@mp3wizard/figma-console-mcp 1.15.2 → 1.15.4

package/dist/cloudflare/index.js

@@ -29,19 +29,6 @@ export { PluginRelayDO } from "./core/cloud-websocket-relay.js";
 // Note: MCP Apps (Token Browser, Dashboard) are only available in local mode
 // They require Node.js file system APIs for serving HTML that don't work in Cloudflare Workers
 const logger = createChildLogger({ component: "mcp-server" });
-/** Escape HTML special characters to prevent XSS in server-rendered HTML responses */
-function htmlEscape(s) {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
-}
-/** Apply baseline HTTP security headers to any Response */
-function withSecurityHeaders(response) {
-    const headers = new Headers(response.headers);
-    headers.set('X-Content-Type-Options', 'nosniff');
-    headers.set('X-Frame-Options', 'DENY');
-    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-    headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
-}
 /**
  * Figma Console MCP Agent
  * Extends McpAgent to provide Figma-specific debugging tools
@@ -51,7 +38,7 @@ export class FigmaConsoleMCPv3 extends McpAgent {
         super(...arguments);
         this.server = new McpServer({
             name: "Figma Console MCP",
-            version: "1.13.0",
+            version: "1.15.0",
         });
         this.browserManager = null;
         this.consoleMonitor = null;
@@ -124,8 +111,11 @@ export class FigmaConsoleMCPv3 extends McpAgent {
         if (this.sessionId) {
             return; // Already loaded
         }
-        // Use a unique, per-Durable-Object session ID so that each MCP client
-        // (identified by Cloudflare's DO routing) gets its own OAuth token.
+        // IMPORTANT: Use a fixed session ID for all MCP connections
+        // This ensures OAuth tokens persist across MCP server reconnections
+        // Each user of this MCP server will share the same OAuth token
+        const FIXED_SESSION_ID = "figma-console-mcp-default-session";
+        // Try to load from Durable Object storage
         // @ts-ignore - this.ctx is available in Durable Object context
         const storage = this.ctx?.storage;
         if (storage) {
@@ -133,14 +123,14 @@ export class FigmaConsoleMCPv3 extends McpAgent {
                 const storedSessionId = await storage.get('sessionId');
                 if (storedSessionId) {
                     this.sessionId = storedSessionId;
-                    logger.info({ hasSessionId: true }, "Loaded persistent session ID from storage");
+                    logger.info({ sessionId: this.sessionId }, "Loaded persistent session ID from storage");
                     return;
                 }
                 else {
-                    // Generate a unique session ID for this Durable Object instance
-                    this.sessionId = FigmaConsoleMCPv3.generateStateToken();
+                    // Store the fixed session ID
+                    this.sessionId = FIXED_SESSION_ID;
                     await storage.put('sessionId', this.sessionId);
-                    logger.info({ hasSessionId: true }, "Initialized unique session ID");
+                    logger.info({ sessionId: this.sessionId }, "Initialized fixed session ID");
                     return;
                 }
             }
@@ -148,9 +138,9 @@ export class FigmaConsoleMCPv3 extends McpAgent {
                 logger.warn({ error: e }, "Failed to access Durable Object storage for session ID");
             }
         }
-        // Fallback: generate unique session ID without persistence
-        this.sessionId = FigmaConsoleMCPv3.generateStateToken();
-        logger.info({ hasSessionId: true }, "Using generated session ID (storage unavailable)");
+        // Fallback: use fixed session ID directly
+        this.sessionId = FIXED_SESSION_ID;
+        logger.info({ sessionId: this.sessionId }, "Using fixed session ID (storage unavailable)");
     }
     /**
      * Get session ID for this Durable Object instance
@@ -777,746 +767,710 @@ export class FigmaConsoleMCPv3 extends McpAgent {
  */
 export default {
     async fetch(request, env, ctx) {
-        const response = await handleRequest(request, env, ctx);
-        return withSecurityHeaders(response);
-    }
-};
-async function handleRequest(request, env, ctx) {
-    const url = new URL(request.url);
-    // Use canonical origin for OAuth redirect URIs so they match the Figma OAuth app config
-    // regardless of whether the request comes via workers.dev or custom domain
-    const oauthOrigin = env.CANONICAL_ORIGIN || url.origin;
-    // Redirect /docs to subdomain
-    if (url.pathname === "/docs" || url.pathname.startsWith("/docs/")) {
-        const newPath = url.pathname.replace(/^\/docs\/?/, "/");
-        const redirectUrl = `https://docs.figma-console-mcp.southleft.com${newPath}${url.search}`;
-        return Response.redirect(redirectUrl, 301);
-    }
-    // ================================================================
-    // Cloud Write Relay — Plugin WebSocket pairing endpoint
-    // ================================================================
-    if (url.pathname === "/ws/pair") {
-        const code = url.searchParams.get("code");
-        if (!code) {
-            return new Response(JSON.stringify({ error: "Missing pairing code" }), {
-                status: 400,
-                headers: { "Content-Type": "application/json" },
-            });
-        }
-        // Look up pairing code in KV
-        const pairingKey = `pairing:${code.toUpperCase()}`;
-        const relayDoId = await env.OAUTH_TOKENS.get(pairingKey);
-        if (!relayDoId) {
-            return new Response(JSON.stringify({ error: "Invalid or expired pairing code" }), {
-                status: 404,
-                headers: { "Content-Type": "application/json" },
-            });
+        const url = new URL(request.url);
+        // Use canonical origin for OAuth redirect URIs so they match the Figma OAuth app config
+        // regardless of whether the request comes via workers.dev or custom domain
+        const oauthOrigin = env.CANONICAL_ORIGIN || url.origin;
+        // Redirect /docs to subdomain
+        if (url.pathname === "/docs" || url.pathname.startsWith("/docs/")) {
+            const newPath = url.pathname.replace(/^\/docs\/?/, "/");
+            const redirectUrl = `https://docs.figma-console-mcp.southleft.com${newPath}${url.search}`;
+            return Response.redirect(redirectUrl, 301);
         }
-        // Delete used code (one-time use)
-        await env.OAUTH_TOKENS.delete(pairingKey);
-        // Forward WebSocket upgrade to the relay DO
-        const doId = env.PLUGIN_RELAY.idFromString(relayDoId);
-        const stub = env.PLUGIN_RELAY.get(doId);
-        // Rewrite URL to the relay DO's /ws/connect path
-        const relayUrl = new URL(request.url);
-        relayUrl.pathname = "/ws/connect";
-        const relayRequest = new Request(relayUrl.toString(), request);
-        return stub.fetch(relayRequest);
-    }
-    // SSE endpoint for remote MCP clients
-    // Per MCP spec, we MUST validate Bearer tokens on every HTTP request
-    if (url.pathname === "/sse" || url.pathname === "/sse/message") {
-        // Validate Authorization header per MCP OAuth 2.1 spec
-        const authHeader = request.headers.get("Authorization");
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-            logger.warn({ pathname: url.pathname }, "SSE request missing Authorization header - returning 401 with resource_metadata");
-            // MCP spec requires resource_metadata URL in WWW-Authenticate header (RFC9728)
-            const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
-            return new Response(JSON.stringify({
-                error: "unauthorized",
-                error_description: "Authorization header with Bearer token is required"
-            }), {
-                status: 401,
-                headers: {
-                    "Content-Type": "application/json",
-                    "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
-                }
-            });
+        // ================================================================
+        // Cloud Write Relay — Plugin WebSocket pairing endpoint
+        // ================================================================
+        if (url.pathname === "/ws/pair") {
+            const code = url.searchParams.get("code");
+            if (!code) {
+                return new Response(JSON.stringify({ error: "Missing pairing code" }), {
+                    status: 400,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Look up pairing code in KV
+            const pairingKey = `pairing:${code.toUpperCase()}`;
+            const relayDoId = await env.OAUTH_TOKENS.get(pairingKey);
+            if (!relayDoId) {
+                return new Response(JSON.stringify({ error: "Invalid or expired pairing code" }), {
+                    status: 404,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            // Delete used code (one-time use)
+            await env.OAUTH_TOKENS.delete(pairingKey);
+            // Forward WebSocket upgrade to the relay DO
+            const doId = env.PLUGIN_RELAY.idFromString(relayDoId);
+            const stub = env.PLUGIN_RELAY.get(doId);
+            // Rewrite URL to the relay DO's /ws/connect path
+            const relayUrl = new URL(request.url);
+            relayUrl.pathname = "/ws/connect";
+            const relayRequest = new Request(relayUrl.toString(), request);
+            return stub.fetch(relayRequest);
         }
-        const bearerToken = authHeader.substring(7); // Remove "Bearer " prefix
-        const bearerKey = `bearer_token:${bearerToken}`;
-        try {
-            const tokenDataJson = await env.OAUTH_TOKENS.get(bearerKey);
-            if (!tokenDataJson) {
-                logger.warn({ pathname: url.pathname }, "SSE request with invalid Bearer token");
+        // SSE endpoint for remote MCP clients
+        // Per MCP spec, we MUST validate Bearer tokens on every HTTP request
+        if (url.pathname === "/sse" || url.pathname === "/sse/message") {
+            // Validate Authorization header per MCP OAuth 2.1 spec
+            const authHeader = request.headers.get("Authorization");
+            if (!authHeader || !authHeader.startsWith("Bearer ")) {
+                logger.warn({ pathname: url.pathname }, "SSE request missing Authorization header - returning 401 with resource_metadata");
+                // MCP spec requires resource_metadata URL in WWW-Authenticate header (RFC9728)
                 const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
                 return new Response(JSON.stringify({
-                    error: "invalid_token",
-                    error_description: "Bearer token is invalid or expired"
+                    error: "unauthorized",
+                    error_description: "Authorization header with Bearer token is required"
                 }), {
                     status: 401,
                     headers: {
                         "Content-Type": "application/json",
-                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
                     }
                 });
             }
-            const tokenData = JSON.parse(tokenDataJson);
-            // Check if token is expired
-            if (tokenData.expiresAt < Date.now()) {
-                logger.warn({ pathname: url.pathname, sessionId: tokenData.sessionId }, "SSE request with expired Bearer token");
