@payloadcms/figma 0.0.1-alpha.7 → 0.0.1-alpha.71

package/dist/commands/login.js

@@ -1,22 +1,29 @@
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { executeOAuthFlow, getValidAccessToken, OAuthFlowError } from '../auth/oauth-flow.js';
-import { TokenStore } from '../auth/token-store.js';
-import { OAUTH_CONFIG } from '../config/oauth.js';
+import { CallbackError } from '../auth/callback-server.js';
+import { executeOAuthFlow, getValidCredential, OAuthFlowError } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getOAuthConfig } from '../config/oauth.js';
+import { getInfraEnvironment } from '../constants.js';
+import { formatEnvSuffix } from '../utils/format-env-suffix.js';
 import * as log from '../utils/log.js';
 /**
  * Handle the `@payloadcms/figma login` command
  *
  * Authenticates the user with Figma OAuth2 and stores tokens locally.
  * If valid tokens already exist, shows an error message.
- */ export async function loginCommand() {
-    const tokenStore = new TokenStore();
+ */ export async function loginCommand(args) {
+    const { showNextSteps } = args || {
+        showNextSteps: false
+    };
+    const env = getInfraEnvironment();
+    const tokenStore = getTokenStore(env);
     // Check for existing valid tokens
     try {
-        const existingToken = await getValidAccessToken(tokenStore);
-        if (existingToken) {
-            const tokens = tokenStore.getTokens();
-            p.log.warn(pc.yellow('Already logged in'));
+        const existingCredential = await getValidCredential(tokenStore);
+        if (existingCredential) {
+            const tokens = tokenStore.getOauthInfo();
+            p.log.warn(pc.yellow(`Already logged in${formatEnvSuffix(env)}`));
             if (tokens?.userId) {
                 log.info(`User ID: ${tokens.userId}`);
             }
@@ -30,28 +37,39 @@ import * as log from '../utils/log.js';
     }
     // Start OAuth flow
     await handleAuthentication({
+        showNextSteps,
         tokenStore
     });
 }
 /**
  * Handle authentication flow
- */ async function handleAuthentication({ tokenStore }) {
+ */ async function handleAuthentication({ showNextSteps, tokenStore }) {
     try {
         // Execute OAuth flow
+        const oauthConfig = getOAuthConfig();
         const result = await executeOAuthFlow(tokenStore, {
-            clientId: OAUTH_CONFIG.clientId,
-            redirectUri: OAUTH_CONFIG.redirectUri,
-            scopes: OAUTH_CONFIG.scopes
+            clientId: oauthConfig.clientId,
+            redirectUri: oauthConfig.redirectUri,
+            scopes: oauthConfig.scopes
         });
-        p.log.success(pc.green('✓ You are now authenticated with Figma'));
+        const env = getInfraEnvironment();
+        p.log.success(pc.green(`✓ Logged in${formatEnvSuffix(env)}`));
         if (result.userId) {
             log.debug(`User ID: ${result.userId}`);
         }
         log.debug(`Token storage: ${pc.dim(tokenStore.getStoragePath())}`);
-        // Show next steps
-        p.note(`  ${pc.cyan('@payloadcms/figma init')}  Create a new CMS instance`, 'Next Steps');
+        // Show next steps unless disabled
+        if (showNextSteps !== false) {
+            p.note(`  ${pc.cyan('@payloadcms/figma init')}  Create a new CMS instance`, 'Next Steps');
+        }
     } catch (error) {
         if (error instanceof OAuthFlowError) {
+            const isTimeout = error.cause instanceof CallbackError && error.cause.code === 'timeout';
+            if (isTimeout) {
+                p.log.error(pc.red('✗ Authentication timed out.'));
+                p.note(`Run ${pc.cyan('@payloadcms/figma login')} to try again.`, 'Tip');
+                process.exit(1);
+            }
             log.error(error.message);
             if (error.cause) {
                 log.debug(`Cause: ${error.cause.message}`);

package/dist/commands/logout.d.ts

@@ -2,15 +2,16 @@
  * Options for logout command
  */
 export interface LogoutCommandOptions {
+    /** Logout from all environments */
+    all?: boolean;
     /** Enable debug mode */
     debug?: boolean;
 }
 /**
  * Handle the `@payloadcms/figma logout` command
  *
- * Clears all stored tokens (OAuth and project tokens) after confirmation.
- *
- * @param _options - Command options (unused)
+ * Clears stored tokens (OAuth and project tokens) after confirmation.
+ * By default clears only current environment. Use --all for all environments.
  */
-export declare function logoutCommand(_options?: LogoutCommandOptions): Promise<void>;
+export declare function logoutCommand(options?: LogoutCommandOptions): Promise<void>;
 //# sourceMappingURL=logout.d.ts.map

