youiyoux 0.1.15 → 0.1.16

package/dist/chunks/{chunk-CZJFEND6.js → chunk-3SBSYNAG.js}

@@ -4,7 +4,7 @@ import { createRequire as __youiRequire } from "node:module"; import { dirname a
 var PACKAGES = {
   core: () => import("./src-4BOFDAZD.js"),
   scanner: () => import("./src-6JO73FOS.js"),
-  discover: () => import("./src-IMWXYWQK.js"),
+  discover: () => import("./src-FBTLHBVB.js"),
   tokens: () => import("./src-WMGLZKYK.js")
 };
 var loadPackage = (name) => PACKAGES[name]();

package/dist/chunks/{chunk-QEUZDGIF.js → chunk-ED35SP3F.js}

@@ -57,7 +57,7 @@ import { homedir, userInfo } from "node:os";
 import { join, resolve } from "node:path";
 async function swapImpact(candidate, family) {
   try {
-    const { discoverIndexPath, sharedStore } = await import("./src-IMWXYWQK.js");
+    const { discoverIndexPath, sharedStore } = await import("./src-FBTLHBVB.js");
     const path = discoverIndexPath();
     if (!process.env.DATABASE_URL && !existsSync(path)) return null;
     const impact = await (await sharedStore(path, process.env, { readOnly: true })).swapImpact(candidate, family);
@@ -68,7 +68,7 @@ async function swapImpact(candidate, family) {
 }
 async function libraryLicence(id) {
   try {
-    const { discoverCacheDir, findListing } = await import("./src-IMWXYWQK.js");
+    const { discoverCacheDir, findListing } = await import("./src-FBTLHBVB.js");
     const { entry } = await findListing(discoverCacheDir(void 0, process.env), id);
     return entry.id === id ? entry.license : null;
   } catch {
@@ -79,7 +79,7 @@ function workflowStateDir(project, state) {
   return resolve(state ?? join(homedir(), ".youi", "workflow", shortHash(`${project.repo.root}\0${project.root}`)));
 }
 async function ingest(link) {
-  const { readLink } = await import("./ingest-R2TM3QBM.js");
+  const { readLink } = await import("./ingest-R5CX6R7G.js");
   return readLink(link, { allowLocal: false });
 }
 async function startRuleEditor(options) {

package/dist/chunks/{chunk-FTL53MU3.js → chunk-FO3WR47A.js}

@@ -4,7 +4,7 @@ import {
   loadPackage,
   readTryIndex,
   send
-} from "./chunk-CZJFEND6.js";
+} from "./chunk-3SBSYNAG.js";
 import {
   writeFileAtomic
 } from "./chunk-S7UN5KQK.js";

package/dist/chunks/{chunk-T4EHV4XY.js → chunk-WMIJNZIL.js}

@@ -9,7 +9,7 @@ import {
   startRuleEditor,
   style,
   truncate
-} from "./chunk-QEUZDGIF.js";
+} from "./chunk-ED35SP3F.js";
 import {
   BASELINE_FILE,
   DEFAULT_EXCLUDE,
@@ -96,7 +96,7 @@ import {
   sharedStore,
   showFromCatalog,
   syncIndex
-} from "./chunk-DAGYR4NV.js";
+} from "./chunk-XSIH7RR4.js";
 import {
   checkpointSqlite,
   indexHome,
@@ -182,7 +182,7 @@ import { join as join2, relative, resolve } from "node:path";
 
 // ../cli/src/command.ts
 var COMMAND = "youiyoux";
-var SUBCOMMANDS = ["show", "where", "bom", "check", "baseline", "rules", "plan", "migrate", "upgrade", "record", "hub", "init", "adopt", "status", "system", "sync", "link", "unlink", "scan", "watch", "hooks", "agents", "mcp", "ui", "library", "discover", "index", "report", "render", "screens", "requests", "detect", "build", "parity", "schema", "inventory", "gaps", "help"];
+var SUBCOMMANDS = ["show", "where", "bom", "check", "baseline", "rules", "plan", "migrate", "upgrade", "record", "hub", "figma", "init", "adopt", "status", "system", "sync", "link", "unlink", "scan", "watch", "hooks", "agents", "mcp", "ui", "library", "discover", "index", "report", "render", "screens", "requests", "detect", "build", "parity", "schema", "inventory", "gaps", "help"];
 