-                const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+            const bearerToken = authHeader.substring(7); // Remove "Bearer " prefix
+            const bearerKey = `bearer_token:${bearerToken}`;
+            try {
+                const tokenDataJson = await env.OAUTH_TOKENS.get(bearerKey);
+                if (!tokenDataJson) {
+                    logger.warn({ pathname: url.pathname }, "SSE request with invalid Bearer token");
+                    const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+                    return new Response(JSON.stringify({
+                        error: "invalid_token",
+                        error_description: "Bearer token is invalid or expired"
+                    }), {
+                        status: 401,
+                        headers: {
+                            "Content-Type": "application/json",
+                            "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        }
+                    });
+                }
+                const tokenData = JSON.parse(tokenDataJson);
+                // Check if token is expired
+                if (tokenData.expiresAt < Date.now()) {
+                    logger.warn({ pathname: url.pathname, sessionId: tokenData.sessionId }, "SSE request with expired Bearer token");
+                    const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+                    return new Response(JSON.stringify({
+                        error: "invalid_token",
+                        error_description: "Bearer token has expired"
+                    }), {
+                        status: 401,
+                        headers: {
+                            "Content-Type": "application/json",
+                            "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        }
+                    });
+                }
+                logger.info({ pathname: url.pathname, sessionId: tokenData.sessionId }, "SSE request authenticated successfully");
+            }
+            catch (error) {
+                logger.error({ error, pathname: url.pathname }, "Error validating Bearer token");
                 return new Response(JSON.stringify({
-                    error: "invalid_token",
-                    error_description: "Bearer token has expired"
+                    error: "server_error",
+                    error_description: "Failed to validate authorization"
                 }), {
-                    status: 401,
-                    headers: {
-                        "Content-Type": "application/json",
-                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
-                    }
+                    status: 500,
+                    headers: { "Content-Type": "application/json" }
                 });
             }
-            logger.info({ pathname: url.pathname, sessionId: tokenData.sessionId }, "SSE request authenticated successfully");
-        }
-        catch (error) {
-            logger.error({ error, pathname: url.pathname }, "Error validating Bearer token");
-            return new Response(JSON.stringify({
-                error: "server_error",
-                error_description: "Failed to validate authorization"
-            }), {
-                status: 500,
-                headers: { "Content-Type": "application/json" }
-            });
+            // Token is valid, proceed with SSE connection
+            return FigmaConsoleMCPv3.serveSSE("/sse").fetch(request, env, ctx);
         }
-        // Token is valid, proceed with SSE connection
-        return FigmaConsoleMCPv3.serveSSE("/sse").fetch(request, env, ctx);
-    }
-    // Streamable HTTP endpoint for MCP communication (current spec)
-    // Supports POST (client→server) and optional GET (server→client SSE)
-    if (url.pathname === "/mcp") {
-        // Validate Authorization header per MCP OAuth 2.1 spec
-        const authHeader = request.headers.get("Authorization");
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-            logger.warn({ pathname: url.pathname }, "MCP request missing Authorization header - returning 401 with resource_metadata");
-            const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
-            return new Response(JSON.stringify({
-                error: "unauthorized",
-                error_description: "Authorization header with Bearer token is required"
-            }), {
-                status: 401,
-                headers: {
-                    "Content-Type": "application/json",
-                    "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
-                }
-            });
-        }
-        const bearerToken = authHeader.substring(7);
-        const bearerKey = `bearer_token:${bearerToken}`;
-        try {
-            const tokenDataJson = await env.OAUTH_TOKENS.get(bearerKey);
-            if (!tokenDataJson) {
-                logger.warn({ pathname: url.pathname }, "MCP request with invalid Bearer token");
+        // Streamable HTTP endpoint for MCP communication (current spec)
+        // Supports POST (client→server) and optional GET (server→client SSE)
+        if (url.pathname === "/mcp") {
+            // Validate Authorization header per MCP OAuth 2.1 spec
+            const authHeader = request.headers.get("Authorization");
+            if (!authHeader || !authHeader.startsWith("Bearer ")) {
+                logger.warn({ pathname: url.pathname }, "MCP request missing Authorization header - returning 401 with resource_metadata");
                 const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
                 return new Response(JSON.stringify({
-                    error: "invalid_token",
-                    error_description: "Bearer token is invalid or expired"
+                    error: "unauthorized",
+                    error_description: "Authorization header with Bearer token is required"
                 }), {
                     status: 401,
                     headers: {
                         "Content-Type": "application/json",
-                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}"`
                     }
                 });
             }
-            const tokenData = JSON.parse(tokenDataJson);
-            if (tokenData.expiresAt < Date.now()) {
-                logger.warn({ pathname: url.pathname, sessionId: tokenData.sessionId }, "MCP request with expired Bearer token");
-                const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+            const bearerToken = authHeader.substring(7);
+            const bearerKey = `bearer_token:${bearerToken}`;
+            try {
+                const tokenDataJson = await env.OAUTH_TOKENS.get(bearerKey);
+                if (!tokenDataJson) {
+                    logger.warn({ pathname: url.pathname }, "MCP request with invalid Bearer token");
+                    const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+                    return new Response(JSON.stringify({
+                        error: "invalid_token",
+                        error_description: "Bearer token is invalid or expired"
+                    }), {
+                        status: 401,
+                        headers: {
+                            "Content-Type": "application/json",
+                            "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        }
+                    });
+                }
+                const tokenData = JSON.parse(tokenDataJson);
+                if (tokenData.expiresAt < Date.now()) {
+                    logger.warn({ pathname: url.pathname, sessionId: tokenData.sessionId }, "MCP request with expired Bearer token");
+                    const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+                    return new Response(JSON.stringify({
+                        error: "invalid_token",
+                        error_description: "Bearer token has expired"
+                    }), {
+                        status: 401,
+                        headers: {
+                            "Content-Type": "application/json",
+                            "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
+                        }
+                    });
+                }
+                logger.info({ pathname: url.pathname, sessionId: tokenData.sessionId }, "MCP request authenticated successfully");
+            }
+            catch (error) {
+                logger.error({ error, pathname: url.pathname }, "Error validating Bearer token for MCP endpoint");
                 return new Response(JSON.stringify({
-                    error: "invalid_token",
-                    error_description: "Bearer token has expired"
+                    error: "server_error",
+                    error_description: "Failed to validate authorization"
                 }), {
-                    status: 401,
-                    headers: {
-                        "Content-Type": "application/json",
-                        "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token"`
-                    }
+                    status: 500,
+                    headers: { "Content-Type": "application/json" }
                 });
             }
-            logger.info({ pathname: url.pathname, sessionId: tokenData.sessionId }, "MCP request authenticated successfully");
-        }
-        catch (error) {
-            logger.error({ error, pathname: url.pathname }, "Error validating Bearer token for MCP endpoint");
-            return new Response(JSON.stringify({
-                error: "server_error",
-                error_description: "Failed to validate authorization"
-            }), {
-                status: 500,
-                headers: { "Content-Type": "application/json" }
+            // Token is valid — use stateless transport (no Durable Objects)
+            // The Bearer token IS the Figma access token, so we use it directly
+            const figmaAccessToken = bearerToken;
+            const statelessApi = new FigmaAPI({ accessToken: figmaAccessToken });
+            const transport = new WebStandardStreamableHTTPServerTransport({
+                sessionIdGenerator: undefined, // Stateless — no session persistence needed
             });
-        }
-        // Token is valid — use stateless transport (no Durable Objects)
-        // The Bearer token IS the Figma access token, so we use it directly
-        const figmaAccessToken = bearerToken;
-        const statelessApi = new FigmaAPI({ accessToken: figmaAccessToken });
-        const transport = new WebStandardStreamableHTTPServerTransport({
-            sessionIdGenerator: undefined, // Stateless — no session persistence needed
-        });
-        const statelessServer = new McpServer({
-            name: "Figma Console MCP",
-            version: "1.13.0",
-        });
-        // ================================================================
-        // Cloud Write Relay — Pairing Tool (stateless /mcp path)
-        // Uses KV keyed by bearer token instead of DO storage
-        // ================================================================
-        statelessServer.tool("figma_pair_plugin", "Pair the Figma Desktop Bridge plugin to this cloud session for write access. Returns a 6-character code the user enters in the plugin's Cloud Mode section.", {}, async () => {
+            const statelessServer = new McpServer({
