spec-layer 0.1.0 → 0.2.1

package/dist/cli.js

@@ -1,4 +1,559 @@
 #!/usr/bin/env node
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/js-sha256/src/sha256.js
+var require_sha256 = __commonJS({
+  "../../node_modules/js-sha256/src/sha256.js"(exports, module) {
+    (function() {
+      "use strict";
+      var ERROR = "input is invalid type";
+      var WINDOW = typeof window === "object";
+      var root = WINDOW ? window : {};
+      if (root.JS_SHA256_NO_WINDOW) {
+        WINDOW = false;
+      }
+      var WEB_WORKER = !WINDOW && typeof self === "object";
+      var NODE_JS = !root.JS_SHA256_NO_NODE_JS && typeof process === "object" && process.versions && process.versions.node && process.type != "renderer";
+      if (NODE_JS) {
+        root = global;
+      } else if (WEB_WORKER) {
+        root = self;
+      }
+      var COMMON_JS = !root.JS_SHA256_NO_COMMON_JS && typeof module === "object" && module.exports;
+      var AMD = typeof define === "function" && define.amd;
+      var ARRAY_BUFFER = !root.JS_SHA256_NO_ARRAY_BUFFER && typeof ArrayBuffer !== "undefined";
+      var HEX_CHARS = "0123456789abcdef".split("");
+      var EXTRA = [-2147483648, 8388608, 32768, 128];
+      var SHIFT = [24, 16, 8, 0];
+      var K = [
+        1116352408,
+        1899447441,
+        3049323471,
+        3921009573,
+        961987163,
+        1508970993,
+        2453635748,
+        2870763221,
+        3624381080,
+        310598401,
+        607225278,
+        1426881987,
+        1925078388,
+        2162078206,
+        2614888103,
+        3248222580,
+        3835390401,
+        4022224774,
+        264347078,
+        604807628,
+        770255983,
+        1249150122,
+        1555081692,
+        1996064986,
+        2554220882,
+        2821834349,
+        2952996808,
+        3210313671,
+        3336571891,
+        3584528711,
+        113926993,
+        338241895,
+        666307205,
+        773529912,
+        1294757372,
+        1396182291,
+        1695183700,
+        1986661051,
+        2177026350,
+        2456956037,
+        2730485921,
+        2820302411,
+        3259730800,
+        3345764771,
+        3516065817,
+        3600352804,
+        4094571909,
+        275423344,
+        430227734,
+        506948616,
+        659060556,
+        883997877,
+        958139571,
+        1322822218,
+        1537002063,
+        1747873779,
+        1955562222,
+        2024104815,
+        2227730452,
+        2361852424,
+        2428436474,
+        2756734187,
+        3204031479,
+        3329325298
+      ];
+      var OUTPUT_TYPES = ["hex", "array", "digest", "arrayBuffer"];
+      var blocks = [];
+      if (root.JS_SHA256_NO_NODE_JS || !Array.isArray) {
+        Array.isArray = function(obj) {
+          return Object.prototype.toString.call(obj) === "[object Array]";
+        };
+      }
+      if (ARRAY_BUFFER && (root.JS_SHA256_NO_ARRAY_BUFFER_IS_VIEW || !ArrayBuffer.isView)) {
+        ArrayBuffer.isView = function(obj) {
+          return typeof obj === "object" && obj.buffer && obj.buffer.constructor === ArrayBuffer;
+        };
+      }
+      var createOutputMethod = function(outputType, is224) {
+        return function(message) {
+          return new Sha256(is224, true).update(message)[outputType]();
+        };
+      };
+      var createMethod = function(is224) {
+        var method = createOutputMethod("hex", is224);
+        if (NODE_JS) {
+          method = nodeWrap(method, is224);
+        }
+        method.create = function() {
+          return new Sha256(is224);
+        };
+        method.update = function(message) {
+          return method.create().update(message);
+        };
+        for (var i = 0; i < OUTPUT_TYPES.length; ++i) {
+          var type = OUTPUT_TYPES[i];
+          method[type] = createOutputMethod(type, is224);
+        }
+        return method;
+      };
+      var nodeWrap = function(method, is224) {
+        var crypto = __require("crypto");
+        var Buffer2 = __require("buffer").Buffer;
+        var algorithm = is224 ? "sha224" : "sha256";
+        var bufferFrom;
+        if (Buffer2.from && !root.JS_SHA256_NO_BUFFER_FROM) {
+          bufferFrom = Buffer2.from;
+        } else {
+          bufferFrom = function(message) {
+            return new Buffer2(message);
+          };
+        }
+        var nodeMethod = function(message) {
+          if (typeof message === "string") {
+            return crypto.createHash(algorithm).update(message, "utf8").digest("hex");
+          } else {
+            if (message === null || message === void 0) {
+              throw new Error(ERROR);
+            } else if (message.constructor === ArrayBuffer) {
+              message = new Uint8Array(message);
+            }
+          }
+          if (Array.isArray(message) || ArrayBuffer.isView(message) || message.constructor === Buffer2) {
+            return crypto.createHash(algorithm).update(bufferFrom(message)).digest("hex");
+          } else {
+            return method(message);
+          }
+        };
+        return nodeMethod;
+      };
+      var createHmacOutputMethod = function(outputType, is224) {
+        return function(key, message) {
+          return new HmacSha256(key, is224, true).update(message)[outputType]();
+        };
+      };
+      var createHmacMethod = function(is224) {
+        var method = createHmacOutputMethod("hex", is224);
+        method.create = function(key) {
+          return new HmacSha256(key, is224);
+        };
+        method.update = function(key, message) {
+          return method.create(key).update(message);
+        };
+        for (var i = 0; i < OUTPUT_TYPES.length; ++i) {
+          var type = OUTPUT_TYPES[i];
+          method[type] = createHmacOutputMethod(type, is224);
+        }
+        return method;
+      };
+      function Sha256(is224, sharedMemory) {
+        if (sharedMemory) {
+          blocks[0] = blocks[16] = blocks[1] = blocks[2] = blocks[3] = blocks[4] = blocks[5] = blocks[6] = blocks[7] = blocks[8] = blocks[9] = blocks[10] = blocks[11] = blocks[12] = blocks[13] = blocks[14] = blocks[15] = 0;
+          this.blocks = blocks;
+        } else {
+          this.blocks = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        }
+        if (is224) {
+          this.h0 = 3238371032;
+          this.h1 = 914150663;
+          this.h2 = 812702999;
+          this.h3 = 4144912697;
+          this.h4 = 4290775857;
+          this.h5 = 1750603025;
+          this.h6 = 1694076839;
+          this.h7 = 3204075428;
+        } else {
+          this.h0 = 1779033703;
+          this.h1 = 3144134277;
+          this.h2 = 1013904242;
+          this.h3 = 2773480762;
+          this.h4 = 1359893119;
+          this.h5 = 2600822924;
+          this.h6 = 528734635;
+          this.h7 = 1541459225;
+        }
+        this.block = this.start = this.bytes = this.hBytes = 0;