package/dist/commands/logout.js

@@ -1,24 +1,37 @@
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { TokenStore } from '../auth/token-store.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getInfraEnvironment } from '../constants.js';
+import { getEnvVarSync } from '../utils/env-management.js';
+import { formatEnvSuffix } from '../utils/format-env-suffix.js';
 import * as log from '../utils/log.js';
+const ALL_ENVIRONMENTS = [
+    'production',
+    'staging'
+];
 /**
  * Handle the `@payloadcms/figma logout` command
  *
- * Clears all stored tokens (OAuth and project tokens) after confirmation.
- *
- * @param _options - Command options (unused)
- */ export async function logoutCommand(_options = {}) {
-    const tokenStore = new TokenStore();
-    const hasTokens = tokenStore.getTokens() !== null;
+ * Clears stored tokens (OAuth and project tokens) after confirmation.
+ * By default clears only current environment. Use --all for all environments.
+ */ export async function logoutCommand(options = {}) {
+    const currentEnv = getInfraEnvironment();
+    if (options.all) {
+        await logoutAllEnvironments();
+    } else {
+        await logoutSingleEnvironment(currentEnv);
+    }
+}
+async function logoutSingleEnvironment(env) {
+    const tokenStore = getTokenStore(env);
+    const hasTokens = tokenStore.getOauthInfo() !== null;
     if (!hasTokens) {
-        p.log.warn(pc.yellow('No tokens found. Already logged out.'));
+        p.log.warn(pc.yellow(`No tokens found${formatEnvSuffix(env, ' for ')}. Already logged out.`));
         return;
     }
-    // Confirm logout
     const confirmed = await p.confirm({
         initialValue: false,
-        message: 'This will clear all OAuth and project tokens. Continue?'
+        message: `This will clear all OAuth and project tokens${formatEnvSuffix(env, ' for ')}. Continue?`
     });
     if (p.isCancel(confirmed) || !confirmed) {
         p.log.info('Logout cancelled');
@@ -27,17 +40,66 @@ import * as log from '../utils/log.js';
     const s = p.spinner();
     s.start('Clearing tokens...');
     try {
-        // Clear OAuth tokens
         tokenStore.clearTokens();
-        // Clear all project tokens
-        tokenStore.clearAllProjectTokens();
-        s.stop(pc.green('✓ Logged out successfully'));
-        p.log.step('All OAuth and project tokens have been cleared');
+        clearCurrentProjectToken(tokenStore, env);
+        s.stop(pc.green(`✓ Logged out${formatEnvSuffix(env, ' from ')}`));
+    } catch (error) {
+        s.stop(pc.red('✗ Failed to clear tokens'));
+        log.error(error instanceof Error ? error.message : 'Unknown error');
+        process.exit(1);
+    }
+}
+async function logoutAllEnvironments() {
+    // Check which environments have tokens
+    const envsWithTokens = ALL_ENVIRONMENTS.filter((env)=>{
+        const store = getTokenStore(env);
+        return store.getOauthInfo() !== null;
+    });
+    if (envsWithTokens.length === 0) {
+        p.log.warn(pc.yellow('No tokens found in any environment. Already logged out.'));
+        return;
+    }
+    const envList = envsWithTokens.join(' and ');
+    const confirmed = await p.confirm({
+        initialValue: false,
+        message: `This will clear all OAuth and project tokens for ${envList}. Continue?`
+    });
+    if (p.isCancel(confirmed) || !confirmed) {
+        p.log.info('Logout cancelled');
+        return;
+    }
+    const s = p.spinner();
+    s.start('Clearing tokens...');
+    try {
+        for (const env of envsWithTokens){
+            const store = getTokenStore(env);
+            store.clearTokens();
+            clearCurrentProjectToken(store, env);
+        }
+        s.stop(pc.green('✓ Logged out from all environments'));
     } catch (error) {
         s.stop(pc.red('✗ Failed to clear tokens'));
         log.error(error instanceof Error ? error.message : 'Unknown error');
         process.exit(1);
     }
 }
+function clearCurrentProjectToken(store, env) {
+    const projectId = getEnvVarSync(process.cwd(), 'FIGMA_PROJECT_ID');
+    if (!projectId) {
+        return;
+    }
+    const bootstrapData = store.getBootstrapData(projectId, env);
+    if (!bootstrapData?.contentSystemId) {
+        return;
+    }
+    const projectInfo = {
+        environmentName: env,
+        projectId
+    };
+    // Clear scoped token for this tenant.
+    store.clearProjectToken({
+        projectInfo
+    });
+}
 