+                name: "Figma Console MCP",
+                version: "1.15.0",
+            });
+            // ================================================================
+            // Cloud Write Relay — Pairing Tool (stateless /mcp path)
+            // Uses KV keyed by bearer token instead of DO storage
+            // ================================================================
+            statelessServer.tool("figma_pair_plugin", "Pair the Figma Desktop Bridge plugin to this cloud session for write access. Returns a 6-character code the user enters in the plugin's Cloud Mode section.", {}, async () => {
+                try {
+                    const code = generatePairingCode();
+                    const relayDoId = env.PLUGIN_RELAY.newUniqueId().toString();
+                    // Store pairing code → relay DO ID in KV (5-min TTL, one-time use)
+                    await env.OAUTH_TOKENS.put(`pairing:${code}`, relayDoId, {
+                        expirationTtl: 300,
+                    });
+                    // Store relay DO ID keyed by bearer token for session persistence
+                    await env.OAUTH_TOKENS.put(`relay:${bearerToken}`, relayDoId, {
+                        expirationTtl: 86400, // 24h — matches typical session length
+                    });
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({
+                                    pairingCode: code,
+                                    expiresIn: "5 minutes",
+                                    instructions: [
+                                        "1. Open the MCP Bridge plugin in Figma Desktop",
+                                        "2. Click the '▶ Cloud Mode' toggle in the plugin UI",
+                                        `3. Enter pairing code: ${code}`,
+                                        "4. Click 'Connect' — the plugin will connect to the cloud relay",
+                                        "5. Once paired, write tools (variables, components, nodes) work through the cloud"
+                                    ],
+                                }, null, 2),
+                            }],
+                    };
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    return {
+                        content: [{ type: "text", text: JSON.stringify({ error: errorMessage }) }],
+                        isError: true,
+                    };
+                }
+            });
+            // Cloud Desktop Connector factory (stateless /mcp path)
+            const getCloudDesktopConnector = async () => {
+                const relayDoId = await env.OAUTH_TOKENS.get(`relay:${bearerToken}`);
+                if (!relayDoId) {
+                    throw new Error('No cloud relay session. Call figma_pair_plugin first to pair the Desktop Bridge plugin.');
+                }
+                const doId = env.PLUGIN_RELAY.idFromString(relayDoId);
+                const stub = env.PLUGIN_RELAY.get(doId);
+                const connector = new CloudWebSocketConnector(stub);
+                await connector.initialize();
+                return connector;
+            };
+            // Build a getCurrentUrl that resolves from the relay DO's file info
+            const getCloudFileUrl = () => {
+                // This is synchronous — we cache the file URL after first relay status check
+                return cloudFileUrlCache;
+            };
+            let cloudFileUrlCache = null;
+            // Pre-fetch file info from relay if paired
             try {
-                const code = generatePairingCode();
-                const relayDoId = env.PLUGIN_RELAY.newUniqueId().toString();
-                // Store pairing code → relay DO ID in KV (5-min TTL, one-time use)
-                await env.OAUTH_TOKENS.put(`pairing:${code}`, relayDoId, {
-                    expirationTtl: 300,
-                });
-                // Store relay DO ID keyed by bearer token for session persistence
-                await env.OAUTH_TOKENS.put(`relay:${bearerToken}`, relayDoId, {
-                    expirationTtl: 86400, // 24h — matches typical session length
-                });
-                return {
-                    content: [{
-                            type: "text",
-                            text: JSON.stringify({
-                                pairingCode: code,
-                                expiresIn: "5 minutes",
-                                instructions: [
-                                    "1. Open the MCP Bridge plugin in Figma Desktop",
-                                    "2. Click the '▶ Cloud Mode' toggle in the plugin UI",
-                                    `3. Enter pairing code: ${code}`,
-                                    "4. Click 'Connect' — the plugin will connect to the cloud relay",
-                                    "5. Once paired, write tools (variables, components, nodes) work through the cloud"
-                                ],
-                            }, null, 2),
-                        }],
-                };
+                const relayDoId = await env.OAUTH_TOKENS.get(`relay:${bearerToken}`);
+                if (relayDoId) {
+                    const doId = env.PLUGIN_RELAY.idFromString(relayDoId);
+                    const stub = env.PLUGIN_RELAY.get(doId);
+                    const statusRes = await stub.fetch('https://relay/relay/status');
+                    const status = await statusRes.json();
+                    if (status.connected && status.fileInfo?.fileKey) {
+                        cloudFileUrlCache = `https://www.figma.com/design/${status.fileInfo.fileKey}`;
+                    }
+                }
             }
-            catch (error) {
-                const errorMessage = error instanceof Error ? error.message : String(error);
-                return {
-                    content: [{ type: "text", text: JSON.stringify({ error: errorMessage }) }],
-                    isError: true,
-                };
+            catch {
+                // No relay session or not paired — cloudFileUrlCache stays null
             }
-        });
-        // Cloud Desktop Connector factory (stateless /mcp path)
-        const getCloudDesktopConnector = async () => {
-            const relayDoId = await env.OAUTH_TOKENS.get(`relay:${bearerToken}`);
-            if (!relayDoId) {
-                throw new Error('No cloud relay session. Call figma_pair_plugin first to pair the Desktop Bridge plugin.');
+            // Register all write/manipulation tools via shared function
+            registerWriteTools(statelessServer, getCloudDesktopConnector);
+            // Register REST API tools with the authenticated Figma API
+            registerFigmaAPITools(statelessServer, async () => statelessApi, getCloudFileUrl, () => null, // No console monitor
+            () => null, // No browser manager
+            undefined, // No ensureInitialized
+            new Map(), // Fresh variables cache per request
+            { isRemoteMode: true }, getCloudDesktopConnector);
+            registerDesignCodeTools(statelessServer, async () => statelessApi, getCloudFileUrl, new Map(), // Fresh variables cache per request
+            { isRemoteMode: true }, getCloudDesktopConnector);
+            registerCommentTools(statelessServer, async () => statelessApi, getCloudFileUrl);
+            registerDesignSystemTools(statelessServer, async () => statelessApi, getCloudFileUrl, new Map(), // Fresh variables cache per request
+            { isRemoteMode: true });
+            await statelessServer.connect(transport);
+            const response = await transport.handleRequest(request);
+            if (response) {
+                return response;
             }
-            const doId = env.PLUGIN_RELAY.idFromString(relayDoId);
-            const stub = env.PLUGIN_RELAY.get(doId);
-            const connector = new CloudWebSocketConnector(stub);
-            await connector.initialize();
-            return connector;
-        };
-        // Register all write/manipulation tools via shared function
-        registerWriteTools(statelessServer, getCloudDesktopConnector);
-        // Register REST API tools with the authenticated Figma API
-        registerFigmaAPITools(statelessServer, async () => statelessApi, () => null, // No browser URL in stateless mode
-        () => null, // No console monitor
-        () => null, // No browser manager
-        undefined, // No ensureInitialized
-        new Map(), // Fresh variables cache per request
-        { isRemoteMode: true }, getCloudDesktopConnector);
-        registerDesignCodeTools(statelessServer, async () => statelessApi, () => null, new Map(), // Fresh variables cache per request
-        { isRemoteMode: true }, getCloudDesktopConnector);
-        registerCommentTools(statelessServer, async () => statelessApi, () => null);
-        registerDesignSystemTools(statelessServer, async () => statelessApi, () => null, new Map(), // Fresh variables cache per request
-        { isRemoteMode: true });
-        await statelessServer.connect(transport);
-        const response = await transport.handleRequest(request);
-        if (response) {
-            return response;
+            return new Response("No response from MCP transport", { status: 500 });
         }
-        return new Response("No response from MCP transport", { status: 500 });
-    }
-    // ============================================================
-    // MCP OAuth 2.1 Spec-Compliant Endpoints
-    // These endpoints follow the MCP Authorization specification
-    // for compatibility with mcp-remote and Claude Code
-    // ============================================================
-    // Protected Resource Metadata (RFC9728)
-    // Required by MCP spec for OAuth discovery - tells clients where to find authorization server
-    if (url.pathname === "/.well-known/oauth-protected-resource" ||
-        url.pathname.startsWith("/.well-known/oauth-protected-resource/")) {
-        const metadata = {
-            resource: url.origin,
-            authorization_servers: [`${url.origin}/`],
-            scopes_supported: ["file_content:read", "library_content:read", "file_variables:read"],
-            bearer_methods_supported: ["header"],
-            resource_signing_alg_values_supported: ["RS256"]
-        };
-        return new Response(JSON.stringify(metadata, null, 2), {
-            headers: {
-                "Content-Type": "application/json",
-                "Cache-Control": "public, max-age=3600"
-            }
-        });
-    }
-    // OAuth 2.0 Authorization Server Metadata (RFC8414)
-    // Required by MCP spec for client discovery
-    if (url.pathname === "/.well-known/oauth-authorization-server") {
-        const metadata = {
-            issuer: url.origin,
-            authorization_endpoint: `${url.origin}/authorize`,
-            token_endpoint: `${url.origin}/token`,
-            registration_endpoint: `${url.origin}/oauth/register`,
-            scopes_supported: ["file_content:read", "library_content:read", "file_variables:read"],
-            response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code", "refresh_token"],
-            token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
-            code_challenge_methods_supported: ["S256"],
-            service_documentation: "https://docs.figma-console-mcp.southleft.com",
-        };
-        return new Response(JSON.stringify(metadata, null, 2), {