+        this.finalized = this.hashed = false;
+        this.first = true;
+        this.is224 = is224;
+      }
+      Sha256.prototype.update = function(message) {
+        if (this.finalized) {
+          return;
+        }
+        var notString, type = typeof message;
+        if (type !== "string") {
+          if (type === "object") {
+            if (message === null) {
+              throw new Error(ERROR);
+            } else if (ARRAY_BUFFER && message.constructor === ArrayBuffer) {
+              message = new Uint8Array(message);
+            } else if (!Array.isArray(message)) {
+              if (!ARRAY_BUFFER || !ArrayBuffer.isView(message)) {
+                throw new Error(ERROR);
+              }
+            }
+          } else {
+            throw new Error(ERROR);
+          }
+          notString = true;
+        }
+        var code, index = 0, i, length = message.length, blocks2 = this.blocks;
+        while (index < length) {
+          if (this.hashed) {
+            this.hashed = false;
+            blocks2[0] = this.block;
+            this.block = blocks2[16] = blocks2[1] = blocks2[2] = blocks2[3] = blocks2[4] = blocks2[5] = blocks2[6] = blocks2[7] = blocks2[8] = blocks2[9] = blocks2[10] = blocks2[11] = blocks2[12] = blocks2[13] = blocks2[14] = blocks2[15] = 0;
+          }
+          if (notString) {
+            for (i = this.start; index < length && i < 64; ++index) {
+              blocks2[i >>> 2] |= message[index] << SHIFT[i++ & 3];
+            }
+          } else {
+            for (i = this.start; index < length && i < 64; ++index) {
+              code = message.charCodeAt(index);
+              if (code < 128) {
+                blocks2[i >>> 2] |= code << SHIFT[i++ & 3];
+              } else if (code < 2048) {
+                blocks2[i >>> 2] |= (192 | code >>> 6) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code & 63) << SHIFT[i++ & 3];
+              } else if (code < 55296 || code >= 57344) {
+                blocks2[i >>> 2] |= (224 | code >>> 12) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code >>> 6 & 63) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code & 63) << SHIFT[i++ & 3];
+              } else {
+                code = 65536 + ((code & 1023) << 10 | message.charCodeAt(++index) & 1023);
+                blocks2[i >>> 2] |= (240 | code >>> 18) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code >>> 12 & 63) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code >>> 6 & 63) << SHIFT[i++ & 3];
+                blocks2[i >>> 2] |= (128 | code & 63) << SHIFT[i++ & 3];
+              }
+            }
+          }
+          this.lastByteIndex = i;
+          this.bytes += i - this.start;
+          if (i >= 64) {
+            this.block = blocks2[16];
+            this.start = i - 64;
+            this.hash();
+            this.hashed = true;
+          } else {
+            this.start = i;
+          }
+        }
+        if (this.bytes > 4294967295) {
+          this.hBytes += this.bytes / 4294967296 << 0;
+          this.bytes = this.bytes % 4294967296;
+        }
+        return this;
+      };
+      Sha256.prototype.finalize = function() {
+        if (this.finalized) {
+          return;
+        }
+        this.finalized = true;
+        var blocks2 = this.blocks, i = this.lastByteIndex;
+        blocks2[16] = this.block;
+        blocks2[i >>> 2] |= EXTRA[i & 3];
+        this.block = blocks2[16];
+        if (i >= 56) {
+          if (!this.hashed) {
+            this.hash();
+          }
+          blocks2[0] = this.block;
+          blocks2[16] = blocks2[1] = blocks2[2] = blocks2[3] = blocks2[4] = blocks2[5] = blocks2[6] = blocks2[7] = blocks2[8] = blocks2[9] = blocks2[10] = blocks2[11] = blocks2[12] = blocks2[13] = blocks2[14] = blocks2[15] = 0;
+        }
+        blocks2[14] = this.hBytes << 3 | this.bytes >>> 29;
+        blocks2[15] = this.bytes << 3;
+        this.hash();
+      };
+      Sha256.prototype.hash = function() {
+        var a = this.h0, b = this.h1, c = this.h2, d = this.h3, e = this.h4, f = this.h5, g = this.h6, h = this.h7, blocks2 = this.blocks, j, s0, s1, maj, t1, t2, ch, ab, da, cd, bc;
+        for (j = 16; j < 64; ++j) {
+          t1 = blocks2[j - 15];
+          s0 = (t1 >>> 7 | t1 << 25) ^ (t1 >>> 18 | t1 << 14) ^ t1 >>> 3;
+          t1 = blocks2[j - 2];
+          s1 = (t1 >>> 17 | t1 << 15) ^ (t1 >>> 19 | t1 << 13) ^ t1 >>> 10;
+          blocks2[j] = blocks2[j - 16] + s0 + blocks2[j - 7] + s1 << 0;
+        }
+        bc = b & c;
+        for (j = 0; j < 64; j += 4) {
+          if (this.first) {
+            if (this.is224) {
+              ab = 300032;
+              t1 = blocks2[0] - 1413257819;
+              h = t1 - 150054599 << 0;
+              d = t1 + 24177077 << 0;
+            } else {
+              ab = 704751109;
+              t1 = blocks2[0] - 210244248;
+              h = t1 - 1521486534 << 0;
+              d = t1 + 143694565 << 0;
+            }
+            this.first = false;
+          } else {
+            s0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+            s1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+            ab = a & b;
+            maj = ab ^ a & c ^ bc;
+            ch = e & f ^ ~e & g;
+            t1 = h + s1 + ch + K[j] + blocks2[j];
+            t2 = s0 + maj;
+            h = d + t1 << 0;
+            d = t1 + t2 << 0;
+          }
+          s0 = (d >>> 2 | d << 30) ^ (d >>> 13 | d << 19) ^ (d >>> 22 | d << 10);
+          s1 = (h >>> 6 | h << 26) ^ (h >>> 11 | h << 21) ^ (h >>> 25 | h << 7);
+          da = d & a;
+          maj = da ^ d & b ^ ab;
+          ch = h & e ^ ~h & f;
+          t1 = g + s1 + ch + K[j + 1] + blocks2[j + 1];
+          t2 = s0 + maj;
+          g = c + t1 << 0;
+          c = t1 + t2 << 0;
+          s0 = (c >>> 2 | c << 30) ^ (c >>> 13 | c << 19) ^ (c >>> 22 | c << 10);
+          s1 = (g >>> 6 | g << 26) ^ (g >>> 11 | g << 21) ^ (g >>> 25 | g << 7);
+          cd = c & d;
+          maj = cd ^ c & a ^ da;
+          ch = g & h ^ ~g & e;
+          t1 = f + s1 + ch + K[j + 2] + blocks2[j + 2];
+          t2 = s0 + maj;
+          f = b + t1 << 0;
+          b = t1 + t2 << 0;
+          s0 = (b >>> 2 | b << 30) ^ (b >>> 13 | b << 19) ^ (b >>> 22 | b << 10);
+          s1 = (f >>> 6 | f << 26) ^ (f >>> 11 | f << 21) ^ (f >>> 25 | f << 7);
+          bc = b & c;
+          maj = bc ^ b & d ^ cd;
+          ch = f & g ^ ~f & h;
+          t1 = e + s1 + ch + K[j + 3] + blocks2[j + 3];
+          t2 = s0 + maj;
+          e = a + t1 << 0;
+          a = t1 + t2 << 0;
+          this.chromeBugWorkAround = true;
+        }
+        this.h0 = this.h0 + a << 0;
+        this.h1 = this.h1 + b << 0;
+        this.h2 = this.h2 + c << 0;
+        this.h3 = this.h3 + d << 0;
+        this.h4 = this.h4 + e << 0;
+        this.h5 = this.h5 + f << 0;
+        this.h6 = this.h6 + g << 0;
