Exporting the recorded Figma designs

The four source documents exported on 12 August 2026 already live in wisent-components/figma/files/. Exporting their component geometry and SVGs does not require buying another Figma seat. The exporter supplements the recorded versions rather than linking applications to a changing live design.

Run on the existing export host

scripts/export-figma-source.sh runs as a Stado job on the Mac mini, using ~/.stado/work/design-assets. Set WISENT_COMPONENTS_REF to the full source commit. Where Stado declares the credential, use its scoped secret reference FIGMA_TOKEN=weles-figma-personal-access-token#api_key. Otherwise FIGMA_TOKEN_SOURCE=weles uses the existing Weles weles-figma-design-assets-exporter reader; it does not grant the Stado agent access to a Weles credential. The token never belongs in command arguments. An existing FIGMA_TOKEN_COMMAND is also supported. Optional FIGMA_TOKEN_RENEW is not a remedy for per-user rate limits.

The Weles reader comes from the installed admission release at ~/.stado/services/weles-admission/current/darwin-arm/runtime, not an old partial token-acquisition checkout. The exporter resolves current once, prints the resulting directory, and requires the endpoint helper, credential reader, endpoint-resolution module, and scope catalog before contacting Figma. WELES_FIGMA_RUNTIME can select another Weles release or a revision-pinned reader bundle containing those four files at their repository paths; a missing entry is reported as Weles export reader is missing <path>, not as a Figma refusal. Reading this credential does not launch a browser or renew the token. Git fetch and push disable credential helpers and terminal/askpass prompts; SSH uses batch mode. Unavailable Git credentials cause a refusal instead of a Keychain consent window or a wait for input.

The exporter acquires the token once and stops immediately if that reader fails. It does not run a fetcher with empty stdin or print a misleading unchanged export afterward. Weles's invalid single-field response diagnostic names the Skarbiec endpoint, consumer, item and field, then reports returned key names, identifier matches, and value/provider types and lengths without printing the credential. This is a credential-response failure, not a Figma HTTP refusal. A nonempty field in a host's vault does not prove that the selected Skarbiec endpoint returned the expected response. The optional provider is metadata, not a route name: the reader follows Skarbiec's bound of 1–128 UTF-8 bytes with no NUL, CR or LF. Spaces, punctuation and non-ASCII text do not invalidate an otherwise valid credential response. A refused provider also reports its byte length and providerValid without printing the metadata or credential.

FIGMA_TOKEN_SOURCE=weles sh scripts/export-figma-source.sh
FIGMA_TOKEN_SOURCE=weles sh scripts/export-figma-source.sh --file YjbhUB2uCYz1f75TQ3s8UE

The default command supplements geometry and SVGs, regenerates snapshots and glyphs, and pushes a unique dated branch. The file-only command snapshots one additional file, or publishes its recorded 404, without fetching component sources. It prints audit-exit=not-run, preserves failures, and does not claim component parity. Neither command modifies wisent-app.

Export an independent component source

--components FIGMA_FILE_KEY fetches geometry and SVGs for just one recorded component source, without requesting the fifth file or the other component sources. A file-specific rate limit therefore need not stop another accessible source. For example:

FIGMA_TOKEN_SOURCE=weles sh scripts/export-figma-source.sh --components fPvmXkvai4Aouum0hnAO6S
FIGMA_TOKEN_SOURCE=weles sh scripts/export-figma-source.sh --components iyYN8q8ZJMRy6oSKjjQIYo

An unknown source is refused as No recorded component source for Figma file <key> before a Figma request. Component-only mode publishes retained geometry and render files with their manifest, preserves fetch failures, and prints audit-exit=not-run. The full command still regenerates the package and audits all sources; one completed source is not evidence that every component is complete. Run exports serially because they use the same host checkout.

Deliver the script without a second Git login

If Stado's initial --repo clone reports Permission denied (publickey), the export script has not run. Submit the script with stado machine submit using source_archive_path, the full repo_ref, and a stable client_request_id. The script still uses the existing authenticated checkout on the export host. Package the file from the commit's scripts tree: a commit archive adds pax_global_header, and an archive with a directory entry adds scripts/; Stado refused both entries as INVALID_SOURCE_ARCHIVE.

revision="$(git rev-parse HEAD)"
mkdir -p .wisent-output
git archive --format=tar.gz --output=.wisent-output/figma-export-source.tar.gz "$revision:scripts" export-figma-source.sh

Set the request's source_archive_path to that archive and its repo_ref and command's WISENT_COMPONENTS_REF to the same full commit. The extracted entry is export-figma-source.sh, without the scripts/ prefix. Retain the returned job ID and archive SHA-256, then read stado machine status JOB_ID; do not submit a second job because the first is still queued. A job with started_at: null has no Figma result. A worker reporting disk-pressure-active and accepting_jobs=false is refusing new work because of host capacity, not because Figma requires a purchase.

Keep completed work

A fresh successful fetch of the current 340 components takes six Tier 1 requests: one node request and one render-map request per component source. Both endpoints receive the Figma version recorded in figma/inventory.json. An additional file takes one document request without a depth-only preflight. Image-fill URLs use Tier 2; the returned assets are downloaded from the CDN.

figma/.export-cache/ retains versioned geometry, render URLs, and partial documents. A stopped asset download does not discard its render map. SVG paths identify the source file and version. Only Figma's explicit null result means a node is unrenderable; a failed request never substitutes an empty reference.

Read a refusal correctly

• HTTP 429: exit 75; the complete Retry-After is saved in figma/.export-cache/tier-1-<file-key>-retry.json (tier 2 for image fills). Until retryAt, a rerun sends no request for that file in that tier. The wait is never shortened and a refused batch is never split into more calls. Another file can belong to another plan, so one refusal is not proof that every file is unavailable.
• HTTP 403: the failed endpoint and Figma's response identify the refusal; the exporter does not assume the token expired or falsely record the file as missing.
• HTTP 404: the file is recorded in inventory.json.unreachable and the command exits nonzero.
• HTTP 5xx: bounded retries retain the actual failure instead of recording a successful null render.

The retry timestamp is advice, not a promised success or monthly reset. A partial cache is not a queued job. A pushed branch is not visual proof: the full exporter preserves its audit's nonzero exit status, and Probierz owns the real figma-parity journey against the exported SVGs.

See Figma's batching and version parameters, its rate-limit contract, and the package's current export instructions and design plan.