Skip to content

Spec Layer v5.0.0

Choose a tag to compare

View all tags
@sandroleks sandroleks released this 09 Sep 18:56
· 76 commits to main since this release
v5.0.0
e8b91d3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Spec Layer v5.0.0

Documentation you generate in Figma, and context a coding agent can actually use.

Highlights

  • Pulled tokens are files your build compiles. spec-layer pull writes a tokens/ directory with one CSS file per collection and mode, plus an index.css that imports them in resolver order, so you can take a single mode and wire prefers-color-scheme yourself. Component briefs sit beside it in component-specs/, byte-identical to Copy for AI. Names come from the designer's code_syntax.WEB when Figma declares one. Two tokens that would collide are both omitted and reported rather than guessed.
  • Foundations copy as DTCG. A Foundation copies as a Design Tokens Format Module 2025.10 resolver document. What the format cannot express is omitted and written to the report, never replaced with a plausible default or a fake reference.
  • Free plans can publish a library. One Figma file, 10 changed publishes a UTC month. A publish counts only when it commits, and republishing unchanged content is answered as unchanged without a write or a count. Pro keeps 10 libraries.
  • Publish screen, rebuilt. A status pill, the last publish date in local time, the free plan's updates left, and the two things you came for: the developer setup command and the AI agent prompt, each in full with a Copy. A library published by an earlier build reads "date not recorded" rather than a guessed date.
  • Your coding agent gets a guide. spec-layer skill --install writes instructions into whichever agent host your repository uses, built from the command catalogue, your last pull, and a reading of your stack. spec-layer tools prints every command with whether it reaches the network, whether it needs the pull key, what it writes, and what each exit code means.
  • Settings has an About section, giving the plugin version and the extractor version as separate rows. They answer different questions: a Library reporting a rebuild on every row is reacting to an extractor bump, which the plugin version alone cannot show.
  • Component and Foundation Context v5, schema 5.1.0, with stable ids, complete alias chains, external references, composite typography and effect styles, and optional code_syntax. A component copy embeds only its own dependency closure.

Getting Started

Install from the Figma Community listing.

The CLI is on npm:

npx spec-layer setup

To run this release from source, with Node.js 22 or newer:

npm ci
npm run build:plugin

Then in Figma desktop choose Plugins → Development → Import plugin from manifest and select packages/plugin/manifest.json.

Security Model

Deterministic sections run entirely inside the plugin and send nothing. AI writing routes through the Spec Layer proxy, which holds the Anthropic credential; no user API key is involved. Component requests include a derived summary and, when it fits the limits, a rendered image. The proxy validates raw license keys with Lemon Squeezy but uses SHA-256 digests for its own cache keys, quota identities, and logs. Keep credentials and private design-system data out of Git.

Verification

This release candidate passed, on 2026-09-09:

npm ci
npm run check:ci          # lint, typecheck, NUL scan, coverage, builds,
                          # CLI bundle smoke test, sandbox scan,
                          # proxy deploy dry run, dependency audit
git diff --check
npm run check:site-live

npm audit reports 0 vulnerabilities. npm run check:site-live confirms that https://spec-layer.com/schemas/foundation-context/v5.json and its component counterpart serve exactly the bytes committed in packages/extractor/src/v5/schema/, with the expected $id, and that a missing path returns 404.

The plugin's networkAccess and packages/plugin/src/ui/proxy.ts both point at https://api.spec-layer.com.

The manual Figma pass in packages/plugin/TESTING.md covers what unit tests cannot reach: component docs, Foundation docs, Library, and Copy for AI against a real file.

Known Limitations

  • Workspace packages other than the CLI are not published to npm.
  • AI prose is the only part of the product that uses a model. Extraction, rendering, drift detection, and Copy for AI are deterministic, and that split is deliberate.
  • Free publishing is budgeted per self-asserted Figma identity, so the per-IP rate limiter is the only ceiling against a client that misreports it. See the accepted risks in packages/proxy/README.md.

Full Changelog

See CHANGELOG.md.

Assets 2
Loading