+        this.h7 = this.h7 + h << 0;
+      };
+      Sha256.prototype.hex = function() {
+        this.finalize();
+        var h0 = this.h0, h1 = this.h1, h2 = this.h2, h3 = this.h3, h4 = this.h4, h5 = this.h5, h6 = this.h6, h7 = this.h7;
+        var hex = HEX_CHARS[h0 >>> 28 & 15] + HEX_CHARS[h0 >>> 24 & 15] + HEX_CHARS[h0 >>> 20 & 15] + HEX_CHARS[h0 >>> 16 & 15] + HEX_CHARS[h0 >>> 12 & 15] + HEX_CHARS[h0 >>> 8 & 15] + HEX_CHARS[h0 >>> 4 & 15] + HEX_CHARS[h0 & 15] + HEX_CHARS[h1 >>> 28 & 15] + HEX_CHARS[h1 >>> 24 & 15] + HEX_CHARS[h1 >>> 20 & 15] + HEX_CHARS[h1 >>> 16 & 15] + HEX_CHARS[h1 >>> 12 & 15] + HEX_CHARS[h1 >>> 8 & 15] + HEX_CHARS[h1 >>> 4 & 15] + HEX_CHARS[h1 & 15] + HEX_CHARS[h2 >>> 28 & 15] + HEX_CHARS[h2 >>> 24 & 15] + HEX_CHARS[h2 >>> 20 & 15] + HEX_CHARS[h2 >>> 16 & 15] + HEX_CHARS[h2 >>> 12 & 15] + HEX_CHARS[h2 >>> 8 & 15] + HEX_CHARS[h2 >>> 4 & 15] + HEX_CHARS[h2 & 15] + HEX_CHARS[h3 >>> 28 & 15] + HEX_CHARS[h3 >>> 24 & 15] + HEX_CHARS[h3 >>> 20 & 15] + HEX_CHARS[h3 >>> 16 & 15] + HEX_CHARS[h3 >>> 12 & 15] + HEX_CHARS[h3 >>> 8 & 15] + HEX_CHARS[h3 >>> 4 & 15] + HEX_CHARS[h3 & 15] + HEX_CHARS[h4 >>> 28 & 15] + HEX_CHARS[h4 >>> 24 & 15] + HEX_CHARS[h4 >>> 20 & 15] + HEX_CHARS[h4 >>> 16 & 15] + HEX_CHARS[h4 >>> 12 & 15] + HEX_CHARS[h4 >>> 8 & 15] + HEX_CHARS[h4 >>> 4 & 15] + HEX_CHARS[h4 & 15] + HEX_CHARS[h5 >>> 28 & 15] + HEX_CHARS[h5 >>> 24 & 15] + HEX_CHARS[h5 >>> 20 & 15] + HEX_CHARS[h5 >>> 16 & 15] + HEX_CHARS[h5 >>> 12 & 15] + HEX_CHARS[h5 >>> 8 & 15] + HEX_CHARS[h5 >>> 4 & 15] + HEX_CHARS[h5 & 15] + HEX_CHARS[h6 >>> 28 & 15] + HEX_CHARS[h6 >>> 24 & 15] + HEX_CHARS[h6 >>> 20 & 15] + HEX_CHARS[h6 >>> 16 & 15] + HEX_CHARS[h6 >>> 12 & 15] + HEX_CHARS[h6 >>> 8 & 15] + HEX_CHARS[h6 >>> 4 & 15] + HEX_CHARS[h6 & 15];
+        if (!this.is224) {
+          hex += HEX_CHARS[h7 >>> 28 & 15] + HEX_CHARS[h7 >>> 24 & 15] + HEX_CHARS[h7 >>> 20 & 15] + HEX_CHARS[h7 >>> 16 & 15] + HEX_CHARS[h7 >>> 12 & 15] + HEX_CHARS[h7 >>> 8 & 15] + HEX_CHARS[h7 >>> 4 & 15] + HEX_CHARS[h7 & 15];
+        }
+        return hex;
+      };
+      Sha256.prototype.toString = Sha256.prototype.hex;
+      Sha256.prototype.digest = function() {
+        this.finalize();
+        var h0 = this.h0, h1 = this.h1, h2 = this.h2, h3 = this.h3, h4 = this.h4, h5 = this.h5, h6 = this.h6, h7 = this.h7;
+        var arr = [
+          h0 >>> 24 & 255,
+          h0 >>> 16 & 255,
+          h0 >>> 8 & 255,
+          h0 & 255,
+          h1 >>> 24 & 255,
+          h1 >>> 16 & 255,
+          h1 >>> 8 & 255,
+          h1 & 255,
+          h2 >>> 24 & 255,
+          h2 >>> 16 & 255,
+          h2 >>> 8 & 255,
+          h2 & 255,
+          h3 >>> 24 & 255,
+          h3 >>> 16 & 255,
+          h3 >>> 8 & 255,
+          h3 & 255,
+          h4 >>> 24 & 255,
+          h4 >>> 16 & 255,
+          h4 >>> 8 & 255,
+          h4 & 255,
+          h5 >>> 24 & 255,
+          h5 >>> 16 & 255,
+          h5 >>> 8 & 255,
+          h5 & 255,
+          h6 >>> 24 & 255,
+          h6 >>> 16 & 255,
+          h6 >>> 8 & 255,
+          h6 & 255
+        ];
+        if (!this.is224) {
+          arr.push(h7 >>> 24 & 255, h7 >>> 16 & 255, h7 >>> 8 & 255, h7 & 255);
+        }
+        return arr;
+      };
+      Sha256.prototype.array = Sha256.prototype.digest;
+      Sha256.prototype.arrayBuffer = function() {
+        this.finalize();
+        var buffer = new ArrayBuffer(this.is224 ? 28 : 32);
+        var dataView = new DataView(buffer);
+        dataView.setUint32(0, this.h0);
+        dataView.setUint32(4, this.h1);
+        dataView.setUint32(8, this.h2);
+        dataView.setUint32(12, this.h3);
+        dataView.setUint32(16, this.h4);
+        dataView.setUint32(20, this.h5);
+        dataView.setUint32(24, this.h6);
+        if (!this.is224) {
+          dataView.setUint32(28, this.h7);
+        }
+        return buffer;
+      };
+      function HmacSha256(key, is224, sharedMemory) {
+        var i, type = typeof key;
+        if (type === "string") {
+          var bytes = [], length = key.length, index = 0, code;
+          for (i = 0; i < length; ++i) {
+            code = key.charCodeAt(i);
+            if (code < 128) {
+              bytes[index++] = code;
+            } else if (code < 2048) {
+              bytes[index++] = 192 | code >>> 6;
+              bytes[index++] = 128 | code & 63;
+            } else if (code < 55296 || code >= 57344) {
+              bytes[index++] = 224 | code >>> 12;
+              bytes[index++] = 128 | code >>> 6 & 63;
+              bytes[index++] = 128 | code & 63;
+            } else {
+              code = 65536 + ((code & 1023) << 10 | key.charCodeAt(++i) & 1023);
+              bytes[index++] = 240 | code >>> 18;
+              bytes[index++] = 128 | code >>> 12 & 63;
+              bytes[index++] = 128 | code >>> 6 & 63;
+              bytes[index++] = 128 | code & 63;
+            }
+          }
+          key = bytes;
+        } else {
+          if (type === "object") {
+            if (key === null) {
+              throw new Error(ERROR);
+            } else if (ARRAY_BUFFER && key.constructor === ArrayBuffer) {
+              key = new Uint8Array(key);
+            } else if (!Array.isArray(key)) {
+              if (!ARRAY_BUFFER || !ArrayBuffer.isView(key)) {
+                throw new Error(ERROR);
+              }
+            }
+          } else {
+            throw new Error(ERROR);
+          }
+        }
+        if (key.length > 64) {
+          key = new Sha256(is224, true).update(key).array();
+        }
+        var oKeyPad = [], iKeyPad = [];
+        for (i = 0; i < 64; ++i) {
+          var b = key[i] || 0;
+          oKeyPad[i] = 92 ^ b;
+          iKeyPad[i] = 54 ^ b;
+        }
+        Sha256.call(this, is224, sharedMemory);
+        this.update(iKeyPad);
+        this.oKeyPad = oKeyPad;
+        this.inner = true;
+        this.sharedMemory = sharedMemory;
+      }
+      HmacSha256.prototype = new Sha256();
+      HmacSha256.prototype.finalize = function() {
+        Sha256.prototype.finalize.call(this);
+        if (this.inner) {
+          this.inner = false;
+          var innerHash = this.array();
+          Sha256.call(this, this.is224, this.sharedMemory);
+          this.update(this.oKeyPad);
+          this.update(innerHash);
+          Sha256.prototype.finalize.call(this);
+        }
+      };
+      var exports2 = createMethod();
+      exports2.sha256 = exports2;
+      exports2.sha224 = createMethod(true);
+      exports2.sha256.hmac = createHmacMethod();
+      exports2.sha224.hmac = createHmacMethod(true);
+      if (COMMON_JS) {
+        module.exports = exports2;
+      } else {
+        root.sha256 = exports2.sha256;
+        root.sha224 = exports2.sha224;
+        if (AMD) {
+          define(function() {
+            return exports2;
+          });
+        }
+      }
+    })();
+  }
+});
