---
"@ux-team/tvu-design-system": patch
---

Mockup integrity CLI: drop a redundant request parameter, tell the two "audit script broke on install" cases apart, and ship two libs that shipped scripts already imported.

`scripts/audit-mockup-integrity.mjs` requested `geometry=paths` on both of its Figma REST calls, which makes Figma inline every vector node's path data. None of its four probes ever read a geometry field — they only read `absoluteBoundingBox` / `type` / `name` / `layoutMode` / `children` — so that payload was pure inflation, and inflation is what pushes the response past V8's single-string limit (`RangeError: Invalid string length`) on large files, *after* the request has already succeeded. The parameter is gone from both URLs. **This does not remove the limit** — the `--node` subtree path decodes through the same `res.json()`; it only stops making the payload bigger than it needs to be. Actual size reduction is not quantified (it needs a live API call to measure).

Error paths are now distinguishable by exit code, which they were not: hitting the string-length limit, forgetting `--file`, and a Figma 5xx all exited `2`. Now `2` = bad usage, `3` = response too large to decode (with the concrete narrowing options printed), `4` = Figma API non-2xx. `scripts/audit-mockup-conformance.mjs` widened its ERROR bucket from `code === 2` to `code >= 2` in the same change, so the new codes cannot slip out of its summary. `ok`/handoff-gate semantics (`every(exitCode === 0)`) are unchanged.

Two files that shipped scripts already imported were missing from the published tarball, so those audits failed with `MODULE_NOT_FOUND` for consumers rather than running:

- `scripts/lib/mockup-library-origin.mjs`, imported by `audit-mockup-library-origin.mjs` — a CLI documented in `docs/CONSUMER_AUDIT_SETUP.md`. **This is a fix to an existing consumer-facing break, not new surface.**
- `scripts/lib/figma-payload-limit.mjs`, the shared decode-failure predicate introduced by this change and imported by `audit-mockup-integrity.mjs`.

No component API, token, style, or export-map changes.