 // ../cli/src/agents.ts
 var import_yaml = __toESM(require_dist(), 1);
@@ -5598,8 +5598,13 @@ ${style.bold("System")}  ${style.dim("approved elements: build only with these")
 ${style.bold("Library")}  ${style.dim("ingested references: browse and request adoption, never build with")}
   library search <query>   Library items (lib: ids) and the System elements each could swap in for
   library request <id> --reason <text>   draft an adoption request for a person to approve
+  figma login [--paste] [--port n] | logout | status
+                           sign in to Figma once, for Figma links: through the browser with your team's
+                           private Figma app (FIGMA_CLIENT_ID, FIGMA_CLIENT_SECRET), else with a personal
+                           access token you paste; kept in the macOS Keychain (else a file only you can
+                           read). FIGMA_TOKEN still wins
   library ingest <link> [--draft] [--json]
-                           read what a GitHub repository, a Storybook, a Figma file (FIGMA_TOKEN) or a
+                           read what a GitHub repository, a Storybook, a Figma file (youiyoux figma login) or a
                            DESIGN.md holds into Library items, each sorted into a role, and show them;
                            --draft files them as one draft in the changes queue, where a person keeps or
                            drops each and approves the rest (youiyoux ui > Changes). GITHUB_TOKEN raises
@@ -5720,6 +5725,7 @@ var OPTIONS = {
   db: { type: "string" },
   record: { type: "boolean", default: false },
   draft: { type: "boolean", default: false },
+  paste: { type: "boolean", default: false },
   cache: { type: "string" },
   role: { type: "string" },
   license: { type: "string" },
@@ -6001,7 +6007,7 @@ async function cmdLibrary(values, positionals) {
     return 0;
   }
   if (action === "ingest" && query && positionals.length === 2) {
-    const { fileIngestDraft, readLink, renderIngest } = await import("./ingest-R2TM3QBM.js");
+    const { fileIngestDraft, readLink, renderIngest } = await import("./ingest-R5CX6R7G.js");
     const p = values.draft ? await project(values) : null;
     const reading = await readLink(query, { allowLocal: true });
     const filed = p ? await fileIngestDraft(p, reading, values.state) : null;
@@ -6040,6 +6046,48 @@ async function cmdRecord(values) {
   else print([renderRecord(record, sentTo), ...values.out ? [style.dim(`  written to ${values.out}`)] : [], ...!values.send && !values.out ? [style.dim(`  youiyoux record --send posts it to the hub in ${HUB_URL_ENV}; --out <file> writes it; --json prints it`)] : []].join("\n"));
   return 0;
 }
+async function cmdFigma(values, positionals) {
+  const [action, ...extra] = positionals;
+  const auth = await import("./figma-auth-ODUC3TSR.js");
+  const store = auth.credentialStore();
+  if (extra.length > 0 || !["login", "logout", "status"].includes(action ?? "")) throw new UsageError("youiyoux figma login [--paste] [--port n]   or   youiyoux figma logout   or   youiyoux figma status");
+  if (action === "status") {
+    const stored = await store.get();
+    const lines = process.env.FIGMA_TOKEN ? [`${style.ok("FIGMA_TOKEN")} is set: it is used, before any sign-in`] : [];
+    if (!stored) lines.push(process.env.FIGMA_TOKEN ? style.dim("no sign-in kept") : `${style.warn("not signed in")} to Figma: youiyoux figma login`);
+    else if (stored.kind === "token") lines.push(`${style.ok("signed in")}${stored.handle ? ` as ${stored.handle}` : ""} with a personal access token, kept in ${store.where} since ${stored.savedAt.slice(0, 10)}`);
+    else lines.push(`${style.ok("signed in")}${stored.handle ? ` as ${stored.handle}` : ""} through your team's Figma app, kept in ${store.where}; renewed before ${stored.expiresAt.slice(0, 10)}${auth.oauthAppOf(process.env) ? "" : style.warn(" (renewing needs FIGMA_CLIENT_ID and FIGMA_CLIENT_SECRET)")}`);
+    print(lines.join("\n"));
+    return stored || process.env.FIGMA_TOKEN ? 0 : 1;
+  }
+  if (action === "logout") {
+    const removed = await store.delete();
+    print(removed ? `${style.ok("signed out")}: the Figma sign-in is removed from ${store.where}. To end it in Figma as well, remove the token or the app in Figma > Settings > Security` : style.dim("not signed in: nothing to remove"));
+    return 0;
+  }
+  const app = values.paste ? null : auth.oauthAppOf(process.env);
+  if (app) {
+    const port = values.port ? Number(values.port) : auth.DEFAULT_CALLBACK_PORT;
+    if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new UsageError(`--port ${JSON.stringify(values.port)}: expected a port from 1024 to 65535`);
+    const credential2 = await auth.browserLogin({ app, port, say: (line) => print(style.dim(line)) });
+    await store.set(credential2);
+    print(`${style.ok("signed in")} to Figma${credential2.handle ? ` as ${credential2.handle}` : ""} through your team's app; kept in ${store.where}, renewed by itself`);
+    return 0;
+  }
+  print([
+    "Sign in with a Figma personal access token:",
+    "  1. Figma > Settings > Security > Personal access tokens > Generate new token (opening it now)",
+    "  2. Give it an expiry, and these scopes, read-only: File content, Library content, and Current user (to check it)",
+    "  3. Paste it here; it is not shown",
+    style.dim(`  (A team can sign in through the browser instead: register a private Figma OAuth app with the redirect URL ${auth.callbackUrl(auth.DEFAULT_CALLBACK_PORT)}, then set FIGMA_CLIENT_ID and FIGMA_CLIENT_SECRET.)`)
+  ].join("\n"));
+  if (process.stdin.isTTY) auth.openBrowser("https://www.figma.com/settings");
+  const token = await auth.readSecret("Token: ");
+  const { credential, checked } = await auth.tokenLogin(token);
+  await store.set(credential);
+  print(`${style.ok("signed in")} to Figma${credential.handle ? ` as ${credential.handle}` : ""}; kept in ${store.where}${checked ? "" : style.warn(" (not checked: give the token Current user: Read to let youiyoux check it)")}`);
+  return 0;
+}
 function builtHub() {
   for (const dir of [join27(TOOL_ROOT, "hub"), join27(TOOL_ROOT, "apps/web/dist")]) if (existsSync4(join27(dir, "index.html"))) return dir;
   return null;
@@ -6517,7 +6565,7 @@ async function cmdReport(values, positionals, io) {
   return result.code;
 }
 async function cmdMcp(values) {
-  const { startStdioServer } = await import("./src-OHHZY3TA.js");
+  const { startStdioServer } = await import("./src-LAUPNDCB.js");
   await startStdioServer({ projectRoot: values.project ?? process.cwd(), ...loadOptions(values), ...values.cache ? { discoverCache: values.cache } : {} });
   return -1;
 }
@@ -6595,6 +6643,7 @@ var COMMANDS = {
   upgrade: cmdUpgrade,
   record: cmdRecord,
   hub: cmdHubServe,
+  figma: cmdFigma,
   init: cmdInit,
   sync: cmdSync,
   scan: cmdScan,

