@intentius/chant 0.80.0 → 0.81.0

package/src/cli/static-config-read.test.ts

@@ -0,0 +1,208 @@
+/**
+ * chant#2591, chant#2589 — `init --force`, `dev onboard`, `import --agents`
+ * and `audit` learn the lexicons a project declares by path without running
+ * its `chant.config.ts`.
+ *
+ * The CLI is spawned the way `bin/chant` runs it, because `main.ts` loads the
+ * config before dispatch for most commands, and a test calling the command
+ * functions would miss that load. Each fixture's config writes a marker file
+ * when it runs. The marker must never appear, and each command's output must
+ * still name the lexicon's path.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { auditCommand } from "./commands/audit";
+import { runCommandInProcess } from "./main";
+import { resetLexiconModules } from "../lexicon-module";
+import { captureRun } from "../workspace/member-run";
+
+const thisDir = dirname(fileURLToPath(import.meta.url));
+const mainTs = resolve(thisDir, "main.ts");
+const repoRoot = resolve(thisDir, "../../../..");
+const tsxLoader = join(repoRoot, "node_modules", "tsx", "dist", "loader.mjs");
+
+let root: string;
+let project: string;
+let marker: string;
+let home: string;
+let moduleMarker: string;
+
+function writeConfig(lexicons: string): void {
+  writeFileSync(
+    join(project, "chant.config.ts"),
+    `import { writeFileSync } from "node:fs";\n` +
+      `writeFileSync(${JSON.stringify(marker)}, "ran");\n` +
+      `export default { lexicons: ${lexicons} };\n`,
+  );
+}
+
+beforeEach(() => {
+  resetLexiconModules();
+  root = realpathSync(mkdtempSync(join(tmpdir(), "chant-2591-cli-")));
+  project = join(root, "project");
+  marker = join(root, "config-ran");
+  home = join(root, "home");
+  moduleMarker = join(root, "module-ran");
+  mkdirSync(join(project, ".github", "workflows"), { recursive: true });
+  mkdirSync(join(project, "gh"), { recursive: true });
+  mkdirSync(join(project, ".git"));
+  // The path lexicon's module is project code too. Audit must never import it.
+  writeFileSync(
+    join(project, "gh", "index.ts"),
+    `import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(moduleMarker)}, "ran");\nexport {};\n`,
+  );
+  writeFileSync(
+    join(project, ".github", "workflows", "ci.yml"),
+    "on: push\njobs:\n  a:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n",
+  );
+  mkdirSync(join(home, ".claude"), { recursive: true });
+  writeFileSync(join(home, ".claude", "mcp.json"), JSON.stringify({ mcpServers: { a: { command: "x" } } }));
+  writeConfig(`[{ name: "github", module: "./gh/index.ts" }]`);
+});
+
+afterEach(() => {
+  resetLexiconModules();
+  rmSync(root, { recursive: true, force: true });
+});
+
+function chant(args: string[], cwd: string): string {
+  const result = spawnSync(process.execPath, ["--import", tsxLoader, mainTs, ...args], {
+    cwd,
+    env: { PATH: process.env.PATH ?? "", HOME: home },
+    encoding: "utf-8",
+    input: "n\n",
+    timeout: 60_000,
+  });
+  return `${result.stdout}\n${result.stderr}`;
+}
+
+const COMMANDS: Array<{ name: string; args: () => string[]; cwd: () => string }> = [
+  { name: "init --force", args: () => ["init", project, "--lexicon", "github", "--force", "--skip-mcp"], cwd: () => root },
+  { name: "dev onboard", args: () => ["dev", "onboard", "github"], cwd: () => project },
+  { name: "import --agents", args: () => ["import", "--agents", "--lexicon", "github", "--output", join(root, "out")], cwd: () => project },
+];
+
+describe("commands that read path lexicons statically run no project code", () => {
+  for (const command of COMMANDS) {
+    for (const sandbox of [false, true]) {
+      test(`${command.name}${sandbox ? " --sandbox" : ""} names the path and never runs chant.config.ts`, () => {
+        const output = chant([...command.args(), ...(sandbox ? ["--sandbox"] : [])], command.cwd());
+        expect(output).toContain("./gh/index.ts");
+        expect(existsSync(marker)).toBe(false);
+      }, 90_000);
+    }
+  }
+
+  test("audit never runs chant.config.ts or the path lexicon's module", () => {
+    chant(["audit", project], root);
+    expect(existsSync(marker)).toBe(false);
+    expect(existsSync(moduleMarker)).toBe(false);
+  }, 90_000);
+
+  test("a config it cannot read is reported, and still not run", () => {
+    writeConfig(`process.env.CI ? ["github"] : [{ name: "github", module: "./gh/index.ts" }]`);
+    const output = chant(["dev", "onboard", "github"], project);
+    expect(output).toContain("could not read the lexicons in");
+    expect(output).toContain("treated as a package");
+    expect(existsSync(marker)).toBe(false);
+
+    const audit = chant(["audit", project], root);
+    expect(audit).toContain("could not read the lexicons in");
+    expect(existsSync(marker)).toBe(false);
+  }, 180_000);
+
+  test("control: build does run chant.config.ts", () => {
+    chant(["build", "."], project);
+    expect(existsSync(marker)).toBe(true);
+  }, 90_000);
+});
+
+describe("audit names a path lexicon by its path and leaves it out of the install line (chant#2589)", () => {
+  test("text output", async () => {
+    const result = await auditCommand({ path: project, plugins: [] });
+    expect(result.status).toBe("no-lexicons");
+    expect(result.output).toContain("github is declared by path: ");
+    expect(result.output).toContain("gh/index.ts");
+    const install = result.output.split("\n").find((line) => line.includes("npx "));
+    expect(install).toBeDefined();
+    expect(install).not.toContain("@intentius/chant-lexicon-github");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("json output", async () => {
+    const result = await auditCommand({ path: project, plugins: [], format: "json" });
+    const report = JSON.parse(result.output) as { install: string };
+    expect(report.install).toMatch(/^npx -p @intentius\/chant( |$)/);
+    expect(report.install).not.toContain("@intentius/chant-lexicon-github");
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("a partial run names the path in its coverage note", async () => {
+    // Some other audit lexicon loaded, github not: the workflow is skipped and the note names the path.
+    const { loadPlugin } = await import("./plugins");
+    const docker = await loadPlugin("docker");
+    const result = await auditCommand({ path: project, plugins: [docker] });
+    expect(result.output).toContain("github is declared by path: ");
+    expect(result.output).not.toContain("npm i @intentius/chant-lexicon-github");
+    expect(existsSync(marker)).toBe(false);
+    expect(existsSync(moduleMarker)).toBe(false);
+  });
+});
+
+/**
+ * chant#2618 — the other ways into `audit`: main's dispatch run in-process
+ * (what `workspace member-run` calls once per member), and `workspace audit`
+ * through the CLI, which reaches it through that member-run process.
+ */
+describe("chant audit never evaluates the audited repository's config (chant#2618)", () => {
+  test("main's in-process dispatch runs neither the config nor the path lexicon's module", async () => {
+    const run = await captureRun(() => runCommandInProcess(["audit", project]));
+    expect(run.exitCode).toBe(0);
+    expect(existsSync(marker)).toBe(false);
+    expect(existsSync(moduleMarker)).toBe(false);
+  }, 90_000);
+
+  test("workspace audit runs no member's config and no path lexicon's module", () => {
+    // The project becomes the root member of a workspace, with a second
+    // member whose config and path lexicon leave markers of their own.
+    const apiMarker = join(root, "api-config-ran");
+    const apiModuleMarker = join(root, "api-module-ran");
+    const api = join(project, "api");
+    mkdirSync(join(api, ".github", "workflows"), { recursive: true });
+    mkdirSync(join(api, "gh"), { recursive: true });
+    writeFileSync(
+      join(api, "chant.config.ts"),
+      `import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(apiMarker)}, "ran");\n` +
+        `export default { lexicons: [{ name: "github", module: "./gh/index.ts" }] };\n`,
+    );
+    writeFileSync(
+      join(api, "gh", "index.ts"),
+      `import { writeFileSync } from "node:fs";\nwriteFileSync(${JSON.stringify(apiModuleMarker)}, "ran");\nexport {};\n`,
+    );
+    writeFileSync(
+      join(api, ".github", "workflows", "ci.yml"),
+      "on: push\njobs:\n  a:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n",
+    );
+    writeFileSync(
+      join(project, "chant.workspace.json"),
+      JSON.stringify({
+        name: "acme",
+        schema: 1,
+        members: [
+          { name: "root", dir: ".", kind: "chant" },
+          { name: "api", dir: "api", kind: "chant" },
+        ],
+      }),
+    );
+    const output = chant(["workspace", "audit", "--json"], project);
+    expect(output).toContain('"api"');
+    expect(existsSync(marker)).toBe(false);
+    expect(existsSync(moduleMarker)).toBe(false);
+    expect(existsSync(apiMarker)).toBe(false);
+    expect(existsSync(apiModuleMarker)).toBe(false);
+  }, 180_000);
+});

package/src/codegen/fetch.test.ts

@@ -1,5 +1,8 @@
 import { describe, test, expect, vi, afterEach } from "vitest";
-import { extractFromTar, fetchWithRetry, TransientFetchError } from "./fetch";
+import { extractFromTar, fetchWithCache, fetchWithRetry, TransientFetchError } from "./fetch";
+import { mkdtempSync, utimesSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
 
 /**
  * Build a minimal valid tar buffer with a single file entry.
@@ -318,3 +321,62 @@ describe("fetchWithRetry", () => {
     expect((err as TransientFetchError).message).toContain("1 attempt");
   });
 });
+
+describe("fetchWithCache", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  function cacheAt(ageMs: number, content = "stale bytes"): string {
+    const file = join(mkdtempSync(join(tmpdir(), "chant-fetch-cache-")), "spec.bin");
+    writeFileSync(file, content);
+    const then = (Date.now() - ageMs) / 1000;
+    utimesSync(file, then, then);
+    return file;
+  }
+
+  test("returns the stale cached copy when every download attempt fails transiently", async () => {
+    const cacheFile = cacheAt(2 * 24 * 60 * 60 * 1000);
+    const fetchMock = vi.fn().mockRejectedValue(new Error("ECONNRESET"));
+    vi.stubGlobal("fetch", fetchMock);
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((m: unknown) => { errors.push(String(m)); });
+
+    const data = await fetchWithCache({ url: "https://example.test/spec", cacheFile, retries: 1, backoffMs: 1 });
+
+    expect(data.toString()).toBe("stale bytes");
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(errors.join("\n")).toContain("Using the cached copy");
+  });
+
+  test("force ignores the stale copy and throws", async () => {
+    const cacheFile = cacheAt(2 * 24 * 60 * 60 * 1000);
+    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("ECONNRESET")));
+
+    await expect(
+      fetchWithCache({ url: "https://example.test/spec", cacheFile, retries: 1, backoffMs: 1 }, true),
+    ).rejects.toBeInstanceOf(TransientFetchError);
+  });
+
+  test("a permanent failure with a stale copy still throws", async () => {
+    const cacheFile = cacheAt(2 * 24 * 60 * 60 * 1000);
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("gone", { status: 404 })));
+
+    await expect(
+      fetchWithCache({ url: "https://example.test/spec", cacheFile, retries: 1, backoffMs: 1 }),
+    ).rejects.toThrow();
+  });
+
+  test("passes attemptTimeoutMs through as the attempt signal", async () => {
+    const cacheFile = cacheAt(2 * 24 * 60 * 60 * 1000);
+    const fetchMock = vi.fn().mockResolvedValue(new Response("fresh"));
+    vi.stubGlobal("fetch", fetchMock);
+
+    const data = await fetchWithCache({ url: "https://example.test/spec", cacheFile, attemptTimeoutMs: 120_000 });
+
+    expect(data.toString()).toBe("fresh");
+    const init = fetchMock.mock.calls[0][1] as RequestInit;
+    expect(init.signal).toBeInstanceOf(AbortSignal);
+  });
+});

package/src/codegen/fetch.ts

@@ -18,6 +18,16 @@ export interface FetchConfig {
   cacheFile: string;
   /** Cache TTL in milliseconds (default: 24 hours). */
   cacheTtlMs?: number;
+  /**
+   * Per-attempt timeout for the download in milliseconds (default: 15 seconds).
+   * A source archive of tens of megabytes needs more than the default, which
+   * is sized for a JSON schema.
+   */
+  attemptTimeoutMs?: number;
+  /** Retries after the first attempt (default: 4). */
+  retries?: number;
+  /** Base back-off between attempts in milliseconds (default: 1 second). */
+  backoffMs?: number;
 }
 
 // ── Transient-aware fetch ──────────────────────────────────────────
@@ -198,7 +208,26 @@ export async function fetchWithCache(config: FetchConfig, force = false): Promis
     }
   }
 
-  const response = await fetchWithRetry(config.url);
+  let response: Response;
+  try {
+    response = await fetchWithRetry(
+      config.url,
+      config.retries ?? DEFAULT_RETRIES,
+      config.backoffMs ?? DEFAULT_BACKOFF_MS,
+      undefined,
+      config.attemptTimeoutMs ?? DEFAULT_ATTEMPT_TIMEOUT_MS,
+    );
+  } catch (e) {
+    // A stale copy beats a failed build. The archives this caches are pinned
+    // by tag or by version in the URL, so a copy past its TTL is the same
+    // bytes; the TTL exists to notice an unpinned URL moving, not to expire
+    // good data. `force` means the caller needs fresh bytes, so it still throws.
+    if (!force && e instanceof TransientFetchError && existsSync(config.cacheFile)) {
+      console.error(`${e.message} Using the cached copy at ${config.cacheFile} from ${new Date(statSync(config.cacheFile).mtimeMs).toISOString()}.`);
+      return readFileSync(config.cacheFile) as unknown as Buffer;
+    }
+    throw e;
+  }
   const arrayBuffer = await response.arrayBuffer();
   const data = Buffer.from(arrayBuffer);
 

package/src/components/cli-support.ts

@@ -39,7 +39,7 @@ import {
   type DriverRunResult,
 } from "./driver";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
-import type { GateLedgerPort } from "../op/gate";
+import type { GateDigestMismatch, GateLedgerPort } from "../op/gate";
 import { gateName } from "../op/gate-name";
 import { isLexiconPlugin, type LexiconPlugin, type ComponentPipelineOptions } from "../lexicon";
 import type { RunProgressEvent } from "./run-progress";
@@ -432,6 +432,8 @@ export interface RunComponentsResult {
     /** Whether this run's own append reached the remote (#2310); absent when the pending fact was already standing. */
     pushed?: boolean;
     pushWarning?: string;
+    /** Set when an approval stands for this gate, but for another plan or none (#2574). */
+    mismatch?: GateDigestMismatch;
   };
   /** This run's resolved build-time parameters (chant #1108) — the component-driver counterpart of `../cli/commands/build.ts`'s `BuildResult.buildParams`. Present only once the run actually reached dispatch (mirrors `BuildResult.buildParams`, which is likewise absent on an early-error return). */
   buildParams?: BuildParamProvenance[];
@@ -584,6 +586,7 @@ export async function runComponents(
                 gate: run.gate,
                 ...(run.gatePushed !== undefined ? { pushed: run.gatePushed } : {}),
                 ...(run.gatePushWarning ? { pushWarning: run.gatePushWarning } : {}),
+                ...(run.gateMismatch ? { mismatch: run.gateMismatch } : {}),
               },
             }
           : {}),
@@ -632,6 +635,7 @@ export async function runComponents(
             gate: componentResult.gate,
             ...(componentResult.gatePushed !== undefined ? { gatePushed: componentResult.gatePushed } : {}),
             ...(componentResult.gatePushWarning ? { gatePushWarning: componentResult.gatePushWarning } : {}),
+            ...(componentResult.gateMismatch ? { gateMismatch: componentResult.gateMismatch } : {}),
           }
         : {}),
       componentOutputs,
@@ -648,6 +652,7 @@ export async function runComponents(
               gate: componentResult.gate,
               ...(componentResult.gatePushed !== undefined ? { pushed: componentResult.gatePushed } : {}),
               ...(componentResult.gatePushWarning ? { pushWarning: componentResult.gatePushWarning } : {}),
+              ...(componentResult.gateMismatch ? { mismatch: componentResult.gateMismatch } : {}),
             },
           }
         : {}),

package/src/components/discover.test.ts

@@ -280,76 +280,46 @@ describe("discoverComponents", () => {
     expect(result.errors.some((e) => e.type === "import")).toBe(true);
   });
 
-  test("the first chant.config.ts encountered becomes the source root and is still scanned", async () => {
-    // Matches findInfraFiles's own rule: the *first* config directory found
-    // becomes `sourceRoot` and is descended into, same as any other
-    // directory — the skip only applies to a *second* nested config found
-    // after that (see the next test).
-    const childDir = join(testDir, "child-project");
-    await mkdir(childDir, { recursive: true });
-    await writeFile(join(childDir, "chant.config.ts"), `export default {};`);
-    await writeFile(
-      join(childDir, "child.component.ts"),
-      `
-        export const childSvc = {
-          name: "child-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
-    await writeFile(
-      join(testDir, "root.component.ts"),
-      `
-        export const rootSvc = {
-          name: "root-svc",
+  const svc = (exportName: string, name: string) => `
+        export const ${exportName} = {
+          name: "${name}",
           dependsOn: [],
           deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
         };
-      `,
-    );
+      `;
 
-    const result = await discoverComponents(testDir);
-
-    expect(result.components.has("root-svc")).toBe(true);
-    expect(result.components.has("child-svc")).toBe(true);
-  });
-
-  test("a second nested chant.config.ts (a true child project) is not descended into", async () => {
+  test("from outside every project, every child project is read (#2527)", async () => {
+    // The source-root quirk is gone: no child config is special for being
+    // found first. The scan root has no config at or above it, so every
+    // child project's components are discovered, nested ones included.
     const firstConfigDir = join(testDir, "first-config");
     const nestedChildProject = join(firstConfigDir, "nested-child-project");
     await mkdir(nestedChildProject, { recursive: true });
     await writeFile(join(firstConfigDir, "chant.config.ts"), `export default {};`);
     await writeFile(join(nestedChildProject, "chant.config.ts"), `export default {};`);
-    await writeFile(
-      join(firstConfigDir, "first.component.ts"),
-      `
-        export const firstSvc = {
-          name: "first-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
-    await writeFile(
-      join(nestedChildProject, "nested.component.ts"),
-      `
-        export const nestedSvc = {
-          name: "nested-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
+    await writeFile(join(testDir, "root.component.ts"), svc("rootSvc", "root-svc"));
+    await writeFile(join(firstConfigDir, "first.component.ts"), svc("firstSvc", "first-svc"));
+    await writeFile(join(nestedChildProject, "nested.component.ts"), svc("nestedSvc", "nested-svc"));
 
     const result = await discoverComponents(testDir);
 
-    // first-config/ has no config above it, so it becomes the source root
-    // and is scanned; nested-child-project/'s own chant.config.ts is the
-    // *second* config encountered, so it is treated as a separate project
-    // scope and not descended into.
+    expect(result.components.has("root-svc")).toBe(true);
     expect(result.components.has("first-svc")).toBe(true);
-    expect(result.components.has("nested-svc")).toBe(false);
+    expect(result.components.has("nested-svc")).toBe(true);
+  });
+
+  test("from inside a project, a child project is a boundary (#2527)", async () => {
+    const childDir = join(testDir, "child-project");
+    await mkdir(childDir, { recursive: true });
+    await writeFile(join(testDir, "chant.config.ts"), `export default {};`);
+    await writeFile(join(childDir, "chant.config.ts"), `export default {};`);
+    await writeFile(join(testDir, "root.component.ts"), svc("rootSvc", "root-svc"));
+    await writeFile(join(childDir, "child.component.ts"), svc("childSvc", "child-svc"));
+
+    const result = await discoverComponents(testDir);
+
+    expect(result.components.has("root-svc")).toBe(true);
+    expect(result.components.has("child-svc")).toBe(false);
   });
 
   // ── chant #1108 — build-time parameters populated before import ────────────

package/src/components/discover.ts

@@ -40,18 +40,16 @@
  * `./component.ts`, already proves the plain-JSON round-trip).
  */
 
-import { readdir } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { existsSync } from "node:fs";
 import { DiscoveryError } from "../errors";
 import { isComponent, type Component } from "./component";
 import type { BuildParamProvenance } from "../provenance";
 import { buildParamValues } from "../build-params";
 import { setBuildParams } from "../params";
-import { compileDiscoveryFilter, hasDiscoveryMarker } from "../discovery/files";
+import { hasDiscoveryMarkerSync } from "../discovery/files";
 import { resolveDiscoveryGlobs } from "../config";
-import { warnDiscoveryChanges } from "../discovery/convergence";
+import { walkDiscovery, workspaceMemberDirs } from "../discovery/walk";
 
 /** One discovered component, paired with the file it was exported from. */
 export interface DiscoveredComponent {
@@ -118,77 +116,24 @@ export interface ImportedComponentModule {
 }
 
 /**
- * Recursively find every `*.component.ts` file under `path`, the same
- * child-project boundary rule `findInfraFiles` (`../discovery/files.ts`)
- * uses: a subdirectory with its own `chant.config.ts` is a separate scope
- * once the outer project's own source root has been established. The
- * project's `exclude`/`include` globs and the skip marker apply here as they
- * do there (#2519).
+ * Every `*.component.ts` file under `path`, through the one discovery walk
+ * (`../discovery/walk.ts`, #2527): the same dot-directory, `dist`,
+ * git-ignore and child-project rules as source discovery, the project's
+ * `exclude`/`include` globs and the skip marker (#2519). Scanned from outside
+ * any project, every child project is read.
  */
 async function findComponentFiles(path: string): Promise<string[]> {
-  const files: string[] = [];
-  let sourceRoot: string | null = null;
-  const skip = compileDiscoveryFilter(await resolveDiscoveryGlobs(path));
-  const skippedChildren: string[] = [];
-
-  async function scanDirectory(dir: string): Promise<void> {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-
-    for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-
-      if (entry.isDirectory()) {
-        // Skip dependency and tool/VCS directories: component sources never live
-        // in them, and descending in is both wasted work and a correctness bug —
-        // e.g. a CI runner like gitlab-ci-local stages a copy of the project
-        // under `.gitlab-ci-local/`, which discovery would otherwise pick up as
-        // duplicate component names alongside the originals.
-        if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-
-        const configPath = join(fullPath, "chant.config.ts");
-        if (existsSync(configPath)) {
-          if (sourceRoot === null) {
-            sourceRoot = fullPath;
-          } else {
-            skippedChildren.push(fullPath);
-            continue;
-          }
-        }
-        await scanDirectory(fullPath);
-      } else if (
-        entry.isFile() &&
-        entry.name.endsWith(".component.ts") &&
-        !entry.name.endsWith(".test.component.ts") &&
-        !entry.name.endsWith(".spec.component.ts") &&
-        !skip?.(fullPath) &&
-        !(await hasDiscoveryMarker(fullPath))
-      ) {
-        files.push(fullPath);
-      }
-    }
-  }
-
-  await scanDirectory(path);
-  // #2527's warning release: the list returned is today's, unchanged.
-  await warnDiscoveryChanges({
+  return walkDiscovery({
     walker: "components",
     root: path,
-    files,
-    sourceRoot,
-    skippedChildren,
-    fileOk: async (name, full) =>
+    globs: await resolveDiscoveryGlobs(path),
+    excludeDirs: await workspaceMemberDirs(path),
+    accept: (name, full) =>
       name.endsWith(".component.ts") &&
       !name.endsWith(".test.component.ts") &&
       !name.endsWith(".spec.component.ts") &&
-      !skip?.(full) &&
-      !(await hasDiscoveryMarker(full)),
+      !hasDiscoveryMarkerSync(full),
   });
-  return files;
 }
 
 /**