 //# sourceMappingURL=logout.js.map

package/dist/commands/upgrade.d.ts

@@ -0,0 +1,5 @@
+export type UpgradeCommandOptions = {
+    isDryRun?: boolean;
+};
+export declare function upgradeCommand(options?: UpgradeCommandOptions): Promise<void>;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/commands/upgrade.js

@@ -0,0 +1,331 @@
+import * as p from '@clack/prompts';
+import fs from 'fs/promises';
+import path from 'path';
+import pc from 'picocolors';
+import { Project } from 'ts-morph';
+import { fileURLToPath } from 'url';
+import { getBootstrapInfo, getCmsResourceId } from '../api/control-plane.js';
+import { getValidCredential } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
+import { addOrUpdateEnvVar, getEnvVar, removeEnvVar } from '../utils/env-management.js';
+import { formatFile } from '../utils/formatter.js';
+import { getPackageManager } from '../utils/package-manager.js';
+import { removeFigmaContentSystemId } from '../utils/payload-config-ast.js';
+import { findPayloadConfig } from '../utils/payload-config-finder.js';
+import { checkPackageInstalled, installPackage } from '../utils/payload-package-check.js';
+import { getOwnVersion } from '../utils/version-check.js';
+export async function upgradeCommand(options = {}) {
+    const cwd = process.cwd();
+    const { isDryRun = false } = options;
+    const changes = [];
+    const warnings = [];
+    const spinner = p.spinner();
+    spinner.start('Checking for needed migrations...');
+    spinner.stop('Checking for needed migrations...');
+    await migrateEnvRename({
+        changes,
+        cwd,
+        isDryRun
+    });
+    await migrateProjectId({
+        changes,
+        cwd,
+        isDryRun,
+        warnings
+    });
+    await ensureBootstrapCached({
+        changes,
+        cwd,
+        isDryRun
+    });
+    await migrateRemoveDeprecatedEnvVars({
+        changes,
+        cwd,
+        isDryRun,
+        warnings
+    });
+    await migrateConfigAst({
+        changes,
+        cwd,
+        isDryRun
+    });
+    await migratePackageVersion({
+        changes,
+        cwd,
+        isDryRun
+    });
+    for (const warning of warnings){
+        p.log.warning(warning);
+    }
+    if (changes.length === 0) {
+        p.log.success('Everything is up to date.');
+        return;
+    }
+    if (isDryRun) {
+        p.log.info(`Dry run: ${changes.length} change(s) detected.`);
+    } else {
+        p.log.success(`${changes.length} change(s) applied.`);
+    }
+}
+const DEPRECATED_ENV_VARS = [
+    'FIGMA_CONTENT_API_CONTENT_SYSTEM_ID',
+    'FIGMA_TENANT_ID',
+    'FIGMA_OAUTH_CLIENT_ID',
+    'FIGMA_OAUTH_CLIENT_SECRET'
+];
+async function migrateEnvRename({ changes, cwd, isDryRun }) {
+    try {
+        const oldValue = await getEnvVar(cwd, 'FIGMA_ENV');
+        if (oldValue === null) {
+            return;
+        }
+        if (isDryRun) {
+            p.log.message(`${pc.dim('○')} Would rename FIGMA_ENV → FIGMA_INFRA_ENV`);
+            changes.push('Rename FIGMA_ENV → FIGMA_INFRA_ENV');
+            return;
+        }
+        await addOrUpdateEnvVar(cwd, 'FIGMA_INFRA_ENV', oldValue);
+        await removeEnvVar(cwd, 'FIGMA_ENV');
+        p.log.message(`${pc.green('●')} Env: Renamed FIGMA_ENV → FIGMA_INFRA_ENV`);
+        changes.push('Renamed FIGMA_ENV → FIGMA_INFRA_ENV');
+    } catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        p.log.warning(`Env rename migration failed: ${msg}`);
+    }
+}
+async function migrateProjectId({ changes, cwd, isDryRun, warnings = [] }) {
+    try {
+        const existingProjectId = await getEnvVar(cwd, 'FIGMA_PROJECT_ID');
+        if (existingProjectId) {
+            return;
+        }
+        const oldContentSystemId = await getEnvVar(cwd, 'FIGMA_CONTENT_API_CONTENT_SYSTEM_ID');
+        if (!oldContentSystemId) {
+            return;
+        }
+        if (isDryRun) {
+            p.log.message(`${pc.dim('○')} Would resolve FIGMA_PROJECT_ID from content system ID`);
+            changes.push('Resolve FIGMA_PROJECT_ID from content system ID');
+            return;
+        }
+        const store = getTokenStore();
+        const credential = await getValidCredential(store);
+        if (!credential) {
+            warnings.push('Not authenticated — could not resolve FIGMA_PROJECT_ID. Run `npx @payloadcms/figma login` first.');
+            return;
+        }
+        const cmsResourceId = await getCmsResourceId(credential, oldContentSystemId);
+        await addOrUpdateEnvVar(cwd, 'FIGMA_PROJECT_ID', cmsResourceId);
+        // Resolve actual environment name from bootstrap API
+        try {
+            const bootstrapInfo = await getBootstrapInfo(credential, cmsResourceId);
