---
"@ux-team/tvu-design-system": patch
---

Mockup integrity CLI: a chunked fallback so an oversized Figma file no longer dead-ends, and the mockup cache writer stops serializing the same 400 MB object four times.

**Read side.** `scripts/audit-mockup-integrity.mjs` still fetches `/files/{key}` whole and decodes it with native `JSON.parse` — unchanged behaviour on every file that already worked. What changed is what happens when that decode hits V8's single-string limit: instead of exiting, it now refetches as `?depth=1` plus one `nodes?ids=<pageId>` request per page and reassembles. Every chunk is parsed by native `JSON.parse`, so no hand-written parser is involved. `figma-sync/api.mjs` gains `getFileChunked()` with the same fallback for library callers; the shared `get()` is deliberately left as an integral decode, because it backs five other bounded endpoints that should not take on reassembly risk.

This raises the ceiling by roughly the page count. It does not remove it: a single page whose own subtree exceeds the limit still fails, and `--node` decodes through the same path. If a page cannot be fetched, the run fails rather than auditing a document that is silently missing a page.

**Write side.** `figma-sync/sync-mockup-data.mjs` wrote its cache with `JSON.stringify(output, null, 2)`. Measured on the real 402,872,387-byte artifact in this repo: **304,456,597 bytes (75.6%) of that file was pretty-print whitespace**, putting a single string at ~75% of the limit where the compact form sits at ~18%. Pretty-printing is gone — these caches are machine-read, and nobody diffs 400 MB by eye.

The same script also serialized that object three more times (twice to answer "did it change?", once to print a size in KB) and deep-cloned it twice. Change detection is now a `_meta.fileSha256` field compared by reading the existing file's first 4 KB; the size comes from `statSync`. The whole run serializes once — the write itself. Cache files gain `_meta.fileSha256` and lose their indentation; `_meta` remains the first key, which `audit-mockup-conformance.mjs` depends on and a test now pins. Existing caches get rewritten once on the next sync because they predate the hash field.

Two libs are added to the published file list because shipped scripts import them: `scripts/lib/figma-file-chunked.mjs` (new) and `scripts/lib/figma-payload-limit.mjs` (gained a dump-header reader).

No component API, token, style, or export-map changes.