package/dist/chunks/{chunk-DAGYR4NV.js → chunk-XSIH7RR4.js}

@@ -700,7 +700,10 @@ var PoliteClient = class {
     if (cached?.etag) headers["if-none-match"] = cached.etag;
     if (cached?.lastModified) headers["if-modified-since"] = cached.lastModified;
     if (this.options.token && parsed.hostname === "api.github.com") headers.authorization = `Bearer ${this.options.token}`;
-    if (this.options.figmaToken && parsed.hostname === "api.figma.com") headers["x-figma-token"] = this.options.figmaToken;
+    if (this.options.figmaToken && parsed.hostname === "api.figma.com") {
+      if (this.options.figmaBearer) headers.authorization = `Bearer ${this.options.figmaToken}`;
+      else headers["x-figma-token"] = this.options.figmaToken;
+    }
     this.stats.sent++;
     this.inFlight++;
     this.stats.maxInFlight = Math.max(this.stats.maxInFlight, this.inFlight);
@@ -2354,7 +2357,7 @@ async function ingestLink(link, options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const target = classifyLink(link, options);
   const fetchedAt = now().toISOString();
-  const result = await (target.kind === "github" ? readGithub(target, options.client, fetchedAt) : target.kind === "storybook" ? readStorybook(target, options.client, fetchedAt) : target.kind === "figma" ? options.figma ? readFigma(target, options.client, fetchedAt) : Promise.reject(new IngestError("a Figma file is read through Figma's API: set FIGMA_TOKEN to a personal access token that can read the file (Figma > Settings > Security > Personal access tokens)")) : readDesignMd(target, options.client, fetchedAt, (path) => readFile3(path, "utf8")));
+  const result = await (target.kind === "github" ? readGithub(target, options.client, fetchedAt) : target.kind === "storybook" ? readStorybook(target, options.client, fetchedAt) : target.kind === "figma" ? options.figma ? readFigma(target, options.client, fetchedAt) : Promise.reject(new IngestError("a Figma file is read through Figma's API: sign in with youiyoux figma login (or set FIGMA_TOKEN)")) : readDesignMd(target, options.client, fetchedAt, (path) => readFile3(path, "utf8")));
   const over = result.entries.length - INGEST_CAP;
   return cleanData({
     ...result,

