@payloadcms/figma 0.1.0-alpha.7 → 0.1.0-alpha.9

package/dist/utils/secret-files.d.ts

@@ -0,0 +1,25 @@
+/**
+ * True when a forward-slash asset key holds no secret or private-history path
+ * segment.
+ *
+ * A deploy can point `--output` at a directory that also holds those files (a
+ * buildless static root, or a framework output folder that copied them in).
+ * Every collected asset becomes a publicly reachable route, so `node_modules`
+ * is excluded here too.
+ */
+export declare function isPublishableAsset(key: string): boolean;
+/**
+ * True when a forward-slash bundle path belongs in a Lambda zip.
+ *
+ * A server bundle needs its `node_modules`, but never the project's `.env`
+ * files or credentials: a deployed function reads its configuration from
+ * deploy environment variables, and a packed secret only widens the blast
+ * radius of any later path that serves bundle files. `.env.production` is the
+ * deliberate exception, an escape hatch for configuration too large for the
+ * Lambda environment-variable limit.
+ *
+ * Paths inside `node_modules` are kept as-is. A dependency's own dotfiles are
+ * not the developer's secrets, and removing files a package may read at
+ * runtime would break the bundle.
+ */
+export declare function isBundlableFile(relativePath: string): boolean;

package/dist/utils/secret-files.js

@@ -0,0 +1,50 @@
+/**
+ * Local secrets and private history that must never leave the developer's
+ * machine: environment files, git history, and credential files.
+ */ const SECRET_NAMES = new Set([
+    '.git',
+    '.netrc',
+    '.npmrc',
+    '.ssh'
+]);
+/** Installed dependencies: private for static hosting, required by a server bundle. */ const DEPENDENCY_DIR = 'node_modules';
+/**
+ * The one environment file a Lambda zip may carry. AWS caps a function's
+ * environment variables at 4 KB total, so a project with more configuration
+ * than that has no way to pass it except inside the bundle. It is still never
+ * publishable: `isPublishableAsset` rejects it like any other `.env` file.
+ */ const BUNDLABLE_ENV_FILE = '.env.production';
+/**
+ * True when a forward-slash asset key holds no secret or private-history path
+ * segment.
+ *
+ * A deploy can point `--output` at a directory that also holds those files (a
+ * buildless static root, or a framework output folder that copied them in).
+ * Every collected asset becomes a publicly reachable route, so `node_modules`
+ * is excluded here too.
+ */ export function isPublishableAsset(key) {
+    return key.split('/').every((segment)=>segment !== DEPENDENCY_DIR && !isSecretName(segment));
+}
+/**
+ * True when a forward-slash bundle path belongs in a Lambda zip.
+ *
+ * A server bundle needs its `node_modules`, but never the project's `.env`
+ * files or credentials: a deployed function reads its configuration from
+ * deploy environment variables, and a packed secret only widens the blast
+ * radius of any later path that serves bundle files. `.env.production` is the
+ * deliberate exception, an escape hatch for configuration too large for the
+ * Lambda environment-variable limit.
+ *
+ * Paths inside `node_modules` are kept as-is. A dependency's own dotfiles are
+ * not the developer's secrets, and removing files a package may read at
+ * runtime would break the bundle.
+ */ export function isBundlableFile(relativePath) {
+    const segments = relativePath.split('/');
+    if (segments.includes(DEPENDENCY_DIR)) {
+        return true;
+    }
+    return segments.every((segment)=>segment === BUNDLABLE_ENV_FILE || !isSecretName(segment));
+}
+function isSecretName(segment) {
+    return SECRET_NAMES.has(segment) || segment.startsWith('.env');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/figma",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.9",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "exports": {
@@ -14,6 +14,11 @@
       "types": "./dist/exports/client.d.ts",
       "default": "./dist/exports/client.js"
     },
+    "./next-image-loader": {
+      "import": "./dist/next/image-loader.js",
+      "types": "./dist/next/image-loader.d.ts",
+      "default": "./dist/next/image-loader.js"
+    },
     "./views": {
       "import": "./dist/exports/views.js",
       "types": "./dist/exports/views.d.ts",