@payloadcms/figma 0.0.1-alpha.63 → 0.0.1-alpha.64

package/dist/auth/oauth-flow.js

@@ -195,6 +195,7 @@ import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './
  */ export async function getValidCredential(tokenStore) {
     const envFigmaAccessToken = process.env.FIGMA_ACCESS_TOKEN;
     if (envFigmaAccessToken) {
+        log.debug('Using FIGMA_ACCESS_TOKEN env var override; skipping stored OAuth tokens');
         return {
             type: 'plan_access_token',
             token: envFigmaAccessToken

package/dist/auth/project-token.d.ts

@@ -14,15 +14,18 @@ export declare class ProjectTokenError extends Error {
     cause?: Error | undefined;
     constructor(message: string, cause?: Error | undefined);
 }
+/** Test-only: clears the in-memory token cache and any in-flight refresh promises. */
+export declare function __resetProjectTokenCacheForTests(): void;
 /**
- * Get a valid project token for a tenant, refreshing if necessary
+ * Get a valid project token for a tenant, refreshing if necessary.
  *
- * This function:
- * 1. Checks if a stored project token exists and is valid (not expired)
- * 2. If expired or missing, gets a valid user access token
- * 3. Calls the Figma API to generate a new project token
- * 4. Stores the new project token in encrypted storage
- * 5. Returns the JWT string
+ * Lookup order:
+ * 1. Module-level in-memory cache (no I/O on hits).
+ * 2. In-flight refresh map — concurrent callers with no cached entry share a single
+ *    refresh promise, so the project-token endpoint is only hit once per cache key.
+ * 3. Persisted (`conf`-backed) token store — picks up tokens minted by sibling processes.
+ * 4. Figma API — fetch + JWT validation, then write to both the persisted store and
+ *    the in-memory cache.
  *
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
@@ -39,10 +42,12 @@ export declare function getValidProjectToken({ projectInfo, tenantId, tokenStore
     tokenStore: TokenStore;
 }): Promise<null | string>;
 /**
- * Refresh a project token for a tenant
+ * Force-refresh a project token, bypassing all cache layers.
  *
- * Forces a refresh of the project token even if the current one is still valid.
- * Useful for testing or when you want to ensure you have the freshest token.
+ * Invalidates the in-memory cache entry, the in-flight refresh promise (so a
+ * concurrently-running refresh that may already be returning a soon-to-be-stale
+ * token is dropped from the dedup map), and the persisted token store. Then
+ * delegates to {@link getValidProjectToken} to mint a fresh token.
  *
  * @param params.tokenStore - Token store for persisting tokens
  * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted

package/dist/auth/project-token.js

@@ -5,6 +5,7 @@
  * to the Content API. Project tokens are scoped to a specific tenant/CMS
  * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
  */ import { getProjectToken as fetchProjectToken } from '../api/figma-api.js';
+import { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
 import { getInfraEnvironment } from '../constants.js';
 import * as log from '../utils/log.js';
 import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
@@ -18,6 +19,21 @@ import { getValidCredential } from './oauth-flow.js';
         this.name = 'ProjectTokenError';
     }
 }
+const projectTokenCache = new Map();
+const inFlightRefreshes = new Map();
+function buildCacheKey(params) {
+    const projectId = params.projectInfo?.projectId ?? '';
+    const environmentName = params.projectInfo?.environmentName ?? '';
+    return `${params.tenantId}::${projectId}::${environmentName}`;
+}
+function isCachedTokenValid(entry) {
+    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000;
+    return Date.now() < entry.expiresAt - bufferMs;
+}
+/** Test-only: clears the in-memory token cache and any in-flight refresh promises. */ export function __resetProjectTokenCacheForTests() {
+    projectTokenCache.clear();
+    inFlightRefreshes.clear();
+}
 /**
  * Parse JWT claims from token without validation
  * Used for mock tokens where signature validation is not needed
@@ -43,14 +59,15 @@ import { getValidCredential } from './oauth-flow.js';
     }
 }
 /**
- * Get a valid project token for a tenant, refreshing if necessary
+ * Get a valid project token for a tenant, refreshing if necessary.
  *
- * This function:
- * 1. Checks if a stored project token exists and is valid (not expired)
- * 2. If expired or missing, gets a valid user access token
- * 3. Calls the Figma API to generate a new project token
- * 4. Stores the new project token in encrypted storage
- * 5. Returns the JWT string
+ * Lookup order:
+ * 1. Module-level in-memory cache (no I/O on hits).
+ * 2. In-flight refresh map — concurrent callers with no cached entry share a single
+ *    refresh promise, so the project-token endpoint is only hit once per cache key.
+ * 3. Persisted (`conf`-backed) token store — picks up tokens minted by sibling processes.
+ * 4. Figma API — fetch + JWT validation, then write to both the persisted store and
+ *    the in-memory cache.
  *
  * The project token is used by local Payload instances to authenticate
  * requests to the Content API without requiring a round-trip to Sinatra.
@@ -71,70 +88,125 @@ import { getValidCredential } from './oauth-flow.js';
     if (!resolvedTenantId) {
         throw new ProjectTokenError('tenantId was not provided and could not be resolved from bootstrap data');
     }
-    // Check for existing valid project token
-    if (tokenStore.hasValidProjectToken({
-        projectInfo
-    })) {
-        const projectToken = tokenStore.getProjectToken({
-            projectInfo
-        });
-        return projectToken?.token || null;
-    }
-    // We need to refresh the project token
-    // An oauth access token is required for the call
-    let credential;
-    try {
-        credential = await getValidCredential(tokenStore);
-    } catch (error) {
-        throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
+    const cacheKey = buildCacheKey({
+        projectInfo,
+        tenantId: resolvedTenantId
+    });
+    const cached = projectTokenCache.get(cacheKey);
+    if (cached && isCachedTokenValid(cached)) {
+        return cached.token;
     }
-    if (!credential) {
-        // No valid user tokens available - user needs to authenticate
-        return null;
+    const inFlight = inFlightRefreshes.get(cacheKey);
+    if (inFlight) {
+        return inFlight;
     }
-    // Fetch a new project token from the Figma API
-    const fetchedToken = await fetchProjectToken(credential, resolvedTenantId);
-    // Validate the JWT signature and claims (skip for mocks)
-    const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
-    const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
-    let validatedClaims;
-    if (hasEnvToken || shouldMock) {
-        // MOCK: Skip JWT validation and parse claims directly
-        log.debug('Skipping JWT validation for mock/env project token');
-        validatedClaims = parseJWTClaims(fetchedToken.token);
-    } else {
-        // REAL: Validate JWT signature against JWKS
+    // The IIFE references this holder so it can check whether it is still the
+    // active refresh before writing back to the caches. Without this guard a
+    // stale in-flight refresh could clobber a fresh token written by a later
+    // refresh (e.g. one triggered by `refreshProjectToken`).
+    const handle = {};
+    handle.promise = (async ()=>{
+        if (tokenStore.hasValidProjectToken({
+            projectInfo
+        })) {
+            const stored = tokenStore.getProjectToken({
+                projectInfo
+            });
+            if (stored?.token && inFlightRefreshes.get(cacheKey) === handle.promise) {
+                projectTokenCache.set(cacheKey, {
+                    expiresAt: stored.expiresAt,
+                    token: stored.token
+                });
+                return stored.token;
+            }
+            if (stored?.token) {
+                return stored.token;
+            }
+            // hasValidProjectToken said yes but getProjectToken returned no token —
+            // store was likely cleared by another process between calls. Fall through
+            // to fetch so the caller still gets a token.
+            log.warning(`Stored project token vanished between hasValidProjectToken and getProjectToken (cacheKey=${cacheKey}); re-fetching`);
+        }
+        let credential;
+        try {
+            credential = await getValidCredential(tokenStore);