package/dist/chunks/figma-auth-ODUC3TSR.js

@@ -0,0 +1,212 @@
+import { createRequire as __youiRequire } from "node:module"; import { dirname as __youiDir } from "node:path"; import { fileURLToPath as __youiPath } from "node:url"; const require = __youiRequire(import.meta.url); const __youiDirname = __youiDir(__youiPath(import.meta.url));
+import {
+  writeFileAtomic
+} from "./chunk-S7UN5KQK.js";
+import "./chunk-WNTS7ZO4.js";
+
+// ../cli/src/figma-auth.ts
+import { execFile, spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rm } from "node:fs/promises";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+var API = "https://api.figma.com/v1";
+var FIGMA_SCOPES = ["file_content:read", "library_content:read", "current_user:read"];
+var DEFAULT_CALLBACK_PORT = 47823;
+var RENEW_MS = 24 * 60 * 60 * 1e3;
+var KEYCHAIN = { account: "youiyoux", service: "youiyoux-figma" };
+var parse = (text) => {
+  if (!text) return null;
+  try {
+    const value = JSON.parse(text);
+    return value && (value.kind === "token" || value.kind === "oauth") ? value : null;
+  } catch {
+    return null;
+  }
+};
+function fileStore(path) {
+  return {
+    where: path,
+    get: async () => parse(await readFile(path, "utf8").catch(() => null)),
+    set: async (credential) => {
+      await mkdir(dirname(path), { recursive: true, mode: 448 });
+      await writeFileAtomic(path, `${JSON.stringify(credential)}
+`);
+      await chmod(path, 384);
+    },
+    delete: async () => rm(path).then(() => true, () => false)
+  };
+}
+function keychainStore() {
+  const { account, service } = KEYCHAIN;
+  return {
+    where: "the macOS Keychain (youiyoux-figma)",
+    get: async () => parse(await run("security", ["find-generic-password", "-a", account, "-s", service, "-w"]).then((r) => Buffer.from(r.stdout.trim(), "base64").toString("utf8"), () => null)),
+    set: (credential) => new Promise((done, fail) => {
+      const child = spawn("security", ["-i"], { stdio: ["pipe", "ignore", "pipe"] });
+      let err = "";
+      child.stderr.on("data", (c) => err += String(c));
+      child.on("error", fail);
+      child.on("exit", (code) => code === 0 && !err.trim() ? done() : fail(new Error(`the Keychain refused the credential${err.trim() ? `: ${err.trim()}` : ""}`)));
+      child.stdin.end(`add-generic-password -a ${account} -s ${service} -U -w ${Buffer.from(JSON.stringify(credential)).toString("base64")}
+`);
+    }),
+    delete: async () => run("security", ["delete-generic-password", "-a", account, "-s", service]).then(() => true, () => false)
+  };
+}
+function credentialStore(env = process.env, platform = process.platform) {
+  if (env.YOUI_FIGMA_CREDENTIALS) return fileStore(env.YOUI_FIGMA_CREDENTIALS);
+  if (platform === "darwin") return keychainStore();
+  return fileStore(join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "youiyoux", "figma.json"));
+}
+var basic = (id, secret) => `Basic ${Buffer.from(`${id}:${secret}`).toString("base64")}`;
+async function postForm(fetcher, url, auth, form) {
+  const response = await fetcher(url, { method: "POST", headers: { authorization: auth, "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(form).toString(), signal: AbortSignal.timeout(15e3) });
+  const body = await response.json().catch(() => ({}));
+  const said = [body.message, body.err, body.error].find((v) => typeof v === "string");
+  if (!response.ok) throw new Error(`Figma refused (${response.status}): ${said ?? response.statusText}`);
+  return body;
+}
+async function whoAmI(token, bearer, fetcher = fetch) {
+  const response = await fetcher(`${API}/me`, { headers: bearer ? { authorization: `Bearer ${token}` } : { "x-figma-token": token }, signal: AbortSignal.timeout(15e3) });
