@metaobjectsdev/sdk 0.23.2 → 0.24.1

package/dist/metadata-files.js

@@ -0,0 +1,155 @@
+// server/typescript/packages/sdk/src/metadata-files.ts
+//
+// The project's default directory names, what counts as a metadata file, and
+// the one walk that turns a directory into an ordered file list.
+//
+// **This module imports nothing from its siblings, and that is the point.**
+// `resolveCollection` (`collection.ts`) is the single authority on where
+// metadata lives, so `memory.ts`'s `loadMemory` must call it — while
+// `collection.ts` and `sources.ts` need the constants and the walk below.
+// Homing those in `memory.ts` closes an ESM cycle whose failure mode is not a
+// warning but a crash: `DEFAULT_SOURCES` (`sources.ts`) reads
+// `DEFAULT_METADATA_DIR` at module top level, so the cycle surfaces as
+// `ReferenceError: Cannot access 'DEFAULT_METADATA_DIR' before initialization`
+// on whichever module the entry point happens to reach first. A leaf both
+// sides import is the fix; a lazy `await import()` inside `loadMemory` is not
+// — that hides the cycle rather than removing it.
+import { extname, join } from "node:path";
+import { readdir, realpath, stat } from "node:fs/promises";
+/**
+ * The DEFAULT value of `sources` — the directory scanned when
+ * `.metaobjects/config.json` declares no sources. Scaffold via `meta init`;
+ * the directory is committed to git.
+ *
+ * **A default, and nothing else.** No read path may assume a directory of this
+ * name exists or is where metadata lives: that question is answered by
+ * `resolveCollection`, which applies this constant exactly once (via
+ * `DEFAULT_SOURCES` in `sources.ts`) when a project declares nothing. A
+ * project that declares `sources` may put its metadata anywhere, and every
+ * command follows the config. `test/no-hardcoded-metadata-dir.test.ts` is the
+ * enforcer.
+ */
+export const DEFAULT_METADATA_DIR = "metaobjects";
+/**
+ * Default directory name (relative to project root) for MetaObjects' own
+ * runtime state: config.json, .gen-state/, package.meta.json, agent docs.
+ * Scaffold via `meta init`; most contents are committed to git.
+ *
+ * Unlike {@link DEFAULT_METADATA_DIR} this one IS a fixed convention — it is
+ * where the config that answers "where is the metadata?" lives, so it cannot
+ * itself be configured.
+ */
+export const DEFAULT_METAOBJECTS_DIR = ".metaobjects";
+/** Recognized metadata file extensions, matched case-insensitively — mirrors
+ *  `DirectorySource` in `@metaobjectsdev/metadata`, which checks
+ *  `extname().toLowerCase()`. The single definition every metadata-file
+ *  walker in this package uses — and since `resolveSources` (`sources.ts`)
+ *  calls {@link listMetadataFiles} outright rather than keeping a second
+ *  recursive walk of its own, there is exactly one walker to keep honest. */
+export const METADATA_EXTENSIONS = new Set([".json", ".yaml", ".yml"]);
+export function isMetadataFile(name) {
+    return METADATA_EXTENSIONS.has(extname(name).toLowerCase());
+}
+/** Directory excluded at every level of {@link listMetadataFiles} — drafts
+ *  that are deliberately not part of the loaded model. */
+const PENDING_DIR = "_pending";
+/**
+ * Recursively list metadata files (*.json, *.yaml, *.yml, matched
+ * case-insensitively — see `isMetadataFile` above) under a directory,
+ * excluding _pending/ at any level. Subdirectories (e.g. projections/) are
+ * walked depth-first. Files within a directory are sorted alphabetically for
+ * deterministic load order; subdirectories are visited AFTER the files at the
+ * same level.
+ *
+ * That per-level rule is a contract, not an implementation detail. This is the
+ * order production has always handed the loader, and declaration order survives
+ * into generated output: `codegen-ts`'s barrel emits from `root.objects()`
+ * order, and so do the shared `enums.ts`, `meta docs` page ordering and `meta
+ * export`'s `canonicalSerialize` sibling order. A flat lexicographic sort of
+ * absolute paths is NOT the same list — it disagrees whenever a subdirectory
+ * name sorts before a sibling file (`common/` before `meta.users.json`) — so