+        } catch (error) {
+            throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
+        }
+        if (!credential) {
+            return null;
+        }
+        let fetchedToken;
         try {
-            validatedClaims = await validateProjectToken(fetchedToken.token, getInfraEnvironment());
-        } catch (validationError) {
-            // Handle validation errors
-            if (validationError instanceof JWTValidationError) {
-                throw new ProjectTokenError(`Project token validation failed: ${validationError.message}`, validationError);
+            fetchedToken = await fetchProjectToken(credential, resolvedTenantId);
+        } catch (error) {
+            // Let API errors (e.g. FigmaApiError) propagate raw so callers can
+            // branch on status codes — but log context for debugging.
+            log.debug(`fetchProjectToken failed (cacheKey=${cacheKey}, tenantId=${resolvedTenantId}): ${error instanceof Error ? error.message : 'Unknown error'}`);
+            throw error;
+        }
+        const hasEnvToken = !!process.env.FIGMA_MOCK_PROJECT_TOKEN_VALUE;
+        const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
+        let validatedClaims;
+        if (hasEnvToken || shouldMock) {
+            log.debug('Skipping JWT validation for mock/env project token');
+            validatedClaims = parseJWTClaims(fetchedToken.token);
+        } else {
+            try {
+                validatedClaims = await validateProjectToken(fetchedToken.token, getInfraEnvironment());
+            } catch (validationError) {
+                if (validationError instanceof JWTValidationError) {
+                    throw new ProjectTokenError(`Project token validation failed: ${validationError.message}`, validationError);
+                }
+                throw validationError;
             }
-            throw validationError;
         }
-    }
-    // Ensure exp claim is present
-    if (!validatedClaims.exp) {
-        throw new ProjectTokenError('Project token missing expiration (exp) claim');
-    }
-    // Store the project token with validated expiration and claims
-    tokenStore.setProjectToken({
-        projectInfo,
-        token: {
-            claims: validatedClaims,
-            expiresAt: validatedClaims.exp * 1000,
-            tenantId: resolvedTenantId,
+        if (typeof validatedClaims.exp !== 'number' || !Number.isFinite(validatedClaims.exp)) {
+            throw new ProjectTokenError('Project token missing or invalid expiration (exp) claim');
+        }
+        const expiresAt = validatedClaims.exp * 1000;
+        if (inFlightRefreshes.get(cacheKey) !== handle.promise) {
+            log.debug(`Project token refresh superseded; not persisting (cacheKey=${cacheKey})`);
+            return fetchedToken.token;
+        }
+        try {
+            tokenStore.setProjectToken({
+                projectInfo,
+                token: {
+                    claims: validatedClaims,
+                    expiresAt,
+                    tenantId: resolvedTenantId,
+                    token: fetchedToken.token
+                }
+            });
+        } catch (error) {
+            // Persistence is best-effort: a failure here (disk full, permissions,
+            // corrupt conf entry) shouldn't lose the freshly-minted token. Log and
+            // populate the in-memory cache so this process can still use it.
+            log.error(`Failed to persist project token to store (cacheKey=${cacheKey}): ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        projectTokenCache.set(cacheKey, {
+            expiresAt,
             token: fetchedToken.token
+        });
+        return fetchedToken.token;
+    })();
+    inFlightRefreshes.set(cacheKey, handle.promise);
+    try {
+        return await handle.promise;
+    } finally{
+        if (inFlightRefreshes.get(cacheKey) === handle.promise) {
+            inFlightRefreshes.delete(cacheKey);
         }
-    });
-    return fetchedToken.token;
+    }
 }
 /**
- * Refresh a project token for a tenant
+ * Force-refresh a project token, bypassing all cache layers.
  *
- * Forces a refresh of the project token even if the current one is still valid.
- * Useful for testing or when you want to ensure you have the freshest token.
+ * Invalidates the in-memory cache entry, the in-flight refresh promise (so a
+ * concurrently-running refresh that may already be returning a soon-to-be-stale
+ * token is dropped from the dedup map), and the persisted token store. Then
+ * delegates to {@link getValidProjectToken} to mint a fresh token.
  *
  * @param params.tokenStore - Token store for persisting tokens
  * @param params.tenantId - Optional tenant/CMS ID; resolved from stored bootstrap data when omitted
@@ -142,12 +214,23 @@ import { getValidCredential } from './oauth-flow.js';
  * @returns Promise resolving to JWT token string or null if failed
  * @throws {ProjectTokenError} If token refresh fails
  */ export async function refreshProjectToken(params) {
-    const { projectInfo, tokenStore } = params;
-    // Clear the existing project token to force a refresh
+    const { projectInfo, tenantId, tokenStore } = params;
+    const resolvedTenantId = tenantId ?? tokenStore.getTenantId({
+        projectInfo
+    });
+    if (resolvedTenantId) {
+        const cacheKey = buildCacheKey({
+            projectInfo,
+            tenantId: resolvedTenantId
+        });
+        projectTokenCache.delete(cacheKey);
+        // Drop any in-flight refresh so getValidProjectToken below cannot return
+        // a soon-to-be-stale token via the dedup map.
+        inFlightRefreshes.delete(cacheKey);
+    }
     tokenStore.clearProjectToken({
         projectInfo
     });
-    // Get a new token (which will fetch from API since we just cleared it)
     return getValidProjectToken(params);
 }
 