+  if (!response.ok) return { ok: false, handle: null, status: response.status };
+  const me = await response.json().catch(() => ({}));
+  return { ok: true, handle: typeof me.handle === "string" ? me.handle : null, status: response.status };
+}
+var oauthAppOf = (env) => env.FIGMA_CLIENT_ID && env.FIGMA_CLIENT_SECRET ? { clientId: env.FIGMA_CLIENT_ID, clientSecret: env.FIGMA_CLIENT_SECRET } : null;
+var callbackUrl = (port) => `http://127.0.0.1:${port}/callback`;
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  spawn(command, args, { stdio: "ignore", detached: true }).on("error", () => {
+  }).unref();
+}
+var page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px system-ui;margin:3rem;max-width:32rem"><h1 style="font-size:1.25rem">${title}</h1><p>${text}</p></body>`;
+async function browserLogin(options) {
+  const fetcher = options.fetcher ?? fetch;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const port = options.port ?? DEFAULT_CALLBACK_PORT;
+  const redirect = callbackUrl(port);
+  const state = randomBytes(24).toString("base64url");
+  const verifier = randomBytes(48).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const authorize = new URL("https://www.figma.com/oauth");
+  for (const [key, value] of Object.entries({ client_id: options.app.clientId, redirect_uri: redirect, scope: FIGMA_SCOPES.join(","), state, response_type: "code", code_challenge: challenge, code_challenge_method: "S256" })) authorize.searchParams.set(key, value);
+  const code = await new Promise((done, fail) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", redirect);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const finish = (status, title, text, outcome) => {
+        res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(page(title, text));
+        clearTimeout(timer);
+        server.close();
+        outcome();
+      };
+      if (url.searchParams.get("state") !== state) return finish(400, "Not this sign-in", "This answer is not for the sign-in youiyoux started. Run youiyoux figma login again.", () => fail(new Error("the answer came with another sign-in's state; nothing was kept")));
+      const error = url.searchParams.get("error");
+      if (error) return finish(400, "Not signed in", "Figma did not sign you in. You can close this tab.", () => fail(new Error(`Figma did not sign you in: ${error}`)));
+      const given = url.searchParams.get("code");
+      if (!given) return finish(400, "Not signed in", "Figma sent no code. Run youiyoux figma login again.", () => fail(new Error("Figma sent no code")));
+      finish(200, "Signed in to Figma", "youiyoux can read your Figma files now. You can close this tab.", () => done(given));
+    });
+    const timer = setTimeout(() => {
+      server.close();
+      fail(new Error("no answer from Figma within five minutes; run youiyoux figma login again"));
+    }, options.timeoutMs ?? 5 * 6e4);
+    server.once("error", (error) => {
+      clearTimeout(timer);
+      fail(new Error(error.code === "EADDRINUSE" ? `port ${port} is taken: pass --port <n>, and register ${callbackUrl(port).replace(String(port), "<n>")} in the Figma app` : error.message));
+    });
+    server.listen(port, "127.0.0.1", () => {
+      options.say?.(`Opening Figma to sign in. If no browser opens, visit:
+  ${authorize.href}`);
+      (options.open ?? openBrowser)(authorize.href);
+    });
+  });
+  const tokens = await postForm(fetcher, `${API}/oauth/token`, basic(options.app.clientId, options.app.clientSecret), { redirect_uri: redirect, code, grant_type: "authorization_code", code_verifier: verifier });
+  const accessToken = tokens.access_token;
+  const refreshToken = tokens.refresh_token;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string") throw new Error("Figma's answer had no tokens");