-            headers: {
-                "Content-Type": "application/json",
-                "Cache-Control": "public, max-age=3600"
-            }
-        });
-    }
-    // MCP-compliant /authorize endpoint
-    // Handles authorization requests from MCP clients
-    if (url.pathname === "/authorize") {
-        const clientId = url.searchParams.get("client_id");
-        const redirectUri = url.searchParams.get("redirect_uri");
-        const state = url.searchParams.get("state");
-        const codeChallenge = url.searchParams.get("code_challenge");
-        const codeChallengeMethod = url.searchParams.get("code_challenge_method");
-        const scope = url.searchParams.get("scope");
-        // For MCP clients, use the client_id as the session identifier
-        // This allows token retrieval after the OAuth flow completes
-        const sessionId = clientId || FigmaConsoleMCPv3.generateStateToken();
-        // Store the MCP client's redirect_uri and state for the callback
-        if (redirectUri && state) {
-            // SEC-004: Validate redirect_uri against the registered client's allowed list
-            if (clientId) {
-                const clientJson = await env.OAUTH_STATE.get(`client:${clientId}`);
-                if (clientJson) {
-                    const clientData = JSON.parse(clientJson);
-                    if (clientData.redirect_uris.length > 0 && !clientData.redirect_uris.includes(redirectUri)) {
-                        return new Response(JSON.stringify({ error: "invalid_request", error_description: "redirect_uri does not match registered redirect URIs" }), {
-                            status: 400, headers: { "Content-Type": "application/json" }
-                        });
-                    }
-                }
-            }
-            const mcpAuthData = {
-                redirectUri,
-                state,
-                codeChallenge,
-                codeChallengeMethod,
-                scope,
-                clientId,
-                sessionId
+        // ============================================================
+        // MCP OAuth 2.1 Spec-Compliant Endpoints
+        // These endpoints follow the MCP Authorization specification
+        // for compatibility with mcp-remote and Claude Code
+        // ============================================================
+        // Protected Resource Metadata (RFC9728)
+        // Required by MCP spec for OAuth discovery - tells clients where to find authorization server
+        if (url.pathname === "/.well-known/oauth-protected-resource" ||
+            url.pathname.startsWith("/.well-known/oauth-protected-resource/")) {
+            const metadata = {
+                resource: url.origin,
+                authorization_servers: [`${url.origin}/`],
+                scopes_supported: ["file_content:read", "file_variables:read", "library_content:read"],
+                bearer_methods_supported: ["header"],
+                resource_signing_alg_values_supported: ["RS256"]
             };
-            // Store with 10 minute expiration
-            const mcpStateKey = `mcp_auth:${sessionId}`;
-            await env.OAUTH_STATE.put(mcpStateKey, JSON.stringify(mcpAuthData), {
-                expirationTtl: 600
+            return new Response(JSON.stringify(metadata, null, 2), {
+                headers: {
+                    "Content-Type": "application/json",
+                    "Cache-Control": "public, max-age=3600"
+                }
             });
         }
-        // Check if OAuth credentials are configured
-        if (!env.FIGMA_OAUTH_CLIENT_ID) {
-            return new Response(JSON.stringify({
-                error: "server_error",
-                error_description: "OAuth not configured on server"
-            }), {
-                status: 500,
-                headers: { "Content-Type": "application/json" }
+        // OAuth 2.0 Authorization Server Metadata (RFC8414)
+        // Required by MCP spec for client discovery
+        if (url.pathname === "/.well-known/oauth-authorization-server") {
+            const metadata = {
+                issuer: url.origin,
+                authorization_endpoint: `${url.origin}/authorize`,
+                token_endpoint: `${url.origin}/token`,
+                registration_endpoint: `${url.origin}/oauth/register`,
+                scopes_supported: ["file_content:read", "file_variables:read", "library_content:read"],
+                response_types_supported: ["code"],
+                grant_types_supported: ["authorization_code", "refresh_token"],
+                token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+                code_challenge_methods_supported: ["S256"],
+                service_documentation: "https://docs.figma-console-mcp.southleft.com",
+            };
+            return new Response(JSON.stringify(metadata, null, 2), {
+                headers: {
+                    "Content-Type": "application/json",
+                    "Cache-Control": "public, max-age=3600"
+                }
             });
         }
-        // Generate CSRF protection token
-        const stateToken = FigmaConsoleMCPv3.generateStateToken();
-        // Store state token with sessionId (10 minute expiration)
-        await env.OAUTH_STATE.put(stateToken, sessionId, {
-            expirationTtl: 600
-        });
-        // Redirect to Figma OAuth
-        const figmaAuthUrl = new URL("https://www.figma.com/oauth");
-        figmaAuthUrl.searchParams.set("client_id", env.FIGMA_OAUTH_CLIENT_ID);
-        figmaAuthUrl.searchParams.set("redirect_uri", `${oauthOrigin}/oauth/callback`);
-        figmaAuthUrl.searchParams.set("scope", "file_content:read,library_content:read,file_variables:read");
-        figmaAuthUrl.searchParams.set("state", stateToken);
-        figmaAuthUrl.searchParams.set("response_type", "code");
-        return Response.redirect(figmaAuthUrl.toString(), 302);
-    }
-    // MCP-compliant /token endpoint
-    // Handles token exchange and refresh requests
-    if (url.pathname === "/token" && request.method === "POST") {
-        const contentType = request.headers.get("content-type") || "";
-        let params;
-        if (contentType.includes("application/x-www-form-urlencoded")) {
-            params = new URLSearchParams(await request.text());
-        }
-        else if (contentType.includes("application/json")) {
-            const body = await request.json();
-            params = new URLSearchParams(body);
-        }
-        else {
-            params = new URLSearchParams(await request.text());
-        }
-        const grantType = params.get("grant_type");
-        const clientId = params.get("client_id");
-        const code = params.get("code");
-        const codeVerifier = params.get("code_verifier");
-        const refreshToken = params.get("refresh_token");
-        // For authorization_code grant, exchange the code for tokens
-        if (grantType === "authorization_code" && code) {
-            // The code here is actually our session-based token
-            // Look up the stored token by session/client ID
-            const sessionId = clientId || code;
-            const tokenKey = `oauth_token:${sessionId}`;
-            logger.info({ grantType, clientId, hasCode: !!code, sessionId }, "Token exchange request");
-            // PKCE verification (SEC-003): if a code_challenge was stored, verify code_verifier now
-            const mcpStateKey = `mcp_auth:${sessionId}`;
-            const mcpAuthJson = await env.OAUTH_STATE.get(mcpStateKey);
-            if (mcpAuthJson) {
-                const mcpAuthData = JSON.parse(mcpAuthJson);
-                if (mcpAuthData.codeChallenge) {
-                    if (!codeVerifier) {
-                        return new Response(JSON.stringify({ error: "invalid_request", error_description: "code_verifier required" }), {
-                            status: 400, headers: { "Content-Type": "application/json" }
-                        });
-                    }
-                    // Verify S256: BASE64URL(SHA-256(code_verifier)) === code_challenge
-                    const encoder = new TextEncoder();
-                    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(codeVerifier));
-                    const computed = btoa(String.fromCharCode(...new Uint8Array(digest)))
-                        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-                    if (computed !== mcpAuthData.codeChallenge) {
-                        return new Response(JSON.stringify({ error: "invalid_grant", error_description: "PKCE verification failed" }), {
-                            status: 400, headers: { "Content-Type": "application/json" }
-                        });
-                    }
-                }
-            }
-            const tokenJson = await env.OAUTH_TOKENS.get(tokenKey);
-            logger.info({ tokenKey, hasToken: !!tokenJson }, "Token lookup result");
-            if (tokenJson) {
-                const tokenData = JSON.parse(tokenJson);
-                // Return tokens in OAuth 2.0 format
-                return new Response(JSON.stringify({
-                    access_token: tokenData.accessToken,
-                    token_type: "Bearer",
-                    expires_in: Math.max(0, Math.floor((tokenData.expiresAt - Date.now()) / 1000)),
-                    refresh_token: tokenData.refreshToken,
-                    scope: "file_content:read library_content:read file_variables:read"
-                }), {
-                    headers: {
-                        "Content-Type": "application/json",
-                        "Cache-Control": "no-store"
-                    }
+        // MCP-compliant /authorize endpoint
+        // Handles authorization requests from MCP clients
+        if (url.pathname === "/authorize") {
+            const clientId = url.searchParams.get("client_id");
+            const redirectUri = url.searchParams.get("redirect_uri");
+            const state = url.searchParams.get("state");
+            const codeChallenge = url.searchParams.get("code_challenge");
+            const codeChallengeMethod = url.searchParams.get("code_challenge_method");
+            const scope = url.searchParams.get("scope");
+            // For MCP clients, use the client_id as the session identifier
+            // This allows token retrieval after the OAuth flow completes
+            const sessionId = clientId || FigmaConsoleMCPv3.generateStateToken();
+            // Store the MCP client's redirect_uri and state for the callback
+            if (redirectUri && state) {
+                const mcpAuthData = {
+                    redirectUri,
+                    state,
+                    codeChallenge,
+                    codeChallengeMethod,
+                    scope,
+                    clientId,
+                    sessionId
+                };
+                // Store with 10 minute expiration
+                const mcpStateKey = `mcp_auth:${sessionId}`;
+                await env.OAUTH_STATE.put(mcpStateKey, JSON.stringify(mcpAuthData), {
+                    expirationTtl: 600
                 });
             }
-            logger.error({ sessionId, clientId, hasCode: !!code }, "Token not found for exchange");
-            return new Response(JSON.stringify({
-                error: "invalid_grant",
-                error_description: "Authorization code not found or expired. Please re-authenticate."