package/dist/auth/token-store-migration.js

@@ -131,7 +131,7 @@ function safeGet(config, key) {
     try {
         return config.get(key);
     } catch (error) {
-        log.warning(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        log.debug(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
         return undefined;
     }
 }
@@ -148,7 +148,7 @@ function safeGet(config, key) {
             projectName: params.projectName
         });
     } catch (error) {
-        log.warning(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        log.debug(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
         return null;
     }
 }

package/dist/auth/token-store.js

@@ -51,7 +51,7 @@ const PROJECT_STORE_SCHEMA_VERSION = 1;
         // Resolve the legacy root dir (matching Conf's env-paths convention)
         // without instantiating Conf, which would read/parse the encrypted file
         // and could wipe it under clearInvalidConfig.
-        this.legacyRootDir = envPaths(projectName).config;
+        this.legacyRootDir = options?.rootDir ?? envPaths(projectName).config;
         const legacyFilePath = path.join(this.legacyRootDir, `${baseConfigName}.json`);
         const newOAuthCwd = this.buildOAuthStoreCwd();
         const newOAuthFilePath = path.join(newOAuthCwd, `${this.buildOAuthConfigName()}.json`);
@@ -84,7 +84,7 @@ const PROJECT_STORE_SCHEMA_VERSION = 1;
         if (environment !== 'production') {
             const oldEnvProjectName = `payloadcms-figma-${environment}`;
             const oldEnvConfigName = options?.configName || oldEnvProjectName;
-            const oldEnvLegacyDir = envPaths(oldEnvProjectName).config;
+            const oldEnvLegacyDir = options?.oldEnvLegacyDir ?? envPaths(oldEnvProjectName).config;
             const oldEnvLegacyFilePath = path.join(oldEnvLegacyDir, `${oldEnvConfigName}.json`);
             if (needsMigration({
                 legacyFilePath: oldEnvLegacyFilePath,

package/dist/auth/types.d.ts

@@ -113,6 +113,10 @@ export type TokenStoreConfig = {
     encryptionKey?: string;
     /** Environment for config file naming */
     environment?: Environment;
+    /** Override for the old per-environment legacy directory (primarily for tests). */
+    oldEnvLegacyDir?: string;
+    /** Override for the storage root directory (primarily for tests). */
+    rootDir?: string;
 };
 /**
  * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients

package/dist/cli.js

@@ -1,6 +1,7 @@
 import * as p from '@clack/prompts';
 import arg from 'arg';
 import pc from 'picocolors';
+import { bootstrapCommand } from './commands/bootstrap.js';
 import { buildLambdaZipCommand } from './commands/build-lambda-zip.js';
 import { debugCommand } from './commands/debug.js';
 import { deployCommand } from './commands/deploy.js';
@@ -42,6 +43,7 @@ class Main {
             '--help': Boolean,
             '--id': String,
             '--infra-env': String,
+            '--json': Boolean,
             '--name': String,
             '--skip-auth': Boolean,
             '--skip-build': Boolean,
@@ -112,6 +114,13 @@ class Main {
             p.intro(pc.bgCyan(pc.black(' @payloadcms/figma ')));
             // Route to appropriate command handler
             switch(subcommand){
+                case 'bootstrap':
+                    await bootstrapCommand({
+                        id: this.args['--id'],
+                        env: this.args['--env'],
+                        json: this.args['--json']
+                    });
+                    break;
                 case 'build-lambda-zip':
                     await buildLambdaZipCommand();
                     break;

