API capability pack for bounded Figma REST API operations against https://api.figma.com only. Enroll a figma connection as either OAuth bearer auth or header auth that injects X-Figma-Token for a personal or plan access token; no credential is embedded in this manifest. The pack reads the current user, files, nodes, rendered image URLs, image-fill references, file metadata, team projects, project metadata, project files, file versions, comments, reactions, published components, component sets, styles, organization activity logs, local and published variable inventories, dev resources, library analytics, and oEmbed previews for daily design-to-build workflows. Approval-gated writes are limited to creating/deleting comments, adding/removing comment reactions, applying explicit variable mutations, and creating/updating/deleting dev-resource links. The pack intentionally excludes webhook list/read/create/update/delete because Figma webhook responses include passcode secret material, plus developer-log token filters, AI usage metering, payments, SCIM, file mutation/upload, arbitrary file export downloads, broad admin configuration, OAuth token exchange, and arbitrary API passthrough.