-            }), {
-                status: 400,
-                headers: { "Content-Type": "application/json" }
-            });
-        }
-        // For refresh_token grant
-        if (grantType === "refresh_token" && refreshToken) {
-            if (!env.FIGMA_OAUTH_CLIENT_ID || !env.FIGMA_OAUTH_CLIENT_SECRET) {
+            // Check if OAuth credentials are configured
+            if (!env.FIGMA_OAUTH_CLIENT_ID) {
                 return new Response(JSON.stringify({
                     error: "server_error",
-                    error_description: "OAuth not configured"
+                    error_description: "OAuth not configured on server"
                 }), {
                     status: 500,
                     headers: { "Content-Type": "application/json" }
                 });
             }
-            const credentials = btoa(`${env.FIGMA_OAUTH_CLIENT_ID}:${env.FIGMA_OAUTH_CLIENT_SECRET}`);
-            const tokenParams = new URLSearchParams({
-                grant_type: "refresh_token",
-                refresh_token: refreshToken
-            });
-            const tokenResponse = await fetch("https://api.figma.com/v1/oauth/token", {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    "Authorization": `Basic ${credentials}`
-                },
-                body: tokenParams.toString()
+            // Generate CSRF protection token
+            const stateToken = FigmaConsoleMCPv3.generateStateToken();
+            // Store state token with sessionId (10 minute expiration)
+            await env.OAUTH_STATE.put(stateToken, sessionId, {
+                expirationTtl: 600
             });
-            if (!tokenResponse.ok) {
+            // Redirect to Figma OAuth
+            const figmaAuthUrl = new URL("https://www.figma.com/oauth");
+            figmaAuthUrl.searchParams.set("client_id", env.FIGMA_OAUTH_CLIENT_ID);
+            figmaAuthUrl.searchParams.set("redirect_uri", `${oauthOrigin}/oauth/callback`);
+            figmaAuthUrl.searchParams.set("scope", "file_content:read,file_variables:read,library_content:read");
+            figmaAuthUrl.searchParams.set("state", stateToken);
+            figmaAuthUrl.searchParams.set("response_type", "code");
+            return Response.redirect(figmaAuthUrl.toString(), 302);
+        }
+        // MCP-compliant /token endpoint
+        // Handles token exchange and refresh requests
+        if (url.pathname === "/token" && request.method === "POST") {
+            const contentType = request.headers.get("content-type") || "";
+            let params;
+            if (contentType.includes("application/x-www-form-urlencoded")) {
+                params = new URLSearchParams(await request.text());
+            }
+            else if (contentType.includes("application/json")) {
+                const body = await request.json();
+                params = new URLSearchParams(body);
+            }
+            else {
+                params = new URLSearchParams(await request.text());
+            }
+            const grantType = params.get("grant_type");
+            const clientId = params.get("client_id");
+            const code = params.get("code");
+            const refreshToken = params.get("refresh_token");
+            // For authorization_code grant, exchange the code for tokens
+            if (grantType === "authorization_code" && code) {
+                // The code here is actually our session-based token
+                // Look up the stored token by session/client ID
+                const sessionId = clientId || code;
+                const tokenKey = `oauth_token:${sessionId}`;
+                logger.info({ grantType, clientId, code, sessionId, tokenKey }, "Token exchange request");
+                const tokenJson = await env.OAUTH_TOKENS.get(tokenKey);
+                logger.info({ tokenKey, hasToken: !!tokenJson }, "Token lookup result");
+                if (tokenJson) {
+                    const tokenData = JSON.parse(tokenJson);
+                    // Return tokens in OAuth 2.0 format
+                    return new Response(JSON.stringify({
+                        access_token: tokenData.accessToken,
+                        token_type: "Bearer",
+                        expires_in: Math.max(0, Math.floor((tokenData.expiresAt - Date.now()) / 1000)),
+                        refresh_token: tokenData.refreshToken,
+                        scope: "file_content:read file_variables:read library_content:read"
+                    }), {
+                        headers: {
+                            "Content-Type": "application/json",
+                            "Cache-Control": "no-store"
+                        }
+                    });
+                }
+                logger.error({ tokenKey, sessionId, clientId, code }, "Token not found for exchange");
                 return new Response(JSON.stringify({
                     error: "invalid_grant",
-                    error_description: "Failed to refresh token"
+                    error_description: "Authorization code not found or expired. Please re-authenticate."
                 }), {
                     status: 400,
                     headers: { "Content-Type": "application/json" }
                 });
             }
-            const tokenData = await tokenResponse.json();
-            // Store the refreshed token
-            if (clientId) {
-                const tokenKey = `oauth_token:${clientId}`;
-                const expiresAt = Date.now() + (tokenData.expires_in * 1000);
-                const storedToken = {
-                    accessToken: tokenData.access_token,
-                    refreshToken: tokenData.refresh_token || refreshToken,
-                    expiresAt
-                };
-                await env.OAUTH_TOKENS.put(tokenKey, JSON.stringify(storedToken), {
-                    expirationTtl: tokenData.expires_in
+            // For refresh_token grant
+            if (grantType === "refresh_token" && refreshToken) {
+                if (!env.FIGMA_OAUTH_CLIENT_ID || !env.FIGMA_OAUTH_CLIENT_SECRET) {
+                    return new Response(JSON.stringify({
+                        error: "server_error",
+                        error_description: "OAuth not configured"
+                    }), {
+                        status: 500,
+                        headers: { "Content-Type": "application/json" }
+                    });
+                }
+                const credentials = btoa(`${env.FIGMA_OAUTH_CLIENT_ID}:${env.FIGMA_OAUTH_CLIENT_SECRET}`);
+                const tokenParams = new URLSearchParams({
+                    grant_type: "refresh_token",
+                    refresh_token: refreshToken
                 });
-                // Store reverse lookup for Bearer token validation on SSE endpoint
-                const bearerKey = `bearer_token:${tokenData.access_token}`;
-                await env.OAUTH_TOKENS.put(bearerKey, JSON.stringify({
-                    sessionId: clientId,
-                    expiresAt
-                }), {
-                    expirationTtl: tokenData.expires_in
+                const tokenResponse = await fetch("https://api.figma.com/v1/oauth/token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Authorization": `Basic ${credentials}`
+                    },
+                    body: tokenParams.toString()
                 });
-            }
-            return new Response(JSON.stringify({
-                access_token: tokenData.access_token,
-                token_type: "Bearer",
-                expires_in: tokenData.expires_in,
-                refresh_token: tokenData.refresh_token || refreshToken,
-                scope: "file_content:read library_content:read file_variables:read"
-            }), {
-                headers: {
-                    "Content-Type": "application/json",
-                    "Cache-Control": "no-store"
-                }
-            });
-        }
-        return new Response(JSON.stringify({
-            error: "unsupported_grant_type",
-            error_description: "Only authorization_code and refresh_token grants are supported"
-        }), {
-            status: 400,
-            headers: { "Content-Type": "application/json" }
-        });
-    }
-    // Dynamic Client Registration (RFC7591)
-    // Required by MCP spec for clients to register
-    if (url.pathname === "/oauth/register" && request.method === "POST") {
-        const body = await request.json();
-        // Validate redirect_uris (SEC-011): reject non-HTTPS URIs and fragments
-        const rawUris = body.redirect_uris || [];
-        const validatedUris = [];
-        for (const uri of rawUris) {
-            try {
-                const parsed = new URL(uri);
-                if (parsed.hash) {
-                    return new Response(JSON.stringify({ error: "invalid_redirect_uri", error_description: "redirect_uri must not contain a fragment" }), {
-                        status: 400, headers: { "Content-Type": "application/json" }
+                if (!tokenResponse.ok) {
+                    return new Response(JSON.stringify({
+                        error: "invalid_grant",
+                        error_description: "Failed to refresh token"
+                    }), {
+                        status: 400,
+                        headers: { "Content-Type": "application/json" }
                     });
                 }
-                if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && parsed.hostname === "localhost")) {
-                    return new Response(JSON.stringify({ error: "invalid_redirect_uri", error_description: "redirect_uri must use https (or http://localhost)" }), {
-                        status: 400, headers: { "Content-Type": "application/json" }
+                const tokenData = await tokenResponse.json();
+                // Store the refreshed token
+                if (clientId) {
+                    const tokenKey = `oauth_token:${clientId}`;