+  const seconds = typeof tokens.expires_in === "number" ? tokens.expires_in : 90 * 86400;
+  const me = await whoAmI(accessToken, true, fetcher).catch(() => ({ ok: false, handle: null, status: 0 }));
+  return { kind: "oauth", accessToken, refreshToken, expiresAt: new Date(now().getTime() + seconds * 1e3).toISOString(), clientId: options.app.clientId, savedAt: now().toISOString(), handle: me.handle };
+}
+async function tokenLogin(token, options = {}) {
+  const clean = token.trim();
+  if (!/^[\w-]{20,200}$/.test(clean)) throw new Error("that does not look like a Figma personal access token (figd_\u2026)");
+  const me = await whoAmI(clean, false, options.fetcher);
+  if (!me.ok && me.status !== 403) throw new Error(`Figma does not accept that token (${me.status}): make a new one`);
+  return { credential: { kind: "token", token: clean, savedAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(), handle: me.handle }, checked: me.ok };
+}
+async function figmaAccess(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.FIGMA_TOKEN) return { token: env.FIGMA_TOKEN, bearer: false, from: "env" };
+  const store = options.store ?? credentialStore(env);
+  const stored = await store.get();
+  if (!stored) return null;
+  if (stored.kind === "token") return { token: stored.token, bearer: false, from: "token" };
+  const now = (options.now ?? (() => /* @__PURE__ */ new Date()))();
+  if (Date.parse(stored.expiresAt) - now.getTime() > RENEW_MS) return { token: stored.accessToken, bearer: true, from: "oauth" };
+  const app = oauthAppOf(env);
+  if (!app || app.clientId !== stored.clientId) {
+    if (Date.parse(stored.expiresAt) > now.getTime()) return { token: stored.accessToken, bearer: true, from: "oauth" };
+    throw new Error("your Figma sign-in has lapsed, and renewing it needs your team's Figma app (FIGMA_CLIENT_ID and FIGMA_CLIENT_SECRET): set them and run youiyoux figma login");
+  }
+  const renewed = await postForm(options.fetcher ?? fetch, `${API}/oauth/refresh`, basic(app.clientId, app.clientSecret), { refresh_token: stored.refreshToken });
+  if (typeof renewed.access_token !== "string") throw new Error("Figma did not renew the sign-in: run youiyoux figma login");
+  const seconds = typeof renewed.expires_in === "number" ? renewed.expires_in : 90 * 86400;
+  await store.set({ ...stored, accessToken: renewed.access_token, expiresAt: new Date(now.getTime() + seconds * 1e3).toISOString() });
+  return { token: renewed.access_token, bearer: true, from: "oauth" };
+}
+async function readSecret(prompt, input = process.stdin, output = process.stderr) {
+  if (!input.isTTY) {
+    let text = "";
+    for await (const chunk of input) {
+      text += String(chunk);
+      if (text.includes("\n")) break;
+    }
+    return text.split(/\r?\n/)[0] ?? "";
+  }
+  output.write(prompt);
+  input.setRawMode(true);
+  input.resume();
+  return new Promise((done, fail) => {
+    let value = "";
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\r" || char === "\n") return finish(() => done(value));
+        if (char === "") return finish(() => fail(new Error("cancelled")));
+        if (char === "\x7F" || char === "\b") value = value.slice(0, -1);
+        else if (char >= " ") value += char;
+      }
+    };
+    const finish = (then) => {
+      input.off("data", onData);
+      input.setRawMode(false);
+      input.pause();
+      output.write("\n");
+      then();
+    };
+    input.on("data", onData);
+  });
+}
+export {
+  DEFAULT_CALLBACK_PORT,
+  FIGMA_SCOPES,
+  browserLogin,
+  callbackUrl,
+  credentialStore,
+  figmaAccess,
+  fileStore,
+  keychainStore,
+  oauthAppOf,
+  openBrowser,
+  readSecret,
+  tokenLogin,
+  whoAmI
+};