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -6,57 +561,287 @@ import { parseArgs } from "node:util";
 // src/commands.ts
 import { join as join3 } from "node:path";
 
-// src/bundle.ts
+// ../extractor/src/statesMatrix.ts
+var STATE_ORDER = [
+  "default",
+  "enabled",
+  "rest",
+  "hover",
+  "hovered",
+  "focus",
+  "focused",
+  "active",
+  "pressed",
+  "selected",
+  "filled",
+  "disabled",
+  "error",
+  "danger",
+  "warning",
+  "success",
+  "loading",
+  "empty",
+  "checked",
+  "invalid",
+  "readonly",
+  "visited"
+];
+var STATE_VOCAB = new Set(STATE_ORDER);
+
+// ../extractor/src/hash.ts
+var import_js_sha256 = __toESM(require_sha256(), 1);
+
+// ../extractor/src/prose/prompt.ts
+var PROSE_SYSTEM_PROMPT = [
+  "You write component guideline prose for a design-system specification tool.",
+  "Your output fills three spec sections: Definition, Accessibility, and Do's & Don'ts,",
+  "in the voice of best-in-class design systems (Atlassian, Material, Polaris, Carbon).",
+  "",
+  "Core rule: every guideline states the rule AND the reason it matters. A rule without its",
+  "consequence reads like a lint message; the reason is what makes it useful guidance.",
+  "",
+  "Voice:",
+  '- Imperative and verb-first ("Use...", "Keep...", "Avoid...", "Never...").',
+  '- Write for people, not "the user". Say "people", "someone", or the concrete role.',
+  '- Be concrete: anchor rules in real situations (forms, dialogs, toolbars), not "certain contexts".',
+  "- Reference only the component's actual variants, props, and states. Never invent options it lacks.",
+  `- Pair a Don't with its alternative (for example, "use a Toggle instead").`,
+  "",
+  "Punctuation and formatting (this matters for readability):",
+  "- Never use em dashes (the long dash) or en dashes as punctuation. Use a period, comma, colon,",
+  "  or parentheses instead. A hyphen is fine in ranges like 3-5 and in compound words.",
+  "- Keep sentences short. One idea per sentence. Split a long sentence into two.",
+  "",
+  "Sections (this is Markdown and renders as-is, so structure each one to scan at a glance):",
+  "- Overview: open with ONE sentence defining what the component is (this becomes the header).",
+  "  Then a short, benefit-led overview: where and how it is used, the value it gives people, its",
+  "  role in the product, and a brief guiding principle. Do NOT name specific variants or styles",
+  '  and do NOT give a "when to use which" guide; those belong to the Variants guide below.',
+  "- Accessibility: a bulleted list. Give each bullet a short bold lead-in naming the topic, then",
+  '  the guidance, for example "- **Keyboard:** ...". Always include a bullet flagging what the',
+  "  design file cannot encode (focus order, live-region behaviour, immediate vs deferred effect).",
+  '  If the list runs long (about six or more points), group the bullets under level-3 ("###")',
+  "  subheadings.",
+  "- Variants guide (optional): 1-2 sentences orienting the reader to what varies across the",
+  "  component's options (the axes and their values). Then, when it has several meaningful types,",
+  '  a bulleted "when to use which type" guide, one per line, type name in bold:',
+  '  "- **Filled**: the single most important action.". Do not restate the plain definition.',
+  "- Anatomy summary (optional, 1-2 sentences): orient the reader to the component's structure,",
+  "  naming its key parts and what each contributes. Describe what the parts are, not how to",
+  "  configure them.",
+  "- Anatomy parts (optional): for each part listed in the prompt, one concise sentence naming its",
+  "  role and why it exists. Match each part name exactly. Describe purpose, not styling. Skip a",
+  "  part when you cannot describe it without guessing.",
+  "- Do's & Don'ts: one rule per bullet. Start each with a short bold lead-in stating the rule, then",
+  '  a sentence giving the reason: "**Use one primary action per view.** Its weight tells people',
+  '  where to go next." Do not add check or cross marks yourself; they are added on render.',
+  '- Use Markdown structure where it helps: bold lead-ins, bullet lists, and at most level-3 ("###")',
+  '  subheadings. Never use level-1 ("#") or level-2 ("##") headings.',
+  "",
+  "Return only the JSON object requested in the user message. No preamble and no prose outside the",
+  "JSON."
+].join("\n");
+var FEW_SHOT_PROMPT = [
+  "Component: Button",
+  "",
+  "Anatomy: Container, Label, Leading icon (component)",
+  "",
+  "Variants:",
+  "  Style: Filled \xB7 Outlined \xB7 Text",
+  "",
+  "States: Enabled, Hovered, Focused, Pressed, Disabled",
+  "",
+  `Return ONLY a JSON object with keys: definition (one sentence defining what it is, then a short benefit-led overview: where it is used, the value it gives people, its role, and a guiding principle; no style names and no when-to-use guide), variantsSummary (1-2 sentences on what varies across the options, then a bulleted "when to use which type" guide with bold type names when it has several types), anatomySummary (1-2 sentences orienting the reader to the component structure and the role of its key parts), anatomyParts (array of { name, description } where each name EXACTLY matches one of the Anatomy part names above and description is one concise sentence naming that part's role), accessibility (a bulleted list; give each bullet a short bold lead-in then the guidance; include one bullet flagging what cannot be known from the design file), interactions (Markdown under "### Mouse", "### Keyboard", "### Other" subheadings, 2-3 bullets each, anchored to the States above), designConsiderations (3-4 designer-facing bullets on contrast, state distinguishability, and missing-state flags), contentConsiderations (3-4 bullets on label writing, truncation, and internationalization), dos (string[], 3 to 5 items, each starting with a bold rule summary then the reason), donts (string[], 3 to 5 items, same shape). Use Markdown (bold lead-ins, lists, at most "###" subheadings); never "#" or "##" headings. Do not use em dashes. Do not include any prose outside the JSON.`
+].join("\n");
+var FEW_SHOT_RESPONSE = {
+  definition: "A Button triggers an action when activated. Used across products to perform common actions, it gives people a familiar, accessible way to engage with the interface and keeps frequent tasks fast and predictable. It is essential for guiding people through workflows and performing the key actions on a screen. Create buttons that are clear, easy to identify, and accessible.",
+  variantsSummary: [
+    "Style sets the visual weight and states cover the interactive feedback; all styles share the same anatomy.",
+    "",
+    "**When to use each type:**",
+    "- **Filled**: the single most important action in a view.",
+    "- **Outlined**: secondary actions that still need a visible boundary.",
+    "- **Text**: low-emphasis actions in dense layouts."