+                    const expiresAt = Date.now() + (tokenData.expires_in * 1000);
+                    const storedToken = {
+                        accessToken: tokenData.access_token,
+                        refreshToken: tokenData.refresh_token || refreshToken,
+                        expiresAt
+                    };
+                    await env.OAUTH_TOKENS.put(tokenKey, JSON.stringify(storedToken), {
+                        expirationTtl: tokenData.expires_in
+                    });
+                    // Store reverse lookup for Bearer token validation on SSE endpoint
+                    const bearerKey = `bearer_token:${tokenData.access_token}`;
+                    await env.OAUTH_TOKENS.put(bearerKey, JSON.stringify({
+                        sessionId: clientId,
+                        expiresAt
+                    }), {
+                        expirationTtl: tokenData.expires_in
                     });
                 }
-                validatedUris.push(uri);
-            }
-            catch {
-                return new Response(JSON.stringify({ error: "invalid_redirect_uri", error_description: "redirect_uri is not a valid URL" }), {
-                    status: 400, headers: { "Content-Type": "application/json" }
+                return new Response(JSON.stringify({
+                    access_token: tokenData.access_token,
+                    token_type: "Bearer",
+                    expires_in: tokenData.expires_in,
+                    refresh_token: tokenData.refresh_token || refreshToken,
+                    scope: "file_content:read file_variables:read library_content:read"
+                }), {
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Cache-Control": "no-store"
+                    }
                 });
             }
+            return new Response(JSON.stringify({
+                error: "unsupported_grant_type",
+                error_description: "Only authorization_code and refresh_token grants are supported"
+            }), {
+                status: 400,
+                headers: { "Content-Type": "application/json" }
+            });
         }
-        // Generate a client ID for this registration
-        const clientId = `mcp_${FigmaConsoleMCPv3.generateStateToken().substring(0, 16)}`;
-        // Store client registration (30 day expiration)
-        await env.OAUTH_STATE.put(`client:${clientId}`, JSON.stringify({
-            client_name: body.client_name || "MCP Client",
-            redirect_uris: validatedUris,
-            created_at: Date.now()
-        }), {
-            expirationTtl: 30 * 24 * 60 * 60
-        });
-        return new Response(JSON.stringify({
-            client_id: clientId,
-            client_name: body.client_name || "MCP Client",
-            redirect_uris: body.redirect_uris || [],
-            token_endpoint_auth_method: "none",
-            grant_types: ["authorization_code", "refresh_token"],
-            response_types: ["code"]
-        }), {
-            status: 201,
-            headers: { "Content-Type": "application/json" }
-        });
-    }
-    // ============================================================
-    // Original Figma OAuth Endpoints (kept for backwards compatibility)
-    // ============================================================
-    // OAuth authorization initiation
-    if (url.pathname === "/oauth/authorize") {
-        const sessionId = url.searchParams.get("session_id");
-        if (!sessionId) {
-            return new Response("Missing session_id parameter", { status: 400 });
-        }
-        // Check if OAuth credentials are configured
-        if (!env.FIGMA_OAUTH_CLIENT_ID) {
+        // Dynamic Client Registration (RFC7591)
+        // Required by MCP spec for clients to register
+        if (url.pathname === "/oauth/register" && request.method === "POST") {
+            const body = await request.json();
+            // Generate a client ID for this registration
+            const clientId = `mcp_${FigmaConsoleMCPv3.generateStateToken().substring(0, 16)}`;
+            // Store client registration (30 day expiration)
+            await env.OAUTH_STATE.put(`client:${clientId}`, JSON.stringify({
+                client_name: body.client_name || "MCP Client",
+                redirect_uris: body.redirect_uris || [],
+                created_at: Date.now()
+            }), {
+                expirationTtl: 30 * 24 * 60 * 60
+            });
             return new Response(JSON.stringify({
-                error: "OAuth not configured",
-                message: "Server administrator needs to configure FIGMA_OAUTH_CLIENT_ID",
-                docs: "https://github.com/southleft/figma-console-mcp#oauth-setup"
+                client_id: clientId,
+                client_name: body.client_name || "MCP Client",
+                redirect_uris: body.redirect_uris || [],
+                token_endpoint_auth_method: "none",
+                grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"]
             }), {
-                status: 500,
+                status: 201,
                 headers: { "Content-Type": "application/json" }
             });
         }
-        // Generate cryptographically secure state token for CSRF protection
-        const stateToken = FigmaConsoleMCPv3.generateStateToken();
-        // Store state token with sessionId in KV (10 minute expiration)
-        await env.OAUTH_STATE.put(stateToken, sessionId, {
-            expirationTtl: 600 // 10 minutes
-        });
-        const redirectUri = `${oauthOrigin}/oauth/callback`;
-        const figmaAuthUrl = new URL("https://www.figma.com/oauth");
-        figmaAuthUrl.searchParams.set("client_id", env.FIGMA_OAUTH_CLIENT_ID);
-        figmaAuthUrl.searchParams.set("redirect_uri", redirectUri);
-        figmaAuthUrl.searchParams.set("scope", "file_content:read,library_content:read,file_variables:read");
-        figmaAuthUrl.searchParams.set("state", stateToken);
-        figmaAuthUrl.searchParams.set("response_type", "code");
-        return Response.redirect(figmaAuthUrl.toString(), 302);
-    }
-    // OAuth callback handler
-    if (url.pathname === "/oauth/callback") {
-        const code = url.searchParams.get("code");
-        const stateToken = url.searchParams.get("state");
-        const error = url.searchParams.get("error");
-        // Handle OAuth errors
-        if (error) {
-            const safeError = htmlEscape(error);
-            const safeDesc = htmlEscape(url.searchParams.get("error_description") || "Unknown error");
-            return new Response(`<html><head><meta charset="utf-8"></head><body>
+        // ============================================================
+        // Original Figma OAuth Endpoints (kept for backwards compatibility)
+        // ============================================================
+        // OAuth authorization initiation
+        if (url.pathname === "/oauth/authorize") {
+            const sessionId = url.searchParams.get("session_id");
+            if (!sessionId) {
+                return new Response("Missing session_id parameter", { status: 400 });
+            }
+            // Check if OAuth credentials are configured
+            if (!env.FIGMA_OAUTH_CLIENT_ID) {
+                return new Response(JSON.stringify({
+                    error: "OAuth not configured",
+                    message: "Server administrator needs to configure FIGMA_OAUTH_CLIENT_ID",
+                    docs: "https://github.com/southleft/figma-console-mcp#oauth-setup"
+                }), {
+                    status: 500,
+                    headers: { "Content-Type": "application/json" }
+                });
+            }
+            // Generate cryptographically secure state token for CSRF protection
+            const stateToken = FigmaConsoleMCPv3.generateStateToken();
+            // Store state token with sessionId in KV (10 minute expiration)
+            await env.OAUTH_STATE.put(stateToken, sessionId, {
+                expirationTtl: 600 // 10 minutes
+            });
+            const redirectUri = `${oauthOrigin}/oauth/callback`;
+            const figmaAuthUrl = new URL("https://www.figma.com/oauth");
+            figmaAuthUrl.searchParams.set("client_id", env.FIGMA_OAUTH_CLIENT_ID);
+            figmaAuthUrl.searchParams.set("redirect_uri", redirectUri);
+            figmaAuthUrl.searchParams.set("scope", "file_content:read,file_variables:read,library_content:read");
+            figmaAuthUrl.searchParams.set("state", stateToken);
+            figmaAuthUrl.searchParams.set("response_type", "code");
+            return Response.redirect(figmaAuthUrl.toString(), 302);
+        }
+        // OAuth callback handler
+        if (url.pathname === "/oauth/callback") {
+            const code = url.searchParams.get("code");
+            const stateToken = url.searchParams.get("state");
+            const error = url.searchParams.get("error");
+            // Handle OAuth errors
+            if (error) {
+                return new Response(`<html><body>
 						<h1>Authentication Failed</h1>
-						<p>Error: ${safeError}</p>
-						<p>Description: ${safeDesc}</p>
+						<p>Error: ${error}</p>
+						<p>Description: ${url.searchParams.get("error_description") || "Unknown error"}</p>
 						<p>You can close this window and try again.</p>
 					</body></html>`, {
-                status: 400,
-                headers: { "Content-Type": "text/html; charset=utf-8", "Content-Security-Policy": "default-src 'none'" }
-            });
-        }
-        if (!code || !stateToken) {
-            return new Response("Missing code or state parameter", { status: 400 });
-        }
-        // Validate state token (CSRF protection)
-        const sessionId = await env.OAUTH_STATE.get(stateToken);
-        logger.info({ hasStateToken: !!stateToken, hasSessionId: !!sessionId }, "OAuth callback - state token lookup");
-        if (!sessionId) {