package/dist/chunks/{ingest-R2TM3QBM.js → ingest-R5CX6R7G.js}

@@ -4,7 +4,7 @@ import {
   plural,
   style,
   workflowStateDir
-} from "./chunk-QEUZDGIF.js";
+} from "./chunk-ED35SP3F.js";
 import "./chunk-HII2I2PI.js";
 import "./chunk-42YJX3W5.js";
 import "./chunk-HIXGUALJ.js";
@@ -14,12 +14,12 @@ import "./chunk-WNTS7ZO4.js";
 // ../cli/src/ingest.ts
 import { userInfo } from "node:os";
 async function readLink(link, options) {
-  const { githubBuckets, ingestLink, PoliteClient } = await import("./src-IMWXYWQK.js");
+  const { githubBuckets, ingestLink, PoliteClient } = await import("./src-FBTLHBVB.js");
   const env = options.env ?? process.env;
   const token = env.GITHUB_TOKEN || void 0;
-  const figmaToken = env.FIGMA_TOKEN || void 0;
-  const client = new PoliteClient({ buckets: githubBuckets(token), ...token ? { token } : {}, ...figmaToken ? { figmaToken } : {} });
-  const result = await ingestLink(link, { client, allowLocal: options.allowLocal, figma: Boolean(figmaToken) });
+  const figma = /figma\.com\//i.test(link) ? await (await import("./figma-auth-ODUC3TSR.js")).figmaAccess({ env }) : null;
+  const client = new PoliteClient({ buckets: githubBuckets(token), ...token ? { token } : {}, ...figma ? { figmaToken: figma.token, figmaBearer: figma.bearer } : {} });
+  const result = await ingestLink(link, { client, allowLocal: options.allowLocal, figma: Boolean(figma) });
   return { link: result.link, source: result.source, license: result.license, fetchedAt: result.fetchedAt, entries: result.entries, skipped: result.skipped, notes: result.notes };
 }
 async function fileIngestDraft(project, reading, state) {

package/dist/chunks/{src-IMWXYWQK.js → src-FBTLHBVB.js}

@@ -127,7 +127,7 @@ import {
   writeHttpCache,
   writeJson,
   writeSources
-} from "./chunk-DAGYR4NV.js";
+} from "./chunk-XSIH7RR4.js";
 import "./chunk-A2IZOTJG.js";
 import "./chunk-S7UN5KQK.js";
 import "./chunk-WNTS7ZO4.js";

package/dist/chunks/{src-OHHZY3TA.js → src-LAUPNDCB.js}

@@ -51,7 +51,7 @@ import {
   searchCatalog,
   sharedStore,
   showFromCatalog
-} from "./chunk-DAGYR4NV.js";
+} from "./chunk-XSIH7RR4.js";
 import {
   storeLocation
 } from "./chunk-A2IZOTJG.js";

package/dist/hub-previews.js

@@ -6,7 +6,7 @@ import {
 import {
   discoverCacheDir,
   loadIndex
-} from "./chunks/chunk-DAGYR4NV.js";
+} from "./chunks/chunk-XSIH7RR4.js";
 import "./chunks/chunk-A2IZOTJG.js";
 import {
   THUMBS_PATH,
@@ -17,8 +17,8 @@ import {
   selectCandidates,
   thumbsDir,
   writeThumbIndex
-} from "./chunks/chunk-FTL53MU3.js";
-import "./chunks/chunk-CZJFEND6.js";
+} from "./chunks/chunk-FO3WR47A.js";
+import "./chunks/chunk-3SBSYNAG.js";
 import "./chunks/chunk-FVVL5JCY.js";
 import "./chunks/chunk-S7UN5KQK.js";
 import "./chunks/chunk-WNTS7ZO4.js";