+            cacheAllEnvironments(store, cmsResourceId, bootstrapInfo);
+            const envName = bootstrapInfo.environments[0]?.name ?? 'production';
+            await addOrUpdateEnvVar(cwd, 'FIGMA_ENVIRONMENT_NAME', envName);
+        } catch  {
+            await addOrUpdateEnvVar(cwd, 'FIGMA_ENVIRONMENT_NAME', 'production');
+        }
+        p.log.message(`${pc.green('●')} Env: Resolved FIGMA_PROJECT_ID from content system ID`);
+        changes.push('Resolved FIGMA_PROJECT_ID from content system ID');
+    } catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        p.log.warning(`Project ID migration failed: ${msg}`);
+    }
+}
+async function ensureBootstrapCached(params) {
+    try {
+        const projectId = await getEnvVar(params.cwd, 'FIGMA_PROJECT_ID');
+        if (!projectId) {
+            return;
+        }
+        const environmentName = await getEnvVar(params.cwd, 'FIGMA_ENVIRONMENT_NAME') ?? 'production';
+        const store = getTokenStore();
+        if (store.getBootstrapData(projectId, environmentName)) {
+            return;
+        }
+        const credential = await getValidCredential(store);
+        if (!credential) {
+            return;
+        }
+        const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+        cacheAllEnvironments(store, projectId, bootstrapInfo);
+        // Fix FIGMA_ENVIRONMENT_NAME if it doesn't match any actual environment
+        const envNames = bootstrapInfo.environments.map((e)=>e.name);
+        if (!envNames.includes(environmentName) && envNames.length > 0) {
+            const correctName = envNames[0];
+            if (params.isDryRun) {
+                p.log.message(`${pc.dim('○')} Would fix FIGMA_ENVIRONMENT_NAME: ${environmentName} → ${correctName}`);
+                params.changes.push(`Fix FIGMA_ENVIRONMENT_NAME`);
+                return;
+            }
+            await addOrUpdateEnvVar(params.cwd, 'FIGMA_ENVIRONMENT_NAME', correctName);
+            p.log.message(`${pc.green('●')} Env: Fixed FIGMA_ENVIRONMENT_NAME: ${environmentName} → ${correctName}`);
+            params.changes.push(`Fixed FIGMA_ENVIRONMENT_NAME: ${environmentName} → ${correctName}`);
+        }
+    } catch  {
+    // Best-effort — runtime will retry if needed
+    }
+}
+async function migrateRemoveDeprecatedEnvVars({ changes, cwd, isDryRun, warnings = [] }) {
+    try {
+        const presentVars = [];
+        for (const key of DEPRECATED_ENV_VARS){
+            const value = await getEnvVar(cwd, key);
+            if (value !== null) {
+                presentVars.push(key);
+            }
+        }
+        if (presentVars.length === 0) {
+            return;
+        }
+        // Only remove when bootstrap data is available (proves the project is set up correctly)
+        const projectId = await getEnvVar(cwd, 'FIGMA_PROJECT_ID');
+        if (!projectId) {
+            warnings.push('Cannot remove deprecated env vars without FIGMA_PROJECT_ID. Run upgrade again after project ID migration.');
+            return;
+        }
+        const environmentName = await getEnvVar(cwd, 'FIGMA_ENVIRONMENT_NAME') ?? 'production';
+        const store = getTokenStore();
+        const bootstrapData = store.getBootstrapData(projectId, environmentName);
+        if (!bootstrapData) {
+            // Try fetching from API
+            const credential = await getValidCredential(store);
+            if (credential) {
+                try {
+                    const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+                    cacheAllEnvironments(store, projectId, bootstrapInfo);
+                } catch  {
+                    warnings.push('Could not verify bootstrap data — keeping deprecated env vars. Run `npx @payloadcms/figma init` to complete migration.');
+                    return;
+                }
+            } else {
+                warnings.push('Not authenticated — keeping deprecated env vars. Run `npx @payloadcms/figma login` first.');
+                return;
+            }
+        }
+        if (isDryRun) {
+            p.log.message(`${pc.dim('○')} Would remove deprecated env vars: ${presentVars.join(', ')}`);
+            changes.push(`Remove deprecated env vars: ${presentVars.join(', ')}`);
+            return;
+        }
+        const removed = [];
+        for (const key of presentVars){
+            await removeEnvVar(cwd, key);
+            removed.push(key);
+        }
+        p.log.message(`${pc.green('●')} Env: Removed deprecated env vars: ${removed.join(', ')}`);
+        changes.push(`Removed deprecated env vars: ${removed.join(', ')}`);