-            return new Response(`<html><body>
+                    status: 400,
+                    headers: { "Content-Type": "text/html" }
+                });
+            }
+            if (!code || !stateToken) {
+                return new Response("Missing code or state parameter", { status: 400 });
+            }
+            // Validate state token (CSRF protection)
+            const sessionId = await env.OAUTH_STATE.get(stateToken);
+            logger.info({ stateToken, sessionId, hasSessionId: !!sessionId }, "OAuth callback - state token lookup");
+            if (!sessionId) {
+                return new Response(`<html><body>
 						<h1>Invalid or Expired Request</h1>
 						<p>The authentication request has expired or is invalid.</p>
 						<p>Please try authenticating again.</p>
 					</body></html>`, {
-                status: 400,
-                headers: { "Content-Type": "text/html" }
-            });
-        }
-        // Delete state token after validation (one-time use)
-        await env.OAUTH_STATE.delete(stateToken);
-        try {
-            // Exchange authorization code for access token
-            // Use Basic auth in Authorization header (Figma's recommended method)
-            const credentials = btoa(`${env.FIGMA_OAUTH_CLIENT_ID}:${env.FIGMA_OAUTH_CLIENT_SECRET}`);
-            const tokenParams = new URLSearchParams({
-                redirect_uri: `${oauthOrigin}/oauth/callback`,
-                code,
-                grant_type: "authorization_code"
-            });
-            const tokenResponse = await fetch("https://api.figma.com/v1/oauth/token", {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    "Authorization": `Basic ${credentials}`
-                },
-                body: tokenParams.toString()
-            });
-            if (!tokenResponse.ok) {
-                const errorText = await tokenResponse.text();
-                let errorData;
-                try {
-                    errorData = JSON.parse(errorText);
-                }
-                catch {
-                    errorData = { error: "Unknown error", raw: errorText, status: tokenResponse.status };
-                }
-                logger.error({ errorData, status: tokenResponse.status }, "Token exchange failed");
-                throw new Error(`Token exchange failed: ${JSON.stringify(errorData)}`);
+                    status: 400,
+                    headers: { "Content-Type": "text/html" }
+                });
             }
-            const tokenData = await tokenResponse.json();
-            const accessToken = tokenData.access_token;
-            const refreshToken = tokenData.refresh_token;
-            const expiresIn = tokenData.expires_in;
-            logger.info({
-                sessionId,
-                hasAccessToken: !!accessToken,
-                hasRefreshToken: !!refreshToken,
-                expiresIn
-            }, "Token exchange successful");
-            // IMPORTANT: Use KV storage for tokens since Durable Object storage is instance-specific
-            // Store token in Workers KV so it's accessible across all Durable Object instances
-            const tokenKey = `oauth_token:${sessionId}`;
-            const tokenExpiresAt = Date.now() + (expiresIn * 1000);
-            const storedToken = {
-                accessToken,
-                refreshToken,
-                expiresAt: tokenExpiresAt
-            };
-            // Store in KV with 90-day expiration (matching token lifetime)
-            await env.OAUTH_TOKENS.put(tokenKey, JSON.stringify(storedToken), {
-                expirationTtl: expiresIn
-            });
-            // Token is stored only under the user-specific sessionId key (SEC-002)
-            // Store reverse lookup for Bearer token validation on SSE endpoint
-            // This allows us to validate Authorization: Bearer <token> headers
-            const bearerKey = `bearer_token:${accessToken}`;
-            await env.OAUTH_TOKENS.put(bearerKey, JSON.stringify({
-                sessionId,
-                expiresAt: tokenExpiresAt
-            }), {
-                expirationTtl: expiresIn
-            });
-            // Verify the token was stored
-            const verifyToken = await env.OAUTH_TOKENS.get(tokenKey);
-            logger.info({ sessionId, tokenKey, storedSuccessfully: !!verifyToken }, "Token stored in KV");
-            // Check if this flow came from an MCP client (like mcp-remote)
-            // If so, we need to redirect back to the client with an authorization code
-            const mcpStateKey = `mcp_auth:${sessionId}`;
-            const mcpAuthJson = await env.OAUTH_STATE.get(mcpStateKey);
-            if (mcpAuthJson) {
-                // MCP client flow - redirect back with authorization code
-                const mcpAuthData = JSON.parse(mcpAuthJson);
-                // Clean up the MCP auth state
-                await env.OAUTH_STATE.delete(mcpStateKey);
-                // Generate an authorization code for the MCP client
-                // We use the sessionId as the code since we've already stored the token
-                const authCode = sessionId;
-                // Build the redirect URL back to the MCP client
-                const redirectUrl = new URL(mcpAuthData.redirectUri);
-                redirectUrl.searchParams.set("code", authCode);
-                redirectUrl.searchParams.set("state", mcpAuthData.state);
+            // Delete state token after validation (one-time use)
+            await env.OAUTH_STATE.delete(stateToken);
+            try {
+                // Exchange authorization code for access token
+                // Use Basic auth in Authorization header (Figma's recommended method)
+                const credentials = btoa(`${env.FIGMA_OAUTH_CLIENT_ID}:${env.FIGMA_OAUTH_CLIENT_SECRET}`);
+                const tokenParams = new URLSearchParams({
+                    redirect_uri: `${oauthOrigin}/oauth/callback`,
+                    code,
+                    grant_type: "authorization_code"
+                });
+                const tokenResponse = await fetch("https://api.figma.com/v1/oauth/token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Authorization": `Basic ${credentials}`
+                    },
+                    body: tokenParams.toString()
+                });
+                if (!tokenResponse.ok) {
+                    const errorText = await tokenResponse.text();
+                    let errorData;
+                    try {
+                        errorData = JSON.parse(errorText);
+                    }
+                    catch {
+                        errorData = { error: "Unknown error", raw: errorText, status: tokenResponse.status };
+                    }
+                    logger.error({ errorData, status: tokenResponse.status }, "Token exchange failed");
+                    throw new Error(`Token exchange failed: ${JSON.stringify(errorData)}`);
+                }
+                const tokenData = await tokenResponse.json();
+                const accessToken = tokenData.access_token;
+                const refreshToken = tokenData.refresh_token;
+                const expiresIn = tokenData.expires_in;
                 logger.info({
                     sessionId,
-                    redirectUri: mcpAuthData.redirectUri,
-                    state: mcpAuthData.state
-                }, "Redirecting back to MCP client");
-                return Response.redirect(redirectUrl.toString(), 302);
-            }
-            // Direct browser flow - show success page
-            return new Response(`<!DOCTYPE html>
+                    hasAccessToken: !!accessToken,
+                    accessTokenPreview: accessToken ? accessToken.substring(0, 10) + "..." : null,
+                    hasRefreshToken: !!refreshToken,
+                    expiresIn
+                }, "Token exchange successful");
+                // IMPORTANT: Use KV storage for tokens since Durable Object storage is instance-specific
+                // Store token in Workers KV so it's accessible across all Durable Object instances
+                const tokenKey = `oauth_token:${sessionId}`;
+                const tokenExpiresAt = Date.now() + (expiresIn * 1000);
+                const storedToken = {
+                    accessToken,
+                    refreshToken,
+                    expiresAt: tokenExpiresAt
+                };
+                // Store in KV with 90-day expiration (matching token lifetime)
+                await env.OAUTH_TOKENS.put(tokenKey, JSON.stringify(storedToken), {
+                    expirationTtl: expiresIn
+                });
+                // CRITICAL: Also store under the fixed session ID that Durable Objects use
+                // This ensures getFigmaAPI() can retrieve the token regardless of which
+                // session ID was used during OAuth (e.g., mcp-remote's client_id)
+                const fixedTokenKey = `oauth_token:figma-console-mcp-default-session`;
+                if (tokenKey !== fixedTokenKey) {
+                    await env.OAUTH_TOKENS.put(fixedTokenKey, JSON.stringify(storedToken), {
+                        expirationTtl: expiresIn
+                    });
+                    logger.info({ fixedTokenKey }, "Token also stored under fixed session ID for Durable Object access");
+                }
+                // Store reverse lookup for Bearer token validation on SSE endpoint
+                // This allows us to validate Authorization: Bearer <token> headers
+                const bearerKey = `bearer_token:${accessToken}`;
+                await env.OAUTH_TOKENS.put(bearerKey, JSON.stringify({
+                    sessionId,
+                    expiresAt: tokenExpiresAt
+                }), {
+                    expirationTtl: expiresIn
+                });
+                // Verify the token was stored
+                const verifyToken = await env.OAUTH_TOKENS.get(tokenKey);