+  ].join("\n"),
+  anatomySummary: "A Button pairs a text label with an optional leading icon inside a single container. The container sets the tap target and carries the visual weight.",
+  anatomyParts: [
+    { name: "Container", description: "Holds the label and icon and defines the clickable area and visual weight." },
+    { name: "Label", description: "Names the action in one to three words so people know what the button does." },
+    { name: "Leading icon", description: "Optional glyph that reinforces the label; never the only signal of meaning." }
+  ],
+  accessibility: [
+    '- **Semantics:** render as a native `<button>` so keyboard and screen-reader behaviour work without extra code. Use role="button" only when a non-button element must act as one.',
+    "- **Accessible name:** the label names the button. For an icon-only button, supply `aria-label`, since an icon alone announces nothing.",
+    '- **Disabled vs aria-disabled:** `disabled` removes the button from the tab order, while `aria-disabled="true"` keeps it focusable to explain why it is unavailable. The design file cannot tell you which to use.',
+    "- **Not in the design file:** focus order and live-region behaviour are not encoded in the design. Confirm the focus ring meets WCAG 2.1 contrast (at least 3:1) in implementation."
+  ].join("\n"),
+  interactions: [
+    "### Mouse",
+    "- Clicking anywhere on the container activates the action; the whole button is the target, not just the label.",
+    "- On hover the surface changes to signal it is interactive, and the cursor becomes a pointer.",
+    "### Keyboard",
+    "- Tab moves focus to the button in reading order, and a visible focus ring shows where focus landed.",
+    "- Enter or Space activates the focused button.",
+    "### Other",
+    "- Screen readers announce the label and the button role; an icon-only button needs an explicit name.",
+    "- Keep the touch target at least 44 by 44 px so it is comfortable to tap."
+  ].join("\n"),
+  designConsiderations: [
+    "- Keep label-to-background contrast at 4.5:1 or better in every style so the action stays legible.",
+    "- Make the interactive states visually distinct from each other, so hover, focus, and pressed never look identical.",
+    "- Confirm a visible focus state exists in build; focus styling is not always encoded in the design file."
+  ].join("\n"),
+  contentConsiderations: [
+    '- Write labels as a verb-first action in one to three words ("Save", "Add item"), not a vague "OK".',
+    "- Plan for labels that wrap or truncate; do not rely on a fixed width holding every translation.",
+    "- Allow for text expansion of roughly 30-40% and mirrored layout in right-to-left languages."
+  ].join("\n"),
+  dos: [
+    "**Use the Filled variant for the single most important action in a view.** Its weight tells people where to go next.",
+    '**Keep labels to one to three words, verb first** ("Save", "Add item"). People can then scan the action without reading a sentence.',
+    "**Use the Text variant in dense toolbars or dialogs.** A filled button there would add visual noise."
+  ],
+  donts: [
+    "**Don't place more than one Filled button in the same view.** Competing primary actions make it unclear which one matters most.",
+    "**Don't use a button for plain navigation.** Screen readers announce links and buttons differently, so use a link (`<a>`) when it just goes somewhere.",
+    "**Don't disable a button without explaining why.** A disabled control gives no reason and drops out of the tab order, so use inline validation instead."
+  ]
+};
+
+// ../extractor/src/prose/foundationPrompt.ts
+var FOUNDATION_SYSTEM_PROMPT = [
+  "You write short descriptions of design-token groups for a design-system reference.",
+  "Each description sits under a group heading in a generated documentation frame.",
+  "",
+  "You are given the token names in the group and their resolved values. That is ALL you know.",
+  "Describe what the group is for, as its names and values actually show.",
+  "",
+  "Never invent: no component names the tokens do not mention, no counts, no accessibility",
+  "claims, no history, no rules the names do not support. If the names are too generic to",
+  "support a purpose, describe the shape of the set plainly instead and stop. A vague but true",
+  "sentence is correct; a specific but invented one is a defect.",
+  "",
+  "Voice:",
+  "- One or two sentences. Under 220 characters. No heading, no list, no markdown.",
+  "- Plain and factual, the tone of a peer explaining their own file.",
+  '- Say what the group is for and when to reach for it. Lead with the purpose, not "This group".',
+  '- Write for people, not "the user".',
+  "- Never use em dashes or en dashes. Use a period, comma, colon, or parentheses.",
+  '- Do not restate the heading as a sentence ("Surface colours are colours for surfaces").',
+  "",
+  "Return ONLY a JSON object mapping each group key to its description string.",
+  "No prose outside the JSON, no code fence."
+].join("\n");
+
+// ../extractor/src/v5/canonical.ts
+var import_js_sha2562 = __toESM(require_sha256(), 1);
+
+// ../extractor/src/v5/componentContext.ts
+var import_js_sha2563 = __toESM(require_sha256(), 1);
+
+// ../extractor/src/libraryBundle.ts
+var LIBRARY_BUNDLE_SCHEMA = "spec-layer-library-bundle";
+var LibraryBundleError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "LibraryBundleError";
+    this.code = code;
+  }
+};
 var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-function contentHash(artifact) {
-  if (!isRecord(artifact) || !isRecord(artifact.spec_layer)) return null;
+function hasContentHash(artifact) {
+  if (!isRecord(artifact) || !isRecord(artifact.spec_layer)) return false;
   const exp = artifact.spec_layer.export;
-  if (!isRecord(exp) || typeof exp.content_hash !== "string") return null;
-  return exp.content_hash;
+  return isRecord(exp) && typeof exp.content_hash === "string";
 }
 function entry(v, where) {
-  if (!isRecord(v) || typeof v.name !== "string" || typeof v.ai !== "string" || contentHash(v.artifact) === null) {
-    throw new Error(`The ${where} entry in this bundle is malformed.`);
+  if (!isRecord(v) || typeof v.name !== "string" || typeof v.ai !== "string" || !hasContentHash(v.artifact)) {
+    throw new LibraryBundleError("malformed", `The ${where} entry in this bundle is malformed.`);
   }
-  return v;
+  return { name: v.name, ai: v.ai, artifact: v.artifact };
 }
-function parseBundle(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error("The server response is not valid JSON.");
+function supportedVersion(version) {
+  return typeof version === "string" && /^1\.\d+\.\d+$/.test(version);
+}
+function parseLibraryBundle(input) {
+  let parsed = input;
+  if (typeof input === "string") {
+    try {
+      parsed = JSON.parse(input);
+    } catch {
+      throw new LibraryBundleError("not_json", "This is not valid JSON.");
+    }
   }
-  if (!isRecord(parsed) || parsed.schema !== "spec-layer-library-bundle") {
-    throw new Error("The server response is not a Spec Layer library bundle.");
+  if (!isRecord(parsed) || parsed.schema !== LIBRARY_BUNDLE_SCHEMA) {
+    throw new LibraryBundleError("not_bundle", "This is not a Spec Layer library bundle.");
+  }
+  if (!supportedVersion(parsed.version)) {