package/dist/hub-server.js

@@ -2,7 +2,7 @@
 import { createRequire as __youiRequire } from "node:module"; import { dirname as __youiDir } from "node:path"; import { fileURLToPath as __youiPath } from "node:url"; const require = __youiRequire(import.meta.url); const __youiDirname = __youiDir(__youiPath(import.meta.url));
 import {
   discoverThumbsMiddleware
-} from "./chunks/chunk-FTL53MU3.js";
+} from "./chunks/chunk-FO3WR47A.js";
 import {
   isLocalHost,
   loadPackage,
@@ -10,7 +10,7 @@ import {
   readTryIndex,
   send,
   tryMiddleware
-} from "./chunks/chunk-CZJFEND6.js";
+} from "./chunks/chunk-3SBSYNAG.js";
 import "./chunks/chunk-FVVL5JCY.js";
 import "./chunks/chunk-S7UN5KQK.js";
 import "./chunks/chunk-WNTS7ZO4.js";

package/dist/hub-snapshot.js

@@ -3,7 +3,7 @@ import { createRequire as __youiRequire } from "node:module"; import { dirname a
 import {
   loadPackage,
   tryProject
-} from "./chunks/chunk-CZJFEND6.js";
+} from "./chunks/chunk-3SBSYNAG.js";
 import "./chunks/chunk-FVVL5JCY.js";
 import "./chunks/chunk-WNTS7ZO4.js";
 

package/dist/youi.js

@@ -2,12 +2,12 @@
 import { createRequire as __youiRequire } from "node:module"; import { dirname as __youiDir } from "node:path"; import { fileURLToPath as __youiPath } from "node:url"; const require = __youiRequire(import.meta.url); const __youiDirname = __youiDir(__youiPath(import.meta.url));
 import {
   main
-} from "./chunks/chunk-T4EHV4XY.js";
-import "./chunks/chunk-QEUZDGIF.js";
+} from "./chunks/chunk-WMIJNZIL.js";
+import "./chunks/chunk-ED35SP3F.js";
 import "./chunks/chunk-HII2I2PI.js";
 import "./chunks/chunk-42YJX3W5.js";
 import "./chunks/chunk-ALQVHSF2.js";
-import "./chunks/chunk-DAGYR4NV.js";
+import "./chunks/chunk-XSIH7RR4.js";
 import "./chunks/chunk-A2IZOTJG.js";
 import "./chunks/chunk-FVVL5JCY.js";
 import "./chunks/chunk-HIXGUALJ.js";

package/dist/youiyoux.js

@@ -3,12 +3,12 @@ import { createRequire as __youiRequire } from "node:module"; import { dirname a
 import {
   COMMAND_NAMES,
   main
-} from "./chunks/chunk-T4EHV4XY.js";
-import "./chunks/chunk-QEUZDGIF.js";
+} from "./chunks/chunk-WMIJNZIL.js";
+import "./chunks/chunk-ED35SP3F.js";
 import "./chunks/chunk-HII2I2PI.js";
 import "./chunks/chunk-42YJX3W5.js";
 import "./chunks/chunk-ALQVHSF2.js";
-import "./chunks/chunk-DAGYR4NV.js";
+import "./chunks/chunk-XSIH7RR4.js";
 import "./chunks/chunk-A2IZOTJG.js";
 import "./chunks/chunk-FVVL5JCY.js";
 import "./chunks/chunk-HIXGUALJ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youiyoux",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Your agent rebuilds components you already have. youiyoux catches it: npx youiyoux turns any repo into a shareable report of near-duplicate components, hardcoded token values and off-library imports, with the fixes.",
   "license": "MIT",
   "repository": {
@@ -46,9 +46,9 @@
     "typescript": "6.0.3"
   },
   "devDependencies": {
-    "@youiyoux/cli": "0.1.15",
-    "@youiyoux/core": "0.1.15",
-    "@youiyoux/scanner": "0.1.15"
+    "@youiyoux/cli": "0.1.16",
+    "@youiyoux/scanner": "0.1.16",
+    "@youiyoux/core": "0.1.16"
   },
   "exports": {
     "./package.json": "./package.json"