figura-cli 0.10.2 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "figura-cli",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "Command-line client for the Figura visualization SaaS",
   "license": "MIT",
   "type": "module",

package/skills/fig/SKILL.md

@@ -48,11 +48,20 @@ greenfield.
 
 ## How to fig
 
-1. **Check auth** — call **`figura_whoami`** to confirm you're connected to a
-   team. Not connected? Tell the user to run `figura login`, or add the MCP:
-   `claude mcp add figura -- figura mcp`. (Creating / publishing figs needs the
-   `figs:write` scope on the team — a read-only token passes whoami but fails the
-   land step.)
+1. **Verify the destination team** — call **`figura_whoami`** (or
+   `figura whoami --json`) and check BOTH halves before generating anything:
+   - **Connected?** Not connected → tell the user to run `figura link` (or
+     `figura login`), or add the MCP: `claude mcp add figura -- figura mcp`.
+     (Creating / publishing figs needs the `figs:write` scope on the team — a
+     read-only token passes whoami but fails the land step.)
+   - **Bound to THIS project?** Read `binding.source` in the response. `project`
+     (or an explicit `env` token) → proceed, and say where the fig will land
+     ("figging to team *slug*"). **`global` → STOP before generating**: nothing
+     pins this repo to that team — the fig would land on whatever team this
+     machine last logged into (this is exactly how mocks have ended up on the
+     wrong tenant). Tell the user to run `figura link` in this repo, then
+     re-verify. If the response has no `binding` field (older CLI/MCP), confirm
+     the team slug matches this project with the user before proceeding.
 
 2. **Default — build it yourself, with YOUR Claude.** Fetch the team's design
    system — `bunx figura-cli brand --json` — and hand-build the fig's HTML against

package/skills/figura-brand/SKILL.md

@@ -17,15 +17,21 @@ directory). Default to the current repo.
 
 ## Prerequisites
 
-The user needs the `figura` CLI authenticated once (`figura login`) — the brand is
+The user needs this repo linked to its Figura team (`figura link`; a global
+`figura login` also works but is only a machine-wide fallback) — the brand is
 written to the team that token belongs to. If a `figura` **MCP server** is
 connected, prefer its `figura_set_brand` tool over the CLI. If neither the CLI nor
 `bunx figura-cli` is available, tell the user to install it
 (`curl -fsSL https://figura.so/install.sh | bash`) and stop.
 
-Confirm the target team first: `figura whoami` (or the `figura_whoami` tool). The
-brand is **team-wide and overwrites** the current one — never push without showing
-the user what you're about to set and getting an explicit OK.
+Verify the destination team first: `figura whoami --json` (or the `figura_whoami`
+tool) and check `binding.source`. `project` (or an explicit `env` token) → name
+the team out loud and continue. **`global` → STOP**: nothing pins this repo to
+that team — you could read *another product's* brand as the baseline and
+overwrite *their* profile with this repo's. Tell the user to run `figura link`
+here first. The brand is **team-wide and overwrites** the current one — never
+push without showing the user what you're about to set and getting an explicit
+OK.
 
 ## Workflow