+                logger.info({ sessionId, tokenKey, storedSuccessfully: !!verifyToken }, "Token stored in KV");
+                // Check if this flow came from an MCP client (like mcp-remote)
+                // If so, we need to redirect back to the client with an authorization code
+                const mcpStateKey = `mcp_auth:${sessionId}`;
+                const mcpAuthJson = await env.OAUTH_STATE.get(mcpStateKey);
+                if (mcpAuthJson) {
+                    // MCP client flow - redirect back with authorization code
+                    const mcpAuthData = JSON.parse(mcpAuthJson);
+                    // Clean up the MCP auth state
+                    await env.OAUTH_STATE.delete(mcpStateKey);
+                    // Generate an authorization code for the MCP client
+                    // We use the sessionId as the code since we've already stored the token
+                    const authCode = sessionId;
+                    // Build the redirect URL back to the MCP client
+                    const redirectUrl = new URL(mcpAuthData.redirectUri);
+                    redirectUrl.searchParams.set("code", authCode);
+                    redirectUrl.searchParams.set("state", mcpAuthData.state);
+                    logger.info({
+                        sessionId,
+                        redirectUri: mcpAuthData.redirectUri,
+                        state: mcpAuthData.state
+                    }, "Redirecting back to MCP client");
+                    return Response.redirect(redirectUrl.toString(), 302);
+                }
+                // Direct browser flow - show success page
+                return new Response(`<!DOCTYPE html>
 <html>
 <head>
 	<meta charset="UTF-8">
@@ -1603,81 +1557,81 @@ async function handleRequest(request, env, ctx) {
 	</script>
 </body>
 </html>`, {
-                headers: {
-                    "Content-Type": "text/html; charset=utf-8"
-                }
-            });
-        }
-        catch (error) {
-            logger.error({ error, sessionId }, "OAuth callback failed");
-            return new Response(`<html><body>
+                    headers: {
+                        "Content-Type": "text/html; charset=utf-8"
+                    }
+                });
+            }
+            catch (error) {
+                logger.error({ error, sessionId }, "OAuth callback failed");
+                return new Response(`<html><body>
 						<h1>Authentication Error</h1>
 						<p>Failed to complete authentication: ${error instanceof Error ? error.message : String(error)}</p>
 						<p>Please try again or contact support.</p>
 					</body></html>`, {
-                status: 500,
-                headers: { "Content-Type": "text/html" }
+                    status: 500,
+                    headers: { "Content-Type": "text/html" }
+                });
+            }
+        }
+        // Health check endpoint
+        if (url.pathname === "/health") {
+            return new Response(JSON.stringify({
+                status: "healthy",
+                service: "Figma Console MCP",
+                version: "1.15.0",
+                endpoints: {
+                    mcp: ["/sse", "/mcp"],
+                    oauth_mcp_spec: ["/.well-known/oauth-authorization-server", "/authorize", "/token", "/oauth/register"],
+                    oauth_legacy: ["/oauth/authorize", "/oauth/callback"],
+                    utility: ["/test-browser", "/health"]
+                },
+                oauth_configured: !!env.FIGMA_OAUTH_CLIENT_ID
+            }), {
+                headers: { "Content-Type": "application/json" },
             });
         }
-    }
-    // Health check endpoint
-    if (url.pathname === "/health") {
-        return new Response(JSON.stringify({
-            status: "healthy",
-            service: "Figma Console MCP",
-            version: "1.13.0",
-            endpoints: {
-                mcp: ["/sse", "/mcp"],
-                oauth_mcp_spec: ["/.well-known/oauth-authorization-server", "/authorize", "/token", "/oauth/register"],
-                oauth_legacy: ["/oauth/authorize", "/oauth/callback"],
-                utility: ["/test-browser", "/health"]
-            },
-            oauth_configured: !!env.FIGMA_OAUTH_CLIENT_ID
-        }), {
-            headers: { "Content-Type": "application/json" },
-        });
-    }
-    // Browser Rendering API test endpoint
-    if (url.pathname === "/test-browser") {
-        const results = await testBrowserRendering(env);
-        return new Response(JSON.stringify(results, null, 2), {
-            headers: { "Content-Type": "application/json" },
-        });
-    }
-    // Serve favicon
-    if (url.pathname === "/favicon.ico") {
-        // Redirect to custom Figma Console icon
-        return Response.redirect("https://p198.p4.n0.cdn.zight.com/items/Qwu1Dywx/b61b7b8f-05dc-4063-8a40-53fa4f8e3e97.jpg", 302);
-    }
-    // Proxy /docs to Mintlify
-    if (/^\/docs/.test(url.pathname)) {
-        // Try mintlify.app domain (Mintlify's standard hosting)
-        const DOCS_URL = "southleftllc.mintlify.app";
-        const CUSTOM_URL = "figma-console-mcp.southleft.com";
-        const proxyUrl = new URL(request.url);
-        proxyUrl.hostname = DOCS_URL;
-        const proxyRequest = new Request(proxyUrl, request);
-        proxyRequest.headers.set("Host", DOCS_URL);
-        proxyRequest.headers.set("X-Forwarded-Host", CUSTOM_URL);
-        proxyRequest.headers.set("X-Forwarded-Proto", "https");
-        return await fetch(proxyRequest);
-    }
-    // Root path - serve landing page with editorial layout and light/dark mode
-    if (url.pathname === "/") {
-        return new Response(`<!DOCTYPE html>
+        // Browser Rendering API test endpoint
+        if (url.pathname === "/test-browser") {
+            const results = await testBrowserRendering(env);
+            return new Response(JSON.stringify(results, null, 2), {
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        // Serve favicon
+        if (url.pathname === "/favicon.ico") {
+            // Redirect to custom Figma Console icon
+            return Response.redirect("https://p198.p4.n0.cdn.zight.com/items/Qwu1Dywx/b61b7b8f-05dc-4063-8a40-53fa4f8e3e97.jpg", 302);
+        }
+        // Proxy /docs to Mintlify
+        if (/^\/docs/.test(url.pathname)) {
+            // Try mintlify.app domain (Mintlify's standard hosting)
+            const DOCS_URL = "southleftllc.mintlify.app";
+            const CUSTOM_URL = "figma-console-mcp.southleft.com";
+            const proxyUrl = new URL(request.url);
+            proxyUrl.hostname = DOCS_URL;
+            const proxyRequest = new Request(proxyUrl, request);
+            proxyRequest.headers.set("Host", DOCS_URL);
+            proxyRequest.headers.set("X-Forwarded-Host", CUSTOM_URL);
+            proxyRequest.headers.set("X-Forwarded-Proto", "https");
+            return await fetch(proxyRequest);
+        }
+        // Root path - serve landing page with editorial layout and light/dark mode
+        if (url.pathname === "/") {
+            return new Response(`<!DOCTYPE html>
 <html lang="en">
 <head>
 	<meta charset="UTF-8">
 	<meta name="viewport" content="width=device-width, initial-scale=1.0">
 	<title>Figma Console MCP - The Most Comprehensive MCP Server for Figma</title>
 	<link rel="icon" type="image/svg+xml" href="https://docs.figma-console-mcp.southleft.com/favicon.svg">
-	<meta name="description" content="Turn your Figma design system into a living API. 59+ tools give AI assistants deep access to design tokens, component specs, variables, and programmatic design creation.">
+	<meta name="description" content="Turn your Figma design system into a living API. 63+ tools give AI assistants deep access to design tokens, component specs, variables, and programmatic design creation.">
 
 	<!-- Open Graph -->
 	<meta property="og:type" content="website">
 	<meta property="og:url" content="https://figma-console-mcp.southleft.com">
 	<meta property="og:title" content="Figma Console MCP - Turn Your Design System Into a Living API">
-	<meta property="og:description" content="The most comprehensive MCP server for Figma. 59+ tools give AI assistants deep access to design tokens, components, variables, and programmatic design creation.">
+	<meta property="og:description" content="The most comprehensive MCP server for Figma. 63+ tools give AI assistants deep access to design tokens, components, variables, and programmatic design creation.">
 	<meta property="og:image" content="https://docs.figma-console-mcp.southleft.com/images/og-image.jpg">
 	<meta property="og:image:width" content="1200">
 	<meta property="og:image:height" content="630">
@@ -1685,7 +1639,7 @@ async function handleRequest(request, env, ctx) {
 	<!-- Twitter -->
 	<meta name="twitter:card" content="summary_large_image">
 	<meta name="twitter:title" content="Figma Console MCP - Turn Your Design System Into a Living API">
-	<meta name="twitter:description" content="The most comprehensive MCP server for Figma. 59+ tools give AI assistants deep access to design tokens, components, variables, and programmatic design creation.">
+	<meta name="twitter:description" content="The most comprehensive MCP server for Figma. 63+ tools give AI assistants deep access to design tokens, components, variables, and programmatic design creation.">
 	<meta name="twitter:image" content="https://docs.figma-console-mcp.southleft.com/images/og-image.jpg">
 
 	<meta name="theme-color" content="#0D9488">
@@ -2892,8 +2846,9 @@ async function handleRequest(request, env, ctx) {
 	</script>
 </body>
 </html>`, {
-            headers: { "Content-Type": "text/html; charset=utf-8" }
-        });
-    }
-    return new Response("Not found", { status: 404 });
-}
+                headers: { "Content-Type": "text/html; charset=utf-8" }
+            });
+        }
+        return new Response("Not found", { status: 404 });
+    },
+};