+ * `resolveSources` calls this function rather than re-walking and re-sorting.
+ * Pinned by `test/source-order.test.ts`.
+ *
+ * Exported for that gate and for `sources.ts`; not re-exported from the package
+ * index — `resolveCollection` is the public door.
+ *
+ * An entry whose `stat` fails (a dangling symlink, a TOCTOU removal between
+ * `readdir` and `stat`, an EACCES entry) is SKIPPED, matching `DirectorySource`
+ * in `@metaobjectsdev/metadata`, which this walk otherwise mirrors. A failure to
+ * read the directory itself still throws — that is the "you have no metadata
+ * here" case callers report.
+ *
+ * A symlink CYCLE (e.g. `metaobjects/link -> ..`) is a loud error rather than
+ * unbounded recursion — see {@link listMetadataFilesGuarded}.
+ *
+ * Format selection (parsing) happens downstream in `FileSource` from
+ * `@metaobjectsdev/metadata`, which infers the parser from file extension.
+ */
+export async function listMetadataFiles(dir) {
+    return listMetadataFilesGuarded(dir, new Set());
+}
+/**
+ * {@link listMetadataFiles}'s recursive worker, carrying the REAL (symlink-
+ * resolved) ancestor directories already on this walk branch.
+ *
+ * This walk follows symlinked directories on purpose (`stat`, not `lstat`,
+ * below — matching `DirectorySource` in `@metaobjectsdev/metadata`), so an
+ * unguarded directory symlink that revisits an ancestor recurses forever:
+ * Java and Python both added this exact guard when this PR promoted
+ * symlink-following to a cross-port contract; the TypeScript reference itself
+ * did not, even though the corpus cites it as authoritative. `ancestors` is
+ * extended only on the recursive call (never mutated in place), so it
+ * reflects the current branch, not siblings visited earlier at the same
+ * level — a directory legitimately reachable via two different symlinked
+ * paths (not a cycle) is not falsely rejected.
+ */
+async function listMetadataFilesGuarded(dir, ancestors) {
+    // `realpath` failing (e.g. `dir` vanished between being listed and now) is
+    // not this guard's problem — fall back to the given path and let `readdir`
+    // below raise its own coded error.
+    const real = await realpath(dir).catch(() => dir);
+    if (ancestors.has(real)) {
+        throw new Error(`symlink loop detected while expanding metadata directory: ${dir} revisits ${real}`);
+    }
+    const nextAncestors = new Set(ancestors);
+    nextAncestors.add(real);
+    let entries;
+    try {
+        entries = await readdir(dir);
+    }
+    catch (err) {
+        throw new Error(`cannot read metadata directory ${dir}: ${err.message}`);
+    }
+    const paths = [];
+    const subdirs = [];
+    // #188: sort the raw `readdir` entries so file order is deterministic across
+    // runtimes/filesystems (Node vs Bun return different `readdir` orders), matching
+    // this function's docstring and the metadata package's own `DirectorySource`.
+    // (Resolution is now order-INDEPENDENT — super-resolve.ts #188 — so this is the
+    // deterministic-enumeration FLOOR, not the fix; it keeps every derived artifact
+    // that preserves declaration order, e.g. serialization, stable across runtimes.)
+    for (const entry of [...entries].sort()) {
+        if (entry === PENDING_DIR)
+            continue;
+        const full = join(dir, entry);
+        // `stat` (not `lstat`/`Dirent.isDirectory()`) so a symlinked subdirectory is
+        // traversed — `DirectorySource` has always followed symlinks this way.
+        const s = await stat(full).catch(() => undefined);
+        if (s === undefined)
+            continue;
+        if (s.isDirectory()) {
+            subdirs.push(full);
+        }
+        else if (s.isFile() && isMetadataFile(entry)) {
+            paths.push(full);
+        }
+    }
+    // Recurse into subdirectories after collecting files at this level.
+    // `subdirs` is already in sorted order (built from the sorted `entries` above).
+    for (const sub of subdirs) {
+        paths.push(...(await listMetadataFilesGuarded(sub, nextAncestors)));
+    }
+    return paths;
+}
+//# sourceMappingURL=metadata-files.js.map