+    const version = typeof parsed.version === "string" ? parsed.version : String(parsed.version);
+    throw new LibraryBundleError(
+      "unsupported_version",
+      `This bundle is version ${version}, which this reader does not support.`
+    );
   }
-  if (typeof parsed.version !== "string" || typeof parsed.extractorVersion !== "string" || !Array.isArray(parsed.components)) {
-    throw new Error("This bundle is missing required fields.");
+  if (typeof parsed.extractorVersion !== "string" || !Array.isArray(parsed.components)) {
+    throw new LibraryBundleError("malformed", "This bundle is missing required fields.");
   }
-  const foundation = parsed.foundation ?? null;
-  if (foundation !== null) {
-    if (!isRecord(foundation) || typeof foundation.ai !== "string" || contentHash(foundation.artifact) === null) {
-      throw new Error("The foundation entry in this bundle is malformed.");
+  const foundationRaw = parsed.foundation ?? null;
+  let foundation = null;
+  if (foundationRaw !== null) {
+    if (!isRecord(foundationRaw) || typeof foundationRaw.ai !== "string" || !hasContentHash(foundationRaw.artifact)) {
+      throw new LibraryBundleError("malformed", "The foundation entry in this bundle is malformed.");
     }
+    foundation = { ai: foundationRaw.ai, artifact: foundationRaw.artifact };
   }
-  const components = parsed.components.map((c, i) => entry(c, `component ${i}`));
   return {
-    schema: "spec-layer-library-bundle",
+    schema: LIBRARY_BUNDLE_SCHEMA,
     version: parsed.version,
     fileName: typeof parsed.fileName === "string" ? parsed.fileName : null,
     pluginVersion: typeof parsed.pluginVersion === "string" ? parsed.pluginVersion : null,
     extractorVersion: parsed.extractorVersion,
     foundation,
-    components
+    components: parsed.components.map((c, i) => entry(c, `component ${i}`))
   };
 }
 
+// src/bundle.ts
+function parseBundle(raw) {
+  try {
+    return parseLibraryBundle(raw);
+  } catch (err) {
+    if (!(err instanceof LibraryBundleError)) throw err;
+    switch (err.code) {
+      case "not_json":
+        throw new Error("The server response is not valid JSON.");
+      case "not_bundle":
+        throw new Error("The server response is not a Spec Layer library bundle.");
+      case "unsupported_version":
+        throw new Error(`${err.message} Update spec-layer and try again.`);
+      case "malformed":
+        throw new Error(err.message);
+    }
+  }
+}
+
 // src/config.ts
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 var DEFAULT_API = "https://api.spec-layer.com";
 var DEFAULT_OUT_DIR = ".speclayer";
 var CONFIG_NAME = "speclayer.json";
+var invalidConfig = () => new Error(`${CONFIG_NAME} is not valid JSON. Fix or delete it, then retry.`);
+function parseInclude(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalidConfig();
+  const record = value;
+  if (record.foundation !== void 0 && typeof record.foundation !== "boolean") throw invalidConfig();
+  if (record.components !== void 0 && !(Array.isArray(record.components) && record.components.every((c) => typeof c === "string"))) {
+    throw invalidConfig();
+  }
+  return {
+    foundation: record.foundation === void 0 ? true : record.foundation,
+    components: record.components === void 0 ? null : record.components
+  };
+}
 function readConfig(cwd) {
   const path = join(cwd, CONFIG_NAME);
   if (!existsSync(path)) return null;
@@ -64,30 +849,36 @@ function readConfig(cwd) {
   try {
     parsed = JSON.parse(readFileSync(path, "utf8"));
   } catch {
-    throw new Error(`${CONFIG_NAME} is not valid JSON. Fix or delete it, then retry.`);
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${CONFIG_NAME} is not valid JSON. Fix or delete it, then retry.`);
+    throw invalidConfig();
   }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw invalidConfig();
   const record = parsed;
   return {
     ...typeof record.libraryId === "string" ? { libraryId: record.libraryId } : {},
-    ...typeof record.outDir === "string" ? { outDir: record.outDir } : {}
+    ...typeof record.outDir === "string" ? { outDir: record.outDir } : {},
+    ...record.include !== void 0 ? { include: parseInclude(record.include) } : {}
   };
 }
 function writeConfig(cwd, config) {
-  writeFileSync(join(cwd, CONFIG_NAME), `${JSON.stringify(config, null, 2)}
+  const body = {
+    libraryId: config.libraryId,
+    outDir: config.outDir,
+    ...config.include ? { include: config.include } : {}
+  };
+  writeFileSync(join(cwd, CONFIG_NAME), `${JSON.stringify(body, null, 2)}
 `);
 }
-function resolveOptions(cwd, flags, env, manifestLibraryId2) {
+function resolveOptions(cwd, flags, env, manifestLibraryId) {
   const config = readConfig(cwd);
   const outDir = flags.out ?? config?.outDir ?? DEFAULT_OUT_DIR;
-  const libraryId = flags.id ?? config?.libraryId ?? manifestLibraryId2(join(cwd, outDir));
+  const libraryId = flags.id ?? config?.libraryId ?? manifestLibraryId(join(cwd, outDir));
   return {
     libraryId,
     outDir,
-    api: flags.api ?? env.SPEC_LAYER_API ?? DEFAULT_API,
-    key: flags.key ?? env.SPEC_LAYER_KEY ?? null
+    // A trailing slash would build "//v1/..." paths the proxy router 404s on.
+    api: (flags.api ?? env.SPEC_LAYER_API ?? DEFAULT_API).replace(/\/+$/, ""),
+    key: flags.key ?? env.SPEC_LAYER_KEY ?? null,
+    ...config?.include ? { include: config.include } : {}
   };
 }
 
@@ -122,8 +913,41 @@ async function fetchBundle(opts) {
 }
 
 // src/files.ts
-import { mkdirSync, writeFileSync as writeFileSync2, readFileSync as readFileSync2, rmSync, renameSync, existsSync as existsSync2 } from "node:fs";
-import { join as join2, dirname } from "node:path";
+import { mkdirSync, writeFileSync as writeFileSync2, readFileSync as readFileSync2, readdirSync, rmSync, renameSync, existsSync as existsSync2 } from "node:fs";
+import { join as join2, dirname, relative, resolve, isAbsolute } from "node:path";
+
+// src/selection.ts
+var DEFAULT_SELECTION = { foundation: true, components: null };
+function selectionFromFlags(flags) {
+  const named = flags.component !== void 0 && flags.component.length > 0 ? flags.component : null;
+  if (flags.only === void 0) return named ? { foundation: true, components: named } : null;
+  if (flags.only === "foundation") {
+    if (named) throw new Error("--only foundation cannot be combined with --component. Drop one of them.");
+    return { foundation: true, components: [] };
+  }
+  if (flags.only === "components") return { foundation: false, components: named };
+  throw new Error(`--only takes "foundation" or "components", not "${flags.only}".`);
+}
+function resolveSelection(flags, config) {
+  return selectionFromFlags(flags) ?? config?.include ?? DEFAULT_SELECTION;
+}
+var matchesName = (input, name) => slugify(input) === slugify(name);
+function selectComponents(bundle, selection) {
+  const wanted = selection.components;
+  if (wanted === null) return bundle.components.map(() => true);
+  const hasMatch = (name) => bundle.components.some((c) => matchesName(name, c.name));
+  const missing = wanted.filter((name) => !hasMatch(name));
+  if (missing.length > 0) {
+    const available = bundle.components.map((c) => c.name).join(", ");
+    throw new Error(
+      `No component named ${missing.map((m) => `"${m}"`).join(", ")} in this library.
