cyber-figma

0.1.1

Patch Changes

• 7b9517f: Bundle the CLI's dependencies into dist/cli.js, and let the skills invoke it directly.

  An installed agent plugin is a copy of a source checkout, not an npm install, so its directory has no reliable node_modules. That is why every skill had to shell out through a pinned npx — the fetch was the only thing supplying the dependency tree. The published dist/cli.js now inlines each runtime dependency and runs with no node_modules present at all.

  skills/init-figma/scripts/cyber-figma.mjs launches that shipped CLI, and the Ensure cyber-figma CLI section now prefers it, falling back to a global install and then to pinned npx exactly as before. The fallback is deliberate: resolving the launcher path is model behaviour, not a guarantee.

  @figma/rest-api-spec is not inlined and does not need to be — it is consumed only through import type, so it never reaches the bundler and contributes nothing to the output.

  The library entries (. and ./mcp) are unchanged. Their dependencies stay external so a consumer that also uses zod or the MCP SDK shares one copy instead of getting a private inlined duplicate.

0.1.0

Minor Changes

• c40d450: Add the analytics and organization domains: analytics, activity-log, developer-log, ai-usage, discovery, and payment, with the matching figma_analytics_*, figma_activity_log_list, figma_developer_log_list, figma_ai_usage_daily, figma_discovery_text_events, and figma_payment_get MCP tools. Together they cover all six Library Analytics endpoints plus Activity Logs, Developer Logs, AI Usage, Discovery, and Payments — eleven endpoints, none skipped.

  Library Analytics ships one command per (asset, metric) pair, because the actions half is a weekly time series with a date window and the usages half is a snapshot with none; --group-by is required and offers only the two dimensions that endpoint actually has.

  These endpoints are gated in ways a bare 403 cannot explain, so every command and tool description names its requirement: Activity Logs needs OAuth or a plan access token and will never work with a personal one; Developer Logs and AI Usage are reachable with a plan access token only; Discovery needs OAuth 2 plus the Governance+ add-on; and Payments is the reverse — a personal access token only, on a resource you own, with no OAuth support at all. Windows, grouping dimensions, and enum filters are validated before the request rather than paid for in a round trip.

  Activity Logs is deliberately declared as an unpaginated endpoint: its response carries a cursor that Figma documents no request parameter for, so the result reports has_more and points at a narrower time window instead of advertising a --cursor flag that would silently re-request the first page.

• c155cd1: Add the published-library domains: component, component-set, and style. Each ships team-list, file-list, and get on the CLI and the matching figma_<resource>_<action> MCP tools, covering all nine Components / Component Sets / Styles endpoints. The team lists declare Figma's integer id-cursor pagination (page_size default 30, max 1000), the file lists declare none, and every description states the two rules these endpoints are misread on: they return published library content only, and a file-scoped read needs a main file key because branches cannot publish.

• d1b024c: Add the comments domain: comment list, comment create, comment delete, and comment reaction list|add|delete, with the matching figma_comment_* and figma_comment_reaction_* MCP tools. Covers all three Comments endpoints and all three Comment Reactions endpoints.

  Comments can be posted as replies (--reply-to) and pinned to a point, a frame, or a region (--x/--y, --node-id, --region-width/--region-height, --pin-corner); --thread narrows a listing to one conversation, which Figma's flat comment list offers no parameter for. Reactions take an emoji shortcode such as :heart: and a literal emoji is refused before the request is spent. Both deletes are idempotent, and the two rules Figma answers with a bare 403 — only the author may delete a comment, only the person who reacted may remove a reaction — are reported as hints. Under --auth-mode plan the writes are refused up front, since Figma does not support file_comments:write for plan access tokens.

• ca73fb7: Add the dev resources domain: dev-resource list|create|update|delete and the figma_dev_resource_* MCP tools, covering all four Dev Resources endpoints. The two bulk writes answer HTTP 200 even when items fail, so every write is reported as ok / requested / succeeded / failed / errors in text, JSON, and TOON alike, and a write where Figma rejected everything exits nonzero instead of acknowledging a change that never happened.

• f87b9a1: Add the variables domain: cyber-figma variable list|collections|get|apply and the figma_variable_list, figma_variable_collection_list, figma_variable_get, and figma_variable_apply MCP tools, covering all three Figma Variables endpoints.

  Variables and collections come back as lists rather than the id-keyed maps Figma sends, get resolves the variableId a node carries in boundVariables, and apply checks a batch change set against the documented limits — action shape, the 40-mode and 5000-variable ceilings, forbidden name characters, value types — before spending a request, with --dry-run to run that check alone.

  Every operation needs an Enterprise plan, reading included; writing also needs a Full seat or admin and is not reachable with a plan access token. The CLI help, the tool descriptions, and the exit code (7) all say so.

• 29e6e02: Ship the agent-plugin layer. The package root is the plugin root, so the tarball now carries the Agent Plugins 1.0.0 manifests (plugin.json, mcp.json), the per-vendor manifests for Claude Code, Cursor, and Codex, and three skills: init-figma, inspect-figma-file, and export-figma-assets.

• ba74636: Add the webhooks domain: cyber-figma webhook list|get|create|update|delete|requests and the figma_webhook_* MCP tools, covering all seven Webhooks v2 endpoints. Passcodes are masked on every path out — including --json and MCP output — and --passcode-env <VAR> keeps one out of shell history; endpoints are checked for https before Figma is asked to call them; and a refused write names the role that context requires (team admin, or Can edit on the project or file) instead of relaying a bare 403.

• 4924b5c: Add the shared spine: a hand-written typed fetch client for the Figma REST API (auth modes, integer query coercion, envelope unwrapping, bounded 429 retry), error classification that names Figma's misleading codes and their fixes, normalization of all four pagination families, agent-friendly output (TOON/JSON/text, truncation, empty states, next steps), URL and team-scope resolution, and the CLI and MCP entrypoints with the seam resource domains plug into.