package/dist/commands/bootstrap.d.ts

@@ -0,0 +1,18 @@
+export type BootstrapCommandOptions = {
+    /** Filter to a single environment (e.g. "production", "staging"). */
+    env?: string;
+    /** CMS Resource ID (FIGMA_PROJECT_ID, e.g. cms_…). */
+    id?: string;
+    /** Emit plain JSON instead of a styled note (handy for piping into jq). */
+    json?: boolean;
+};
+/**
+ * Fetch and display bootstrap info for a CMS resource.
+ *
+ * Calls the Control Plane bootstrap endpoint with the current OAuth credential
+ * and prints the resulting environments (`contentSystemId`, `tenantInstanceId`)
+ * plus OAuth client credentials. Useful for grabbing a tenant ID without having
+ * to `init` a project.
+ */
+export declare function bootstrapCommand(options?: BootstrapCommandOptions): Promise<void>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/commands/bootstrap.js

@@ -0,0 +1,90 @@
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { ControlPlaneError, getBootstrapInfo } from '../api/control-plane.js';
+import { getValidCredential } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getInfraEnvironment } from '../constants.js';
+import { isDebug } from '../utils/is-debug.js';
+import { maskToken } from '../utils/token-display.js';
+/**
+ * Fetch and display bootstrap info for a CMS resource.
+ *
+ * Calls the Control Plane bootstrap endpoint with the current OAuth credential
+ * and prints the resulting environments (`contentSystemId`, `tenantInstanceId`)
+ * plus OAuth client credentials. Useful for grabbing a tenant ID without having
+ * to `init` a project.
+ */ export async function bootstrapCommand(options = {}) {
+    if (!options.id) {
+        p.log.error(pc.red('--id <project-id> is required'));
+        p.note('The CMS Resource ID (FIGMA_PROJECT_ID), e.g. cms_abc123', 'Tip');
+        process.exit(1);
+    }
+    const tokenStore = getTokenStore(getInfraEnvironment());
+    let credential;
+    try {
+        credential = await getValidCredential(tokenStore);
+    } catch (error) {
+        p.log.error(pc.red(`Failed to read stored credentials: ${error instanceof Error ? error.message : 'Unknown error'}`));
+        p.note(`Run ${pc.cyan(`@payloadcms/figma logout --infra-env ${getInfraEnvironment()} -y`)} ` + `then ${pc.cyan(`@payloadcms/figma login --infra-env ${getInfraEnvironment()}`)} and retry.`, 'Re-authenticate');
+        if (isDebug() && error instanceof Error) {
+            // eslint-disable-next-line no-console
+            console.error(error);
+        }
+        process.exit(1);
+    }
+    if (!credential) {
+        p.log.error(pc.red('Not authenticated.'));
+        p.note(`Run ${pc.cyan('@payloadcms/figma login')} first`, 'Tip');
+        process.exit(1);
+    }
+    let info;
+    try {
+        info = await getBootstrapInfo(credential, options.id, options.env);
+    } catch (error) {
+        if (error instanceof ControlPlaneError) {
+            p.log.error(pc.red(`Bootstrap fetch failed: ${error.statusCode} ${error.message}`));
+            if (error.statusCode === 401) {
+                p.note(`Stored credentials for infra env ${pc.bold(getInfraEnvironment())} were rejected.\n` + `Run ${pc.cyan(`@payloadcms/figma logout --infra-env ${getInfraEnvironment()} -y`)} ` + `then ${pc.cyan(`@payloadcms/figma login --infra-env ${getInfraEnvironment()}`)} and retry.`, 'Re-authenticate');
+            } else if (error.statusCode === 404) {
+                p.note(`Resource ${pc.bold(options.id)} was not found in infra env ${pc.bold(getInfraEnvironment())}.\n` + `Try ${pc.cyan('--infra-env staging')} (or production) to target a different infra.`, 'Wrong infra environment?');
+            }
+        } else if (error instanceof Error) {
+            const causeMessage = error.cause instanceof Error ? `: ${error.cause.message}` : '';
+            p.log.error(pc.red(`${error.name}: ${error.message}${causeMessage}`));
+            if (isDebug()) {
+                // eslint-disable-next-line no-console
+                console.error(error);
+            }
+        } else {
+            p.log.error(pc.red('Unknown error'));
+        }
+        process.exit(1);
+    }
+    if (options.json) {
+        const showSecretsInJson = isDebug();
+        const payload = showSecretsInJson ? info : {
+            ...info,
+            oauthCredentials: {
+                ...info.oauthCredentials,
+                oauthClientSecret: maskToken(info.oauthCredentials.oauthClientSecret)
+            }
+        };
+        // eslint-disable-next-line no-console
+        console.log(JSON.stringify(payload, null, 2));
+        return;
+    }
+    const showSecret = isDebug();
+    const lines = [
+        `Project ID:        ${options.id}`,
+        `OAuth Client ID:   ${info.oauthCredentials.oauthClientId}`,
+        `OAuth Client Secret: ${showSecret ? info.oauthCredentials.oauthClientSecret : maskToken(info.oauthCredentials.oauthClientSecret)}`,
+        '',
+        'Environments:'
+    ];
+    for (const env of info.environments){
+        lines.push(`  ${pc.bold(env.name)}`, `    Tenant ID (contentSystemId): ${env.contentSystemId}`, `    Tenant Instance ID:          ${env.tenantInstanceId}`);
+    }
+    p.note(lines.join('\n'), 'Bootstrap Info');
+}
+
+//# sourceMappingURL=bootstrap.js.map