+    } catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        p.log.warning(`Deprecated env var removal failed: ${msg}`);
+    }
+}
+async function migrateConfigAst({ changes, cwd, isDryRun }) {
+    try {
+        const configPath = await findPayloadConfig(cwd);
+        if (!configPath) {
+            return;
+        }
+        const project = new Project({
+            skipAddingFilesFromTsConfig: true
+        });
+        const sourceFile = project.addSourceFileAtPath(configPath);
+        const wouldRemove = removeFigmaContentSystemId(sourceFile);
+        if (!wouldRemove) {
+            return;
+        }
+        if (isDryRun) {
+            p.log.message(`${pc.dim('○')} Would remove contentSystemId from payload.config.ts`);
+            changes.push('Remove contentSystemId from payload.config.ts');
+            return;
+        }
+        // Re-parse fresh since the detection already mutated the AST
+        const freshProject = new Project({
+            skipAddingFilesFromTsConfig: true
+        });
+        const freshSourceFile = freshProject.addSourceFileAtPath(configPath);
+        removeFigmaContentSystemId(freshSourceFile);
+        await freshSourceFile.save();
+        try {
+            const packageManager = await getPackageManager(cwd);
+            await formatFile(configPath, packageManager);
+        } catch  {
+        // Formatting is best-effort
+        }
+        p.log.message(`${pc.green('●')} Config: Removed contentSystemId from payload.config.ts`);
+        changes.push('Removed contentSystemId from payload.config.ts');
+    } catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        p.log.warning(`Config AST migration failed: ${msg}`);
+    }
+}
+async function migratePackageVersion({ changes, cwd, isDryRun }) {
+    try {
+        const isInstalled = await checkPackageInstalled(cwd, '@payloadcms/figma');
+        if (!isInstalled) {
+            return;
+        }
+        const cliDir = path.dirname(fileURLToPath(import.meta.url));
+        const isFromRegistry = cliDir.includes('node_modules') || cliDir.includes('.npm');
+        if (isFromRegistry) {
+            await migrateRegistryPackageVersion({
+                changes,
+                cliDir,
+                cwd,
+                isDryRun
+            });
+        } else {
+            await migrateLocalPackageVersion({
+                changes,
+                cliDir,
+                cwd,
+                isDryRun
+            });
+        }
+    } catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        p.log.warning(`Package version sync failed: ${msg}`);
+    }
+}
+async function migrateRegistryPackageVersion({ changes, cliDir: _cliDir, cwd, isDryRun }) {
+    const cliVersion = await getOwnVersion();
+    const pkgJsonPath = path.join(cwd, 'package.json');
+    const pkgJson = JSON.parse(await fs.readFile(pkgJsonPath, 'utf-8'));
+    const installedVersion = pkgJson.dependencies?.['@payloadcms/figma']?.replace(/^[\^~>=<]+/, '');
+    if (!installedVersion || installedVersion === cliVersion) {
+        return;
+    }
+    if (isDryRun) {
+        p.log.message(`${pc.dim('○')} Would update @payloadcms/figma ${installedVersion} → ${cliVersion}`);
+        changes.push(`Update @payloadcms/figma ${installedVersion} → ${cliVersion}`);
+        return;
+    }
+    const packageManager = await getPackageManager(cwd);
+    await installPackage(cwd, '@payloadcms/figma', packageManager, cliVersion);
+    p.log.message(`${pc.green('●')} Package: Updated @payloadcms/figma ${installedVersion} → ${cliVersion}`);
+    changes.push(`Updated @payloadcms/figma ${installedVersion} → ${cliVersion}`);
+}
+async function migrateLocalPackageVersion({ changes, cliDir, cwd, isDryRun }) {
+    if (isDryRun) {
+        p.log.message(`${pc.dim('○')} Would install @payloadcms/figma from local build`);
+        changes.push('Install @payloadcms/figma from local build');
+        return;
+    }
+    // Dynamic import — findPackageRoot and packLocalPackage will be exported in a later task
+    const { findPackageRoot, packLocalPackage } = await import('../utils/handle-upgrade.js');
+    const pkgDir = await findPackageRoot(cliDir);
+    if (!pkgDir) {
+        return;
+    }
+    const packageManager = await getPackageManager(cwd);
+    const tgzPath = packLocalPackage(pkgDir);
+    const destTgz = path.join(cwd, path.basename(tgzPath));
+    await fs.rename(tgzPath, destTgz);
+    await installPackage(cwd, destTgz, packageManager);
+    await fs.unlink(destTgz).catch(()=>{});
+    p.log.message(`${pc.green('●')} Package: Installed @payloadcms/figma from local build`);
+    changes.push('Installed @payloadcms/figma from local build');
+}
+
+//# sourceMappingURL=upgrade.js.map

