@codeam/shared 2.61.11 → 2.61.13

package/dist/index.d.mts

@@ -327,7 +327,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma';
 type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
@@ -456,7 +456,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "resend", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "trello", "resend", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -327,7 +327,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma';
 type IntegrationAuthKind = 'oauth_redirect' | 'oauth_device' | 'api_key';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
@@ -456,7 +456,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "figma", "trello", "resend", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "posthog", "clickup", "trello", "resend", "vercel", "supabase", "asana", "postman", "n8n", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude", "datadog"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -791,6 +791,49 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { AZURE_DEVOPS_AUTH_METHOD: "pat" }
       }
     }
+  },
+  figma: {
+    id: "figma",
+    name: "Figma",
+    icon: "figma",
+    // LIVE — the Figma OAuth app (Confidential, both prod+dev redirect URIs)
+    // is registered and FIGMA_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in
+    // Secret Manager (prod+dev, created 2026-07-16). The backend
+    // FigmaOAuthProvider is config-gated (503 if env unset) so this is safe
+    // even mid-rollout before the secrets mount.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // Granular READ-ONLY scopes (legacy `files:read` is deprecated for
+      // OAuth). Asset export (GET /v1/images) rides file_content:read.
+      // file_variables:read is Enterprise-only and would break linking for
+      // normal accounts — deliberately excluded. ⚠️ Changing these requires
+      // the user to RE-LINK Figma.
+      scopes: [
+        "current_user:read",
+        "file_content:read",
+        "file_metadata:read",
+        "file_dev_resources:read",
+        "library_content:read"
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Framelink figma-developer-mcp (Node, stdio) in BYO-token headless
+        // mode — the ONLY known Figma MCP server that accepts an OAuth
+        // Bearer token: FIGMA_OAUTH_TOKEN → `Authorization: Bearer` (env
+        // only, never argv). Figma's official servers can't be used here
+        // (remote = interactive OAuth + client allowlist; Dev Mode =
+        // desktop app). Version PINNED; bump only after re-verifying
+        // headless. Tools: get_figma_data (condensed layout extraction) +
+        // download_figma_images (asset export).
+        command: "npx",
+        args: ["-y", "figma-developer-mcp@0.13.2", "--stdio", "--no-telemetry"],
+        envMapping: {
+          FIGMA_OAUTH_TOKEN: "accessToken"
+        }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -998,7 +1041,6 @@ var UPCOMING_INTEGRATION_IDS = [
   "gmail",
   "posthog",
   "clickup",
-  "figma",
   "trello",
   "resend",
   "vercel",