package/dist/commands/init.js

@@ -225,6 +225,18 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
             p.note('Run this command in a directory without an existing project or in an existing Payload project.', 'Action Required');
             process.exit(1);
         }
+        // npm leaves node_modules in a transient state after a sequence of
+        // add/remove calls; without a final `install` the subprocess that runs
+        // generate:importmap silently misses @payloadcms/figma subpath components.
+        s.start('Reconciling dependencies...');
+        try {
+            await installDependencies(process.cwd(), packageManager);
+            s.stop(pc.green('✓ Dependencies reconciled'));
+        } catch (error) {
+            s.stop(pc.red('✗ Failed to reconcile dependencies before generate:importmap'));
+            log.error(error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
         // Generate import map to prevent errors on first dev run
         const importMapResult = await runScript(process.cwd(), 'generate:importmap', packageManager);
         if (!importMapResult) {
@@ -240,7 +252,10 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
         ]);
         // Generate project token (unless skipping auth)
         if (!options.skipAuth && resolvedEnv) {
-            await generateProjectTokenWithFeedback(tokenStore, resolvedEnv.contentSystemId, s);
+            await generateProjectTokenWithFeedback(tokenStore, resolvedEnv.contentSystemId, s, {
+                environmentName: resolvedEnv.name,
+                projectId: cmsResourceId
+            });
         }
         // Success message for existing project
         p.outro(pc.green('✓ Project initialized successfully!'));
@@ -339,6 +354,18 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
         } catch (error) {
             p.log.warn(pc.yellow(`⚠ Failed to update .env file: ${error instanceof Error ? error.message : 'Unknown error'}`));
         }
+        // npm leaves node_modules in a transient state after a sequence of
+        // add/remove calls; without a final `install` the subprocess that runs
+        // generate:importmap silently misses @payloadcms/figma subpath components.
+        s.start('Reconciling dependencies...');
+        try {
+            await installDependencies(fullPath, packageManager);
+            s.stop(pc.green('✓ Dependencies reconciled'));
+        } catch (error) {
+            s.stop(pc.red('✗ Failed to reconcile dependencies before generate:importmap'));
+            log.error(error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
         // Generate import map to prevent errors on first dev run
         const importMapResult = await runScript(fullPath, 'generate:importmap', packageManager);
         if (!importMapResult) {
@@ -346,7 +373,10 @@ import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
         }
         // Generate project token (unless skipping auth)
         if (!options.skipAuth && resolvedEnv) {
-            await generateProjectTokenWithFeedback(tokenStore, resolvedEnv.contentSystemId, s);
+            await generateProjectTokenWithFeedback(tokenStore, resolvedEnv.contentSystemId, s, {
+                environmentName: resolvedEnv.name,
+                projectId: cmsResourceId
+            });
         }
         // Initialize git repository (after all files including lock file are ready)
         initializeGitRepo(fullPath);