package/dist/metadata-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-files.js","sourceRoot":"","sources":["../src/metadata-files.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,8EAA8E;AAC9E,8DAA8D;AAC9D,uEAAuE;AACvE,+EAA+E;AAC/E,0EAA0E;AAC1E,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD;;;;;6EAK6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;0DAC0D;AAC1D,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,OAAO,wBAAwB,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,wBAAwB,CAAC,GAAW,EAAE,SAA8B;IACjF,2EAA2E;IAC3E,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6DAA6D,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,6EAA6E;IAC7E,iFAAiF;IACjF,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,WAAW;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,gFAAgF;IAChF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,wBAAwB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/records/any.d.ts

@@ -127,6 +127,7 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     scope: z.ZodUnion<[z.ZodLiteral<"global">, z.ZodArray<z.ZodString, "many">]>;
 }, "strip", z.ZodTypeAny, {
     type: "decision";
+    scope: string[] | "global";
     schema_version: 1;
     id: string;
     title: string;
@@ -141,7 +142,6 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     }[];
     rationale: string;
     alternatives_considered: string[];
-    scope: string[] | "global";
     superseded_by?: string | undefined;
     evidence?: {
         commits?: string[] | undefined;
@@ -150,6 +150,7 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     } | undefined;
 }, {
     type: "decision";
+    scope: string[] | "global";
     schema_version: 1;
     id: string;
     title: string;
@@ -159,7 +160,6 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     last_validated_against_commit: string;
     rationale: string;
     alternatives_considered: string[];
-    scope: string[] | "global";
     superseded_by?: string | undefined;
     evidence?: {
         commits?: string[] | undefined;
@@ -216,6 +216,7 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     enforcement: z.ZodDefault<z.ZodEnum<["advisory", "block"]>>;
 }, "strip", z.ZodTypeAny, {
     type: "principle";
+    scope: string[];
     schema_version: 1;
     id: string;
     title: string;
@@ -230,7 +231,6 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     }[];
     examples: string[];
     rationale: string;
-    scope: string[];
     statement: string;
     counter_examples: string[];
     enforcement: "advisory" | "block";
@@ -242,6 +242,7 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     } | undefined;
 }, {
     type: "principle";
+    scope: string[];
     schema_version: 1;
     id: string;
     title: string;
@@ -251,7 +252,6 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     last_validated_against_commit: string;
     examples: string[];
     rationale: string;
-    scope: string[];
     statement: string;
     counter_examples: string[];
     superseded_by?: string | undefined;
@@ -310,11 +310,11 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         entity: z.ZodOptional<z.ZodString>;
         files: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
-        entity?: string | undefined;
         files?: string[] | undefined;
-    }, {
         entity?: string | undefined;
+    }, {
         files?: string[] | undefined;
+        entity?: string | undefined;
     }>;
     see_also: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -335,8 +335,8 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     synonyms: string[];
     definition: string;
     code_anchors: {
-        entity?: string | undefined;
         files?: string[] | undefined;
+        entity?: string | undefined;
     };
     see_also: string[];
     superseded_by?: string | undefined;
@@ -358,8 +358,8 @@ export declare const AnyRecord: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     synonyms: string[];
     definition: string;
     code_anchors: {
-        entity?: string | undefined;
         files?: string[] | undefined;
+        entity?: string | undefined;
     };
     see_also: string[];
     superseded_by?: string | undefined;

package/dist/records/decision.d.ts

@@ -41,6 +41,7 @@ export declare const DecisionRecord: z.ZodObject<{
     scope: z.ZodUnion<[z.ZodLiteral<"global">, z.ZