@3fn/core 14.0.0 → 15.0.0

package/dist/cli/shared/errorCatalog.js

@@ -0,0 +1,148 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errorCatalog_exports = {};
+__export(errorCatalog_exports, {
+  attachUnbornRepoMessage: () => attachUnbornRepoMessage,
+  bornIndexAbsentMessage: () => bornIndexAbsentMessage,
+  cloneHatchMessage: () => cloneHatchMessage,
+  componentTokenFamilyMismatchMessage: () => componentTokenFamilyMismatchMessage,
+  componentTokenFileLoadFailedMessage: () => componentTokenFileLoadFailedMessage,
+  consumerDegradationMessage: () => consumerDegradationMessage,
+  existingMcpEntryMessage: () => existingMcpEntryMessage,
+  explicitTokenIndexMissingMessage: () => explicitTokenIndexMissingMessage,
+  initBornRepoMessage: () => initBornRepoMessage,
+  jestConfigCollisionMessage: () => jestConfigCollisionMessage,
+  managedRegionEditedInsideMessage: () => managedRegionEditedInsideMessage,
+  managedRegionMarkersMissingMessage: () => managedRegionMarkersMissingMessage,
+  packageModeIndexAbsentMessage: () => packageModeIndexAbsentMessage,
+  partialCaseMessage: () => partialCaseMessage,
+  partialConfigNoTierMessage: () => partialConfigNoTierMessage,
+  partialManifestOnlyMessage: () => partialManifestOnlyMessage,
+  partialTierNoConfigMessage: () => partialTierNoConfigMessage,
+  partialUnusedLocalTierMessage: () => partialUnusedLocalTierMessage,
+  personalNoteNamingMessage: () => personalNoteNamingMessage,
+  restartLineNowMessage: () => restartLineNowMessage,
+  restartLineSequencedMessage: () => restartLineSequencedMessage
+});
+module.exports = __toCommonJS(errorCatalog_exports);
+function partialConfigNoTierMessage(root, tokenSource) {
+  const tokenSourceSlot = tokenSource ?? "(a non-literal tokenSource value in designerpunk.config.ts)";
+  return `found designerpunk.config.ts at ${root} but no DesignerPunk token tier at ${tokenSourceSlot} \u2014 this repo looks partly initialized. Refusing rather than guessing. Inspect it, or complete it deliberately: npx designerpunk init --re-scaffold`;
+}
+function partialUnusedLocalTierMessage(root) {
+  return `found a token tier at ${root}/src/tokens but your config omits tokenSource, so generate would use DesignerPunk's tokens, not yours. Add tokenSource: './src/tokens' to designerpunk.config.ts. (Refusing to generate until then.)`;
+}
+function partialTierNoConfigMessage(root) {
+  return `found a DesignerPunk token tier at ${root}/src/tokens but no designerpunk.config.ts \u2014 refusing to generate or serve DesignerPunk's reference index as yours. Restore the config, or run: npx designerpunk init --re-scaffold`;
+}
+function partialManifestOnlyMessage(root) {
+  return `found designerpunk.manifest.json at ${root} but no config or token tier \u2014 the design system files are missing. Restore them from version control, or run: npx designerpunk init --re-scaffold`;
+}
+function partialCaseMessage(root, partialCase, attemptedTokenSource) {
+  switch (partialCase) {
+    case "config-no-tier":
+      return partialConfigNoTierMessage(root, attemptedTokenSource);
+    case "unused-local-tier":
+      return partialUnusedLocalTierMessage(root);
+    case "tier-no-config":
+      return partialTierNoConfigMessage(root);
+    case "manifest-only":
+      return partialManifestOnlyMessage(root);
+  }
+}
+function packageModeIndexAbsentMessage() {
+  return `this repo runs in package mode (designerpunk.config.ts has no tokenSource), so its token index is DesignerPunk's tokens \u2014 run 'npx designerpunk generate' to build it. To make a design system of your own: npx designerpunk init --re-scaffold`;
+}
+function bornIndexAbsentMessage(root) {
+  return `no token index in this design system (${root}/token-index is absent or empty) \u2014 run 'npx designerpunk generate'`;
+}
+function explicitTokenIndexMissingMessage(explicitPath) {
+  return `TOKEN_INDEX_DIR is set to ${explicitPath}, which is absent or empty \u2014 unset it, or run generate`;
+}
+function initBornRepoMessage(root) {
+  return `this repo already has a design system (${root}) \u2014 init is the birth event and runs once. To join it: npm install \u2192 npx designerpunk generate \u2192 fill in .designerpunk/personal-note.local.md (generate creates it) \u2192 restart your agent session (approve DesignerPunk's MCP servers if asked). Using a different agent tool than this repo was set up for? Also run: npx designerpunk attach --target=<cc|kiro> to attach a harness (agents + MCP config + approvals). To deliberately re-scaffold: npx designerpunk init --re-scaffold`;
+}
+function restartLineSequencedMessage() {
+  return `when the steps above are done, restart your agent session \u2014 DesignerPunk's MCP servers and your personal note load when a session starts, so this session cannot see them yet (approve the servers if your tool asks)`;
+}
+function cloneHatchMessage() {
+  return `want to own the engine too? Clone github.com/3fn/DesignerPunk \u2014 init already made the token language yours; the clone adds the engine and the components`;
+}
+function personalNoteNamingMessage() {
+  return `fill in .designerpunk/personal-note.local.md \u2014 who you are and how you want to be worked with; your agents read it every session (it stays on your machine)`;
+}
+function jestConfigCollisionMessage() {
+  return `skipped: jest.config.js (already exists) \u2014 the DesignerPunk jest preset is not applied; to test your own forked components with @3fn/core/testing, add ...require('@3fn/core/jest-preset') to your config`;
+}
+function consumerDegradationMessage(member, where, consequence) {
+  return `warning: ${member} is missing from the installed @3fn/core (${where}) \u2014 ${consequence}. Generation continued without it. If a clean reinstall (remove node_modules, then npm install) does not restore it, the package you installed does not contain it.`;
+}
+function managedRegionMarkersMissingMessage(file) {
+  return `the DesignerPunk-managed region in ${file} is missing its markers \u2014 not rewriting the file. Restore the markers (see install doc \xA7 "Your agent layer") or re-run attach`;
+}
+function managedRegionEditedInsideMessage(file) {
+  return `you edited inside the DesignerPunk-managed region of ${file} \u2014 those edits will be replaced. Move them outside the region; not applying without --apply`;
+}
+function attachUnbornRepoMessage() {
+  return `no design system here. To create one: npx designerpunk init. Only reading DesignerPunk's docs and components? No init needed: npx designerpunk attach --target=<cc|kiro> --reference`;
+}
+function restartLineNowMessage() {
+  return `restart your agent session now \u2014 DesignerPunk's MCP servers load when a session starts, so this session cannot see them yet (approve them if your tool asks)`;
+}
+function existingMcpEntryMessage(configFile, key, target) {
+  return `${configFile} already has '${key}' entry; left unchanged. If it is outdated, delete the entry and re-run: npx designerpunk attach --target=${target} \u2014 or update it by hand.`;
+}
+function componentTokenFamilyMismatchMessage(file, guardMessage) {
+  let alternative = "";
+  if (file.startsWith("src/tokens/")) {
+    alternative = ` Or, if an earlier DesignerPunk init copied this file, replace it with the package's version at node_modules/@3fn/core/${file} and change its '../../build/tokens' import to '@3fn/core/build'.`;
+  } else if (file.startsWith("src/components/core/")) {
+    alternative = ` Or, if this is an unedited copy an earlier DesignerPunk init made, delete it \u2014 its component tokens then leave your generated ComponentTokens.* files.`;
+  }
+  return `generate stopped \u2014 ${file} declares a component token in the wrong family's defineComponentTokens() call. ${guardMessage} To fix it, split that file's defineComponentTokens() into one call per token family.${alternative} Nothing was written.`;
+}
+function componentTokenFileLoadFailedMessage(file, reason) {
+  const firstLine = reason.split(/\r?\n/, 1)[0].trim();
+  return `generate stopped \u2014 ${file} could not be loaded: ${firstLine} Fix the file and run generate again. Nothing was written.`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  attachUnbornRepoMessage,
+  bornIndexAbsentMessage,
+  cloneHatchMessage,
+  componentTokenFamilyMismatchMessage,
+  componentTokenFileLoadFailedMessage,
+  consumerDegradationMessage,
+  existingMcpEntryMessage,
+  explicitTokenIndexMissingMessage,
+  initBornRepoMessage,
+  jestConfigCollisionMessage,
+  managedRegionEditedInsideMessage,
+  managedRegionMarkersMissingMessage,
+  packageModeIndexAbsentMessage,
+  partialCaseMessage,
+  partialConfigNoTierMessage,
+  partialManifestOnlyMessage,
+  partialTierNoConfigMessage,
+  partialUnusedLocalTierMessage,
+  personalNoteNamingMessage,
+  restartLineNowMessage,
+  restartLineSequencedMessage
+});
+//# sourceMappingURL=errorCatalog.js.map

package/dist/cli/shared/mcpConfig/cc.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Claude Code's per-harness MCP config emitter (Spec 123 Task 4; design.md
+ * § "C8. Per-harness MCP configuration + approvals"; requirements.md Reqs
+ * 5.3, 5.4, 7.1–7.4, 15A.1).
+ *
+ * Extracted from `src/cli/init.ts` (Task 2's `scaffoldClaudeCodeMcpConfig`,
+ * which carried a KNOWN INTERIM approval source — the static template's
+ * hand-authored `autoApprove` arrays, reformatted to the `mcp__<server>__<tool>`
+ * grain; see `task-2-3-completion.md` § "Notes for Task 4"). This module keeps
+ * the SAME output shape (`.mcp.json` with no `autoApprove`/`disabled` fields —
+ * CC has no per-server auto-approve field; `.claude/settings.json`
+ * `permissions.allow`) and the SAME create/merge-carefully behavior; the only
+ * thing it changes is the approval SOURCE: `permissions.allow` is now
+ * GENERATED from `dist/mcp/tool-manifest.json`'s `readOnlyHint`-annotated tool
+ * registrations, never a hand-maintained array.
+ */
+import type { McpConfigManifestRecorder, McpConfigTemplate } from './kiro';
+/**
+ * Scaffold Claude Code's `.mcp.json` (server config, no `autoApprove`/`disabled`
+ * fields) plus the `.claude/settings.json` `permissions.allow` keys (Spec 123
+ * Task 4, C8's approval-source replacement). `template` is already
+ * parsed/validated by the caller (`init.ts`'s `readMcpTemplate`).
+ */
+export declare function scaffoldClaudeCodeMcpConfig(template: McpConfigTemplate, dest: string, manifest: McpConfigManifestRecorder, pkgRoot: string): void;
+//# sourceMappingURL=cc.d.ts.map

package/dist/cli/shared/mcpConfig/cc.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Claude Code's per-harness MCP config emitter (Spec 123 Task 4; design.md
+ * § "C8. Per-harness MCP configuration + approvals"; requirements.md Reqs
+ * 5.3, 5.4, 7.1–7.4, 15A.1).
+ *
+ * Extracted from `src/cli/init.ts` (Task 2's `scaffoldClaudeCodeMcpConfig`,
+ * which carried a KNOWN INTERIM approval source — the static template's
+ * hand-authored `autoApprove` arrays, reformatted to the `mcp__<server>__<tool>`
+ * grain; see `task-2-3-completion.md` § "Notes for Task 4"). This module keeps
+ * the SAME output shape (`.mcp.json` with no `autoApprove`/`disabled` fields —
+ * CC has no per-server auto-approve field; `.claude/settings.json`
+ * `permissions.allow`) and the SAME create/merge-carefully behavior; the only
+ * thing it changes is the approval SOURCE: `permissions.allow` is now
+ * GENERATED from `dist/mcp/tool-manifest.json`'s `readOnlyHint`-annotated tool
+ * registrations, never a hand-maintained array.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scaffoldClaudeCodeMcpConfig = scaffoldClaudeCodeMcpConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const errorCatalog_1 = require("../errorCatalog");
+const kiro_1 = require("./kiro");
+/**
+ * Scaffold Claude Code's `.mcp.json` (server config, no `autoApprove`/`disabled`
+ * fields) plus the `.claude/settings.json` `permissions.allow` keys (Spec 123
+ * Task 4, C8's approval-source replacement). `template` is already
+ * parsed/validated by the caller (`init.ts`'s `readMcpTemplate`).
+ */
+function scaffoldClaudeCodeMcpConfig(template, dest, manifest, pkgRoot) {
+    // --- .mcp.json ---
+    const mcpJsonPath = path.join(dest, '.mcp.json');
+    const ccServers = {};
+    for (const [key, value] of Object.entries(template.mcpServers)) {
+        const { autoApprove, disabled, ...rest } = value;
+        void autoApprove;
+        void disabled;
+        ccServers[key] = rest;
+    }
+    if (!fs.existsSync(mcpJsonPath)) {
+        fs.writeFileSync(mcpJsonPath, JSON.stringify({ mcpServers: ccServers }, null, 2) + '\n', 'utf-8');
+        console.log(`✓ Created .mcp.json (${Object.keys(ccServers).join(' + ')})`);
+        for (const key of Object.keys(ccServers))
+            manifest.recordKey('.mcp.json', key, ccServers[key]);
+    }
+    else {
+        let existing;
+        try {
+            existing = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
+        }
+        catch {
+            console.log(`  warning: .mcp.json exists but is not valid JSON; leaving unchanged`);
+            existing = { mcpServers: {} };
+        }
+        if (!existing.mcpServers || typeof existing.mcpServers !== 'object')
+            existing.mcpServers = {};
+        const added = [];
+        const skipped = [];
+        for (const [key, value] of Object.entries(ccServers)) {
+            if (key in existing.mcpServers) {
+                skipped.push(key);
+            }
+            else {
+                existing.mcpServers[key] = value;
+                added.push(key);
+                manifest.recordKey('.mcp.json', key, value);
+            }
+        }
+        if (added.length > 0) {
+            fs.writeFileSync(mcpJsonPath, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+            console.log(`✓ .mcp.json: added ${added.join(' + ')}`);
+        }
+        else if (skipped.length === Object.keys(ccServers).length) {
+            console.log(`  skipped: .mcp.json (all DesignerPunk entries already present)`);
+        }
+        for (const key of skipped) {
+            console.log(`  ⚠️  ${(0, errorCatalog_1.existingMcpEntryMessage)('.mcp.json', key, 'cc')}`);
+        }
+    }
+    // --- .claude/settings.json (permissions.allow) — GENERATED from the tool
+    // manifest's readOnlyHint (Spec 123 Task 4), never the template's autoApprove.
+    const settingsPath = path.join(dest, '.claude/settings.json');
+    const allowEntries = [];
+    for (const serverKey of Object.keys(template.mcpServers)) {
+        for (const tool of (0, kiro_1.readApprovedToolNames)(pkgRoot, serverKey)) {
+            allowEntries.push(`mcp__${serverKey}__${tool}`);
+        }
+    }
+    if (!fs.existsSync(settingsPath)) {
+        fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+        fs.writeFileSync(settingsPath, JSON.stringify({ permissions: { allow: allowEntries } }, null, 2) + '\n', 'utf-8');
+        console.log(`✓ Created .claude/settings.json (${allowEntries.length} approved tools)`);
+        // Key grain, one entry per allow string (Spec 123 Task 5.3 — C7's `permissions.allow` row).
+        for (const entry of allowEntries)
+            manifest.recordKey('.claude/settings.json', entry, entry);
+        return;
+    }
+    let existingSettings;
+    try {
+        existingSettings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+    }
+    catch {
+        console.log(`  warning: .claude/settings.json exists but is not valid JSON; leaving unchanged`);
+        return;
+    }
+    if (!existingSettings.permissions || typeof existingSettings.permissions !== 'object') {
+        existingSettings.permissions = {};
+    }
+    const existingAllow = Array.isArray(existingSettings.permissions.allow) ? existingSettings.permissions.allow : [];
+    const newEntries = allowEntries.filter((e) => !existingAllow.includes(e));
+    if (newEntries.length > 0) {
+        existingSettings.permissions.allow = [...existingAllow, ...newEntries];
+        fs.writeFileSync(settingsPath, JSON.stringify(existingSettings, null, 2) + '\n', 'utf-8');
+        console.log(`✓ .claude/settings.json: added ${newEntries.length} approved tool(s)`);
+        // Key grain — only the entries WE added; pre-existing ones are hers (C7 namespace rule).
+        for (const entry of newEntries)
+            manifest.recordKey('.claude/settings.json', entry, entry);
+    }
+    else {
+        console.log(`  skipped: .claude/settings.json (all DesignerPunk approvals already present)`);
+    }
+}
+//# sourceMappingURL=cc.js.map

package/dist/cli/shared/mcpConfig/kiro.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Kiro's per-harness MCP config emitter (Spec 123 Task 4; design.md § "C8.
+ * Per-harness MCP configuration + approvals"; requirements.md Reqs 5.3, 5.4,
+ * 7.1–7.4, 15A.1).
+ *
+ * Extracted from `src/cli/init.ts` (Task 2's `scaffoldKiroMcpConfig`, which
+ * carried a KNOWN INTERIM approval source — the static template's
+ * hand-authored `autoApprove` arrays; see `task-2-3-completion.md` § "Notes
+ * for Task 4"). This module keeps the SAME output shape and the SAME
+ * create/merge-carefully behavior; the only thing it changes is the approval
+ * SOURCE: `autoApprove` is now GENERATED from `dist/mcp/tool-manifest.json`'s
+ * `readOnlyHint`-annotated tool registrations (C8: "ANNOTATIONS, not a hand
+ * list"), never a hand-maintained array.
+ */
+/** Structural — satisfied by `init.ts`'s `ManifestBuilder` without importing it (avoids a circular import). */
+export interface McpConfigManifestRecorder {
+    recordKey(relPath: string, key: string, value: unknown): void;
+    recordFile(relPath: string, absPath: string, origin: 'copy' | 'generated' | 'emitted-key'): void;
+}
+/** A server entry from `mcp-config.json.template`, connection wiring only (no `autoApprove` — Task 4 computes it). */
+export interface McpServerTemplateEntry {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    disabled?: boolean;
+    [key: string]: unknown;
+}
+export interface McpConfigTemplate {
+    mcpServers: Record<string, McpServerTemplateEntry>;
+}
+/**
+ * Read `dist/mcp/tool-manifest.json` (built by `scripts/build-tool-manifest.ts`
+ * at `npm run build:mcp` — Task 4.2) and return the tool NAMES this server key
+ * has `readOnlyHint: true` for. Fails soft with a warning (never throws) —
+ * mirrors `readMcpTemplate`'s existing defensive pattern, since a missing or
+ * unreadable manifest should degrade to an empty approval list, not crash `init`.
+ */
+export declare function readApprovedToolNames(pkgRoot: string, serverKey: string): string[];
+/**
+ * Scaffold Kiro's `.kiro/settings/mcp.json` from the parsed template plus a
+ * GENERATED per-server `autoApprove` (Spec 102 Gap 5's output shape, Spec 123
+ * Task 4's approval source). `template` is already parsed/validated by the
+ * caller (`init.ts`'s `readMcpTemplate`) — this module owns approval
+ * generation and the merge behavior, not template loading.
+ *
+ * Three behaviors depending on destination state:
+ * 1. **Destination doesn't exist** → create from template + generated approvals.
+ * 2. **Destination exists, neither DesignerPunk entry present** → merge.
+ * 3. **Destination exists, one or both DesignerPunk entries already present** →
+ *    skip the conflicting entries with a prominent warning (partial merge).
+ */
+export declare function scaffoldKiroMcpConfig(template: McpConfigTemplate, destPath: string, manifest: McpConfigManifestRecorder, repoRoot: string, pkgRoot: string): void;
+//# sourceMappingURL=kiro.d.ts.map

package/dist/cli/shared/mcpConfig/kiro.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Kiro's per-harness MCP config emitter (Spec 123 Task 4; design.md § "C8.
+ * Per-harness MCP configuration + approvals"; requirements.md Reqs 5.3, 5.4,
+ * 7.1–7.4, 15A.1).
+ *
+ * Extracted from `src/cli/init.ts` (Task 2's `scaffoldKiroMcpConfig`, which
+ * carried a KNOWN INTERIM approval source — the static template's
+ * hand-authored `autoApprove` arrays; see `task-2-3-completion.md` § "Notes
+ * for Task 4"). This module keeps the SAME output shape and the SAME
+ * create/merge-carefully behavior; the only thing it changes is the approval
+ * SOURCE: `autoApprove` is now GENERATED from `dist/mcp/tool-manifest.json`'s
+ * `readOnlyHint`-annotated tool registrations (C8: "ANNOTATIONS, not a hand
+ * list"), never a hand-maintained array.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readApprovedToolNames = readApprovedToolNames;
+exports.scaffoldKiroMcpConfig = scaffoldKiroMcpConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const errorCatalog_1 = require("../errorCatalog");
+/**
+ * Read `dist/mcp/tool-manifest.json` (built by `scripts/build-tool-manifest.ts`
+ * at `npm run build:mcp` — Task 4.2) and return the tool NAMES this server key
+ * has `readOnlyHint: true` for. Fails soft with a warning (never throws) —
+ * mirrors `readMcpTemplate`'s existing defensive pattern, since a missing or
+ * unreadable manifest should degrade to an empty approval list, not crash `init`.
+ */
+function readApprovedToolNames(pkgRoot, serverKey) {
+    const manifestPath = path.join(pkgRoot, 'dist/mcp/tool-manifest.json');
+    if (!fs.existsSync(manifestPath)) {
+        console.log(`  warning: MCP tool manifest not found at ${manifestPath}; '${serverKey}' will scaffold with NO auto-approved tools. Run 'npm run build' in the package.`);
+        return [];
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+    }
+    catch {
+        console.log(`  warning: MCP tool manifest at ${manifestPath} is not valid JSON; '${serverKey}' will scaffold with NO auto-approved tools.`);
+        return [];
+    }
+    const entries = manifest.servers?.[serverKey] ?? [];
+    return entries.filter((tool) => tool.readOnlyHint === true).map((tool) => tool.name);
+}
+/**
+ * Scaffold Kiro's `.kiro/settings/mcp.json` from the parsed template plus a
+ * GENERATED per-server `autoApprove` (Spec 102 Gap 5's output shape, Spec 123
+ * Task 4's approval source). `template` is already parsed/validated by the
+ * caller (`init.ts`'s `readMcpTemplate`) — this module owns approval
+ * generation and the merge behavior, not template loading.
+ *
+ * Three behaviors depending on destination state:
+ * 1. **Destination doesn't exist** → create from template + generated approvals.
+ * 2. **Destination exists, neither DesignerPunk entry present** → merge.
+ * 3. **Destination exists, one or both DesignerPunk entries already present** →
+ *    skip the conflicting entries with a prominent warning (partial merge).
+ */
+function scaffoldKiroMcpConfig(template, destPath, manifest, repoRoot, pkgRoot) {
+    const withApprovals = {};
+    for (const [key, value] of Object.entries(template.mcpServers)) {
+        withApprovals[key] = { ...value, autoApprove: readApprovedToolNames(pkgRoot, key) };
+    }
+    if (!fs.existsSync(destPath)) {
+        fs.mkdirSync(path.dirname(destPath), { recursive: true });
+        fs.writeFileSync(destPath, JSON.stringify({ mcpServers: withApprovals }, null, 2) + '\n', 'utf-8');
+        const keys = Object.keys(withApprovals);
+        console.log(`✓ Created .kiro/settings/mcp.json (${keys.join(' + ')})`);
+        for (const key of keys)
+            manifest.recordKey(path.relative(repoRoot, destPath), key, withApprovals[key]);
+        return;
+    }
+    let existing;
+    try {
+        existing = JSON.parse(fs.readFileSync(destPath, 'utf-8'));
+    }
+    catch {
+        console.log(`  warning: .kiro/settings/mcp.json exists but is not valid JSON; leaving unchanged`);
+        return;
+    }
+    if (!existing.mcpServers || typeof existing.mcpServers !== 'object') {
+        existing.mcpServers = {};
+    }
+    const added = [];
+    const skipped = [];
+    for (const [key, value] of Object.entries(withApprovals)) {
+        if (key in existing.mcpServers) {
+            skipped.push(key);
+        }
+        else {
+            existing.mcpServers[key] = value;
+            added.push(key);
+            manifest.recordKey(path.relative(repoRoot, destPath), key, value);
+        }
+    }
+    if (added.length > 0) {
+        fs.writeFileSync(destPath, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+        console.log(`✓ .kiro/settings/mcp.json: added ${added.join(' + ')}`);
+    }
+    else if (skipped.length === Object.keys(withApprovals).length) {
+        console.log(`  skipped: .kiro/settings/mcp.json (all DesignerPunk entries already present)`);
+    }
+    for (const key of skipped) {
+        console.log(`  ⚠️  ${(0, errorCatalog_1.existingMcpEntryMessage)('.kiro/settings/mcp.json', key, 'kiro')}`);
+    }
+}
+//# sourceMappingURL=kiro.js.map

package/dist/cli/shared/mcpDataRoots.d.ts

@@ -1,6 +1,7 @@
+import type { DesignSystemRoot, PartialCase } from './bornRepo';
 export { resolvePackageRoot } from './resolvePackageRoot';
 /** Which resolution source won for a data root. */
-export type DataRootSource = 'env' | 'cwd' | 'package';
+export type DataRootSource = 'env' | 'cwd' | 'package' | 'package-consume';
 /** A resolved data root: absolute path + which source won. */
 export interface ResolvedDataRoot {
     /** Absolute path to the data root. */
@@ -21,6 +22,17 @@ export declare function resolvePackageOwnedRoot(opts: {
     relPath: string;
 }): ResolvedDataRoot;
 /**
+ * @deprecated Spec 123 Task 1.2 — superseded by the birth-aware resolvers below
+ * (`resolveComponentRoots`, `resolveTokenIndexRoot`, `resolveProductRoot`), which
+ * consult a `DesignSystemRoot` (from `bornRepo.findDesignSystemRoot`) instead of a
+ * bare cwd-existence check. This function does not know about `born` /
+ * `package-mode` / `partial` — a cwd-relative `token-index/` in an UNRELATED
+ * directory (e.g. a stray leftover) would win over the correct package fallback.
+ * KEPT, UNCHANGED, so the three servers' `require.main` bootstrap blocks keep
+ * compiling and behaving exactly as before until Tasks 1.4–1.6 (indexer multi-root
+ * consumption, `generate`'s tier-aware writes, and the servers' bootstrap rewiring)
+ * land together. Do not add new callers.
+ *
  * Resolve a CONSUMER-OWNED data root: env var → cwd-relative (if exists AND
  * non-empty) → package-relative fallback (only when `packageRoot` is provided).
  * When `packageRoot` is omitted (product server's `product/` root), the
@@ -35,4 +47,79 @@ export declare function resolveConsumerOwnedRoot(opts: {
     /** Absolute package root; OMIT to disable the package fallback. */
     packageRoot?: string;
 }): ResolvedDataRoot;
+/** The result of resolving the component-root UNION (C3: consumer ∪ package). */
+export interface ComponentRootsResult {
+    /** `[consumerRoot?, packageRoot]` — the union, consumer-first for precedence. */
+    roots: string[];
+    /** Parallel to `roots`: which source produced each entry. */
+    sources: DataRootSource[];
+}
+/**
+ * Resolve the component-root UNION (C3 "Resolver" § `resolveComponentRoots`).
+ * `consumerRoot` = the env value if set, else `bornRoot/src/components` when
+ * `dsRoot.state === 'born'`; absent otherwise (package-mode, partial, unborn,
+ * with no explicit env). **The env value names the consumer root, never the
+ * only root** — `packageRoot` is always present in `roots` too, so the union
+ * (and the fork-precedence-on-declared-name rule, Task 1.4) still applies.
+ */
+export declare function resolveComponentRoots(opts: {
+    /** The env-var value, if set (e.g. process.env.COMPONENTS_DIR / COMPONENT_DIR). */
+    envValue?: string;
+    /** The caller's birth-detection result (`bornRepo.findDesignSystemRoot`). */
+    dsRoot: DesignSystemRoot;
+    /** Absolute package root (from `resolvePackageRoot`). */
+    packageRoot: string;
+}): ComponentRootsResult;
+/** The result of resolving the token-index root (C3 "Resolver" § `resolveTokenIndexRoot`). */
+export type TokenIndexResolution = {
+    ok: true;
+    path: string;
+    source: DataRootSource;
+    /** Set for package-mode and unborn — never for `born`. */
+    tokenOrigin?: 'designerpunk-package-mode' | 'designerpunk-reference';
+} | {
+    ok: false;
+    reason: 'empty-env-value';
+} | {
+    ok: false;
+    reason: 'run-generate';
+} | {
+    ok: false;
+    reason: 'partial';
+    partialCase?: PartialCase;
+};
+/**
+ * Resolve the token-index root (C3):
+ * - explicit env value absent-or-empty on disk → error, in ANY posture;
+ * - `born` → `bornRoot/token-index`, erroring ("run generate") if absent/empty;
+ * - `package-mode` → `root/token-index`, labelled `designerpunk-package-mode`,
+ *   erroring ("run generate") if absent/empty — safe here because a config exists;
+ * - `partial` → its own error, naming the sub-case — NEVER "run generate";
+ * - `unborn` → the package index, `source: 'package-consume'`, labelled
+ *   `tokenOrigin: 'designerpunk-reference'`.
+ *
+ * Message-string assembly (the catalog rows) is a Task 1.6 concern — this
+ * resolver returns structured reasons only.
+ */
+export declare function resolveTokenIndexRoot(opts: {
+    /** The env-var value, if set (e.g. process.env.TOKEN_INDEX_DIR). */
+    envValue?: string;
+    /** The caller's birth-detection result (`bornRepo.findDesignSystemRoot`). */
+    dsRoot: DesignSystemRoot;
+    /** Absolute package root (from `resolvePackageRoot`). */
+    packageRoot: string;
+}): TokenIndexResolution;
+/**
+ * Resolve the product root (C3): env, else `bornRoot/product` (born,
+ * package-mode OR partial — any state with a resolved `root`), else
+ * `cwd/product` (unborn — unchanged from the pre-123 behavior).
+ */
+export declare function resolveProductRoot(opts: {
+    /** The env-var value, if set (e.g. process.env.PRODUCT_DIR). */
+    envValue?: string;
+    /** The caller's birth-detection result (`bornRepo.findDesignSystemRoot`). */
+    dsRoot: DesignSystemRoot;
+    /** The invoking process's cwd (the unborn fallback base). */
+    cwd: string;
+}): ResolvedDataRoot;
 //# sourceMappingURL=mcpDataRoots.d.ts.map