+Available: ${available || "none"}.`
+    );
+  }
+  return bundle.components.map((c) => wanted.some((name) => matchesName(name, c.name)));
+}
+
+// src/files.ts
 function slugify(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return slug || "component";
@@ -137,7 +961,50 @@ function readManifest(outDir) {
     return null;
   }
 }
+function readLocalBundle(outDir) {
+  const path = join2(outDir, "bundle.json");
+  if (!existsSync2(path)) return null;
+  try {
+    return parseBundle(readFileSync2(path, "utf8"));
+  } catch {
+    throw new Error(`${path} could not be read as a library bundle. Run spec-layer pull again.`);
+  }
+}
+function componentSlugs(bundle) {
+  const usedSlugs = /* @__PURE__ */ new Set();
+  const nextSuffix = /* @__PURE__ */ new Map();
+  return bundle.components.map((component) => {
+    const base = slugify(component.name);
+    let slug = base;
+    if (usedSlugs.has(slug)) {
+      let n = (nextSuffix.get(base) ?? 1) + 1;
+      slug = `${base}-${n}`;
+      while (usedSlugs.has(slug)) {
+        n += 1;
+        slug = `${base}-${n}`;
+      }
+      nextSuffix.set(base, n);
+    } else {
+      nextSuffix.set(base, 1);
+    }
+    usedSlugs.add(slug);
+    return slug;
+  });
+}
+function assertReplaceable(outDir, cwd) {
+  const rel = relative(resolve(cwd), resolve(outDir));
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error('The output directory must sit inside the current directory, not be "." or a parent of it.');
+  }
+  if (existsSync2(outDir) && !existsSync2(join2(outDir, "manifest.json")) && readdirSync(outDir).length > 0) {
+    throw new Error(`${outDir} exists and was not written by spec-layer pull. Choose an empty or new directory.`);
+  }
+}
 function writeBundleFiles(opts) {
+  assertReplaceable(opts.outDir, opts.cwd);
+  const selection = opts.selection ?? DEFAULT_SELECTION;
+  const selected = selectComponents(opts.bundle, selection);
+  const slugs = componentSlugs(opts.bundle);
   const staging = `${opts.outDir}.partial`;
   rmSync(staging, { recursive: true, force: true });
   const written = [];
@@ -151,46 +1018,32 @@ function writeBundleFiles(opts) {
     put("bundle.json", opts.raw);
     const artifacts = [];
     if (opts.bundle.foundation) {
-      put("ai/foundation.yaml", opts.bundle.foundation.ai);
+      const aiPath = selection.foundation ? "ai/foundation.yaml" : null;
+      if (aiPath) put(aiPath, opts.bundle.foundation.ai);
       artifacts.push({
         kind: "foundation",
         name: "foundation",
         contentHash: opts.bundle.foundation.artifact.spec_layer.export.content_hash,
-        aiPath: "ai/foundation.yaml"
+        aiPath
       });
     }
-    const usedSlugs = /* @__PURE__ */ new Set();
-    const nextSuffix = /* @__PURE__ */ new Map();
-    for (const component of opts.bundle.components) {
-      const base = slugify(component.name);
-      let slug = base;
-      if (usedSlugs.has(slug)) {
-        let n = (nextSuffix.get(base) ?? 1) + 1;
-        slug = `${base}-${n}`;
-        while (usedSlugs.has(slug)) {
-          n += 1;
-          slug = `${base}-${n}`;
-        }
-        nextSuffix.set(base, n);
-      } else {
-        nextSuffix.set(base, 1);
-      }
-      usedSlugs.add(slug);
-      const aiPath = `ai/components/${slug}.yaml`;
-      put(aiPath, component.ai);
+    opts.bundle.components.forEach((component, i) => {
+      const aiPath = selected[i] ? `ai/components/${slugs[i]}.yaml` : null;
+      if (aiPath) put(aiPath, component.ai);
       artifacts.push({
         kind: "component",
         name: component.name,
         contentHash: component.artifact.spec_layer.export.content_hash,
         aiPath
       });
-    }
+    });
     const manifest = {
       libraryId: opts.libraryId,
       publishedAt: opts.publishedAt,
       bundleHash: opts.bundleHash,
       pluginVersion: opts.bundle.pluginVersion,
       extractorVersion: opts.bundle.extractorVersion,
+      selection,
       artifacts
     };
     put("manifest.json", `${JSON.stringify(manifest, null, 2)}
@@ -205,24 +1058,43 @@ function writeBundleFiles(opts) {
 }
 
 // src/commands.ts
-var manifestLibraryId = (outDir) => readManifest(outDir)?.libraryId ?? null;
+var NO_LOCAL_PULL = "No local pull found. Run spec-layer pull.";
+function manifestReader() {
+  const cache = /* @__PURE__ */ new Map();
+  return (outDir) => {
+    if (!cache.has(outDir)) cache.set(outDir, readManifest(outDir));
+    return cache.get(outDir) ?? null;
+  };
+}
+function sameSelection(a, b) {
+  const key = (s) => JSON.stringify([s.foundation, s.components === null ? null : [...new Set(s.components.map(slugify))].sort()]);
+  return key(a) === key(b);
+}
+var errorText = (err) => err instanceof Error ? err.message : String(err);
 function runInit(cwd, flags, io2) {
   if (!flags.id) {
     io2.err("spec-layer init needs --id lib_... (shown in the plugin after publishing).");
     return 1;
   }
+  let include;
+  try {
+    include = selectionFromFlags(flags);
+  } catch (err) {
+    io2.err(errorText(err));
+    return 1;
+  }
   const outDir = flags.out ?? DEFAULT_OUT_DIR;
-  writeConfig(cwd, { libraryId: flags.id, outDir });
+  writeConfig(cwd, { libraryId: flags.id, outDir, ...include ? { include } : {} });
   io2.out(`Wrote speclayer.json (library ${flags.id}, output ${outDir}).`);
   io2.out("The pull key is never stored here. Set SPEC_LAYER_KEY in your environment or pass --key.");
   return 0;
 }
-function resolved(cwd, flags, env, io2) {
+function resolved(cwd, flags, env, io2, manifestAt) {
   let opts;
   try {
-    opts = resolveOptions(cwd, flags, env, manifestLibraryId);
+    opts = resolveOptions(cwd, flags, env, (outDir) => manifestAt(outDir)?.libraryId ?? null);
   } catch (err) {
-    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(errorText(err));
     return null;
   }
   if (!opts.libraryId) {
@@ -235,13 +1107,39 @@ function resolved(cwd, flags, env, io2) {
   }
   return opts;
 }
+function resolvedOutDir(cwd, flags, io2) {
+  try {
+    return join3(cwd, flags.out ?? readConfig(cwd)?.outDir ?? DEFAULT_OUT_DIR);
+  } catch (err) {
+    io2.err(errorText(err));
+    return null;
+  }
+}
+function describePull(bundle, selection, selected) {
+  const total = bundle.components.length;
+  const count = selected.filter(Boolean).length;
+  const components = count === total ? `${total} component${total === 1 ? "" : "s"}` : `${count} of ${total} components`;
+  if (!bundle.foundation) return components;
+  return selection.foundation ? `foundation + ${components}` : `${components}, no foundation`;
+}
 async function runPull(cwd, flags, env, io2, fetcher) {
-  const opts = resolved(cwd, flags, env, io2);
+  const manifestAt = manifestReader();
+  const opts = resolved(cwd, flags, env, io2, manifestAt);
   if (!opts) return 1;
+  let selection;
+  try {
+    selection = resolveSelection(flags, opts);
+  } catch (err) {
+    io2.err(errorText(err));
+    return 1;
+  }
+  const manifest = manifestAt(join3(cwd, opts.outDir));
+  const etag = manifest && sameSelection(manifest.selection ?? DEFAULT_SELECTION, selection) ? manifest.bundleHash : void 0;