package/dist/config/oauth.d.ts

@@ -1,19 +1,25 @@
 import type { OAuthConfig } from '../auth/types.js';
-export declare const URLS: Record<'prod' | 'staging', Pick<OAuthConfig, 'authorizationUrl' | 'refreshUrl' | 'tokenUrl'>>;
+export declare const DEFAULT_CALLBACK_PORTS: number[];
+export declare const DEFAULT_CALLBACK_PORT: number;
 /**
- * Figma OAuth2 configuration for public CLI client
+ * Get OAuth configuration for current environment.
  *
- * This is a PUBLIC OAuth client using PKCE (Proof Key for Code Exchange).
- * No client secret is used because CLIs cannot securely store secrets.
- * PKCE provides security through the code_verifier/code_challenge mechanism.
+ * `apiBaseUrl` (FIGMA_API_BASE_URL) and `authorizationUrl` (FIGMA_WEB_BASE_URL)
+ * are resolved by `getEnvConfig`; this function only layers on the OAuth-client
+ * specifics it owns:
+ *   FIGMA_CLIENT_ID    → clientId
+ *   FIGMA_REDIRECT_URI → redirectUri
  *
- * For production use, register a public OAuth app with Figma.
- * To register an OAuth app, visit: https://www.figma.com/developers/api#oauth2
+ * When FIGMA_INFRA_ENV=devbox, FIGMA_API_BASE_URL and FIGMA_WEB_BASE_URL are
+ * required (the devbox preset has empty URL defaults, to fail closed).
  */
-export declare const OAUTH_CONFIG: OAuthConfig;
+export declare function getOAuthConfig(): OAuthConfig;
+export declare const TOKEN_EXPIRY_BUFFER_SECONDS = 300;
 /**
- * Buffer time (in seconds) before token expiration to consider token as expired
- * This helps avoid using tokens that are about to expire
+ * Freshness buffer for project tokens. Figma's `pixie` issues 300-second project
+ * tokens, so reusing the 300-second OAuth buffer would treat every fresh token as
+ * already-expired and bypass the cache entirely. 30 seconds is well above the
+ * round-trip time for the calls these tokens authorize.
  */
-export declare const TOKEN_EXPIRY_BUFFER_SECONDS = 300;
+export declare const PROJECT_TOKEN_EXPIRY_BUFFER_SECONDS = 30;
 //# sourceMappingURL=oauth.d.ts.map