@codeam/shared 2.61.65 → 2.61.66

package/dist/index.d.mts

@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -575,7 +587,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -469,6 +469,18 @@ interface IntegrationDefinition {
          *  resolves the credential by delegating to the source integration, and the
          *  client renders it as "part of <source>" with no Connect action of its own. */
         aliasOf?: IntegrationId;
+        /** SECONDARY api-key / PAT path for a PRIMARY OAuth integration. OAuth
+         *  (`kind`) stays the primary/preferred flow; this lets the user paste a
+         *  personal access token instead — a fallback while the vendor's OAuth app
+         *  is in review, or a permanent alternative (like GitHub OAuth + PAT).
+         *  ⚠️ The PAT often needs a DIFFERENT delivery env var than the OAuth token
+         *  (e.g. Figma: OAuth → `FIGMA_OAUTH_TOKEN`/Bearer, PAT →
+         *  `FIGMA_API_KEY`/`X-Figma-Token`), so it carries its OWN `envMapping` used
+         *  INSTEAD of `delivery.mcp.envMapping` when the credential was linked via PAT. */
+        apiKeyFallback?: {
+            fields: IntegrationApiKeyField[];
+            envMapping: Record<string, string>;
+        };
     };
     delivery: IntegrationDelivery;
 }
@@ -575,7 +587,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -1147,11 +1147,12 @@ var INTEGRATION_REGISTRY = {
     name: "Figma",
     icon: "figma",
     category: "design",
-    // DARK — pending Figma's OAuth-app review approval (submitted 2026-07-16).
-    // Figma OAuth apps do NOT exist publicly until review passes (authorize URL
-    // errors "OAuth app ... doesn't exist"). Backend provider + secrets are
-    // already deployed; flip to true once approved (bead codeagent-m4ix).
-    enabled: false,
+    // LIVE. OAuth is the PRIMARY flow (app pending Figma's review — until it
+    // passes the authorize URL errors "OAuth app doesn't exist"), so a PAT
+    // fallback (`apiKeyFallback`) ships alongside it and works TODAY: the user
+    // pastes a Figma personal access token. Same OAuth-primary + PAT-secondary
+    // shape as GitHub. Flip of the OAuth review is transparent (bead codeagent-m4ix).
+    enabled: true,
     auth: {
       kind: "oauth_redirect",
       // Granular READ-ONLY scopes (legacy `files:read` is deprecated for
@@ -1165,7 +1166,25 @@ var INTEGRATION_REGISTRY = {
         "file_metadata:read",
         "file_dev_resources:read",
         "library_content:read"
-      ]
+      ],
+      // SECONDARY: paste a Figma personal access token instead of OAuth. The
+      // PAT uses the `X-Figma-Token` header, so the delivery env var differs
+      // from OAuth (`FIGMA_API_KEY` vs `FIGMA_OAUTH_TOKEN`) — hence its own
+      // envMapping, used when the credential was linked via PAT.
+      apiKeyFallback: {
+        fields: [
+          {
+            key: "accessToken",
+            label: "Figma personal access token",
+            placeholder: "figd_\u2026",
+            secret: true,
+            help: "Figma \u2192 Settings \u2192 Security \u2192 Personal access tokens (read-only scopes)."
+          }
+        ],
+        envMapping: {
+          FIGMA_API_KEY: "accessToken"
+        }
+      }
     },
     delivery: {
       mcp: {
@@ -1812,7 +1831,6 @@ var INTEGRATION_BRANDING = {
 };
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
-  "figma",
   "asana",
   "stripe",
   "pendo",