   const result = await fetchBundle({
     api: opts.api,
     libraryId: opts.libraryId,
     key: opts.key,
+    ...etag ? { etag } : {},
     ...fetcher ? { fetcher } : {}
   });
   if (result.kind === "error") {
@@ -249,37 +1147,40 @@ async function runPull(cwd, flags, env, io2, fetcher) {
     return 1;
   }
   if (result.kind === "not_modified") {
-    io2.out("Already up to date.");
+    io2.out(`Already up to date (published ${manifest?.publishedAt ?? "unknown"}).`);
     return 0;
   }
   let written;
   try {
     const bundle = parseBundle(result.raw);
+    const selected = selectComponents(bundle, selection);
     written = writeBundleFiles({
       outDir: join3(cwd, opts.outDir),
+      cwd,
       raw: result.raw,
       bundle,
+      selection,
       libraryId: opts.libraryId,
       publishedAt: result.publishedAt,
       bundleHash: result.bundleHash
     });
-    const components = bundle.components.length;
     io2.out(
-      `Pulled ${bundle.fileName ?? opts.libraryId}: ${bundle.foundation ? "foundation + " : ""}${components} component${components === 1 ? "" : "s"} (published ${result.publishedAt}).`
+      `Pulled ${bundle.fileName ?? opts.libraryId}: ${describePull(bundle, selection, selected)} (published ${result.publishedAt}).`
     );
   } catch (err) {
-    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(errorText(err));
     return 1;
   }
   io2.out(`Wrote ${written.length} files under ${opts.outDir}/.`);
   return 0;
 }
 async function runStatus(cwd, flags, env, io2, fetcher) {
-  const opts = resolved(cwd, flags, env, io2);
+  const manifestAt = manifestReader();
+  const opts = resolved(cwd, flags, env, io2, manifestAt);
   if (!opts) return 1;
-  const manifest = readManifest(join3(cwd, opts.outDir));
+  const manifest = manifestAt(join3(cwd, opts.outDir));
   if (!manifest) {
-    io2.err("No local pull found. Run spec-layer pull.");
+    io2.err(NO_LOCAL_PULL);
     return 2;
   }
   const result = await fetchBundle({
@@ -300,19 +1201,96 @@ async function runStatus(cwd, flags, env, io2, fetcher) {
   io2.out(`Behind: remote published ${result.publishedAt}. Run spec-layer pull.`);
   return 2;
 }
+function runList(cwd, flags, io2) {
+  const outDir = resolvedOutDir(cwd, flags, io2);
+  if (!outDir) return 1;
+  const manifest = readManifest(outDir);
+  if (!manifest) {
+    io2.err(NO_LOCAL_PULL);
+    return 1;
+  }
+  io2.out(`Library ${manifest.libraryId}, published ${manifest.publishedAt}.`);
+  const rows = manifest.artifacts.map((a) => [a.kind, a.name, a.aiPath ?? "not written", a.contentHash]);
+  const widths = [0, 1, 2].map((i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const row of rows) {
+    io2.out(row.map((cell, i) => i < 3 ? cell.padEnd(widths[i]) : cell).join("  "));
+  }
+  return 0;
+}
+var SHOW_USAGE = 'spec-layer show takes "foundation" or "component NAME".';
+function runShow(cwd, flags, args, io2) {
+  const [target, name] = args;
+  const wantsFoundation = target === "foundation" && name === void 0;
+  const wantsComponent = target === "component" && typeof name === "string";
+  if (!wantsFoundation && !wantsComponent) {
+    io2.err(SHOW_USAGE);
+    return 1;
+  }
+  const outDir = resolvedOutDir(cwd, flags, io2);
+  if (!outDir) return 1;
+  let bundle;
+  try {
+    bundle = readLocalBundle(outDir);
+  } catch (err) {
+    io2.err(errorText(err));
+    return 1;
+  }
+  if (!bundle) {
+    io2.err(NO_LOCAL_PULL);
+    return 1;
+  }
+  let entry2;
+  if (wantsFoundation) {
+    if (!bundle.foundation) {
+      io2.err("This library has no Foundation. Run spec-layer list to see what it holds.");
+      return 1;
+    }
+    entry2 = bundle.foundation;
+  } else {
+    const matches = bundle.components.filter((c) => matchesName(name, c.name));
+    if (matches.length === 0) {
+      const available = bundle.components.map((c) => c.name).join(", ");
+      io2.err(`No component named "${name}" in this library.
+Available: ${available || "none"}.`);
+      return 1;
+    }
+    if (matches.length > 1) {
+      io2.err(`"${name}" matches ${matches.length} components. Run spec-layer list to see them, then rename one in Figma to tell them apart.`);
+      return 1;
+    }
+    entry2 = matches[0];
+  }
+  io2.write(flags.canonical ? `${JSON.stringify(entry2.artifact, null, 2)}
+` : entry2.ai);
+  return 0;
+}
 
 // src/cli.ts
 var USAGE = `spec-layer <command>
 
 Commands:
-  init    --id lib_... [--out DIR]        write speclayer.json
-  pull    [--id lib_...] [--key sl_...]   fetch the library into DIR (default .speclayer)
-  status  [--id lib_...] [--key sl_...]   check freshness; exits 2 when behind
+  init    --id lib_... [--out DIR] [selection]   write speclayer.json
+  pull    [--id lib_...] [--key sl_...] [selection]
+                                                 fetch the library into DIR (default .speclayer)
+  status  [--id lib_...] [--key sl_...]          check freshness; exits 2 when behind
+  list                                           list every artifact in the last pull
+  show    foundation | component NAME [--canonical]
+                                                 print one artifact's AI YAML (or canonical JSON)
+
+Selection (pull and init; flags replace the include block in speclayer.json):
+  --only foundation | components   write just the foundation, or just components
+  --component NAME                 write only this component (repeatable, matched by slug)
 
 Options:
   --api URL   override the API origin (default https://api.spec-layer.com)
 The pull key comes from --key or the SPEC_LAYER_KEY environment variable.`;
-var io = { out: (l) => console.log(l), err: (l) => console.error(l) };
+var io = {
+  out: (l) => console.log(l),
+  err: (l) => console.error(l),
+  write: (t) => {
+    process.stdout.write(t);
+  }
+};
 async function main() {
   let values;
   let positionals;
@@ -323,7 +1301,10 @@ async function main() {
         id: { type: "string" },
         out: { type: "string" },
         key: { type: "string" },
-        api: { type: "string" }
+        api: { type: "string" },
+        only: { type: "string" },
+        component: { type: "string", multiple: true },
+        canonical: { type: "boolean" }
       }
     }));
   } catch {
@@ -336,6 +1317,8 @@ async function main() {
     if (command === "init") return runInit(cwd, values, io);
     if (command === "pull") return await runPull(cwd, values, process.env, io);
     if (command === "status") return await runStatus(cwd, values, process.env, io);
+    if (command === "list") return runList(cwd, values, io);
+    if (command === "show") return runShow(cwd, values, positionals.slice(1), io);
     io.err(USAGE);
     return 1;
   } catch (err) {
@@ -344,3 +1327,15 @@ async function main() {
   }
 }
 process.exitCode = await main();
+/*! Bundled license information:
+
+js-sha256/src/sha256.js:
+  (**
+   * [js-sha256]{@link https://github.com/emn178/js-sha256}
+   *
+   * @version 0.11.1
+   * @author Chen, Yi-Cyuan [emn178@gmail.com]
+   * @copyright Chen, Yi-Cyuan 2014-2025
+   * @license MIT
+   *)
+*/