clear
+     * the cache. Eventually we will want to support doing tag invalidation at the
+     * CDN layer.
+     */
+    revalidateTag(tags: any, _durations?: {}): Promise<void>;
+    resetRequestCache(): void;
+}

package/dist/utils/lambda-runtime/nextjs-cache.js

@@ -0,0 +1,162 @@
+import { deserialize, serialize } from 'node:v8';
+const MAX_CACHE_BYTES = 8 * 1024 * 1024;
+// Approximate Map entry and metadata overhead; actual heap use can differ.
+const ESTIMATED_ENTRY_OVERHEAD_BYTES = 64;
+const cache = new Map();
+let cacheBytes = 0;
+// Tag invalidation advances this counter to reject writes from earlier requests.
+let tagVersion = 0;
+/**
+ * A process-local, fresh-only Next.js cacheHandler. The CDN owns stale serving.
+ * No filesystem access: Lambda's code directory is read-only. Each cold process
+ * starts empty; Gatekeeper serves the separately uploaded static assets.
+ */ export default class NextjsCacheHandler {
+    constructor(){
+        this.tagVersion = tagVersion;
+    }
+    async get(key, context = {}) {
+        const cacheKey = getCacheKey(key, context.kind === 'FETCH');
+        const entry = cache.get(cacheKey);
+        if (!entry) {
+            observe('miss', context.kind);
+            return null;
+        }
+        const effectiveTTL = context.kind === 'FETCH' && context.revalidate !== undefined ? Math.min(entry.seconds, lifetime(context.revalidate)) : entry.seconds;
+        const ageMs = Math.max(0, Date.now() - entry.lastModified);
+        if (ageMs >= effectiveTTL * 1000) {
+            if (ageMs >= entry.seconds * 1000) {
+                remove(cacheKey);
+            }
+            observe('expired', context.kind);
+            return null;
+        }
+        // Clone cached buffers/maps so a caller cannot mutate the stored value.
+        // V8 can return Buffer views into its input, so copy the serialized bytes.
+        const value = deserialize(Buffer.from(entry.data));
+        if (value && [
+            'APP_PAGE',
+            'APP_ROUTE',
+            'PAGES'
+        ].includes(value.kind)) {
+            value.headers = withoutAge(value.headers);
+            value.headers.Age = String(Math.floor(ageMs / 1000));
+        }
+        cache.delete(cacheKey);
+        cache.set(cacheKey, entry);
+        observe('hit', context.kind);
+        return {
+            value,
+            lastModified: entry.lastModified
+        };
+    }
+    async set(key, value, context = {}) {
+        // A render that overlaps invalidation must not restore an old value.
+        if (this.tagVersion !== tagVersion) {
+            return;
+        }
+        const cacheKey = getCacheKey(key, context.fetchCache);
+        remove(cacheKey);
+        const seconds = lifetime(context.fetchCache ? value?.revalidate : context.cacheControl?.revalidate);
+        if (seconds === 0) {
+            return;
+        }
+        let data;
+        try {
+            data = serialize(value);
+        } catch  {
+            observe('unsupported', value?.kind);
+            return;
+        }
+        const size = data.byteLength + Buffer.byteLength(cacheKey) + ESTIMATED_ENTRY_OVERHEAD_BYTES;
+        if (size > MAX_CACHE_BYTES) {
+            observe('oversized', value?.kind);
+            return;
+        }
+        // Preserve an upstream Age, including a previous cached response that Next
+        // attempts to write again after an unsuccessful on-demand revalidation.
+        const age = responseAge(value);
+        if (age >= seconds) {
+            return;
+        }
+        while(cacheBytes + size > MAX_CACHE_BYTES){
+            remove(cache.keys().next().value);
+        }
+        cache.set(cacheKey, {
+            data,
+            size,
+            seconds,
+            lastModified: Date.now() - age * 1000
+        });
+        cacheBytes += size;
+    }
+    /**
+   * The revalidateTag function allows invalidating cached data on-demand based
+   * on the specified tags. For our purposes, since we are currently doing a
+   * local in-memory, per-process lambda cache, we can just go ahead and clear
+   * the cache. Eventually we will want to support doing tag invalidation at the
+   * CDN layer.
+   */ async revalidateTag(tags, _durations = {}) {
+        const tagsArr = Array.isArray(tags) ? tags : [
+            tags
+        ];
+        const hasValidTag = tagsArr.some((tag)=>typeof tag === 'string' && tag.length);
+        if (!hasValidTag) {
+            return;
+        }
+        cache.clear();
+        cacheBytes = 0;
+        tagVersion += 1;
+        observe('invalidated', 'local');
+    }
+    // Outstanding writes still belong to the request that started before invalidation.
+    resetRequestCache() {}
+}
+function getCacheKey(key, fetchCache) {
+    return `${fetchCache ? 'fetch' : 'route'}:${key}`;
+}
+function lifetime(revalidate) {
+    if (revalidate === false) {
+        return Infinity;
+    }
+    return Number.isSafeInteger(revalidate) && revalidate > 0 ? revalidate : 0;
+}
+function remove(key) {
+    const entry = cache.get(key);
+    if (entry) {
+        cacheBytes -= entry.size;
+    }
+    cache.delete(key);
+}
+function withoutAge(headers) {
+    return Object.fromEntries(Object.entries(headers ?? {}).filter(([name])=>name.toLowerCase() !== 'age'));
+}
+function responseAge(value) {
+    if (!value || value.kind === 'FETCH') {
+        return 0;
+    }
+    const age = Object.entries(value.headers ?? {}).find(([name])=>name.toLowerCase() === 'age')?.[1];
+    if (age === undefined) {
+        return 0;
+    }
+    if (typeof age !== 'number' && (typeof age !== 'string' || !/^\d+$/.test(age))) {
+        return Infinity;
+    }
+    const seconds = Number(age);
+    return Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : Infinity;
+}
+function observe(result, kind) {
+    if (![
+        'APP_PAGE',
+        'APP_ROUTE',
+        'PAGES',
+        'local'
+    ].includes(kind)) {
+        return;
+    }
+    // Bounded fields only: never log cache keys, URLs, values, or tags.
+    console.info(JSON.stringify({
+        event: 'figma_nextjs_cache',
+        result,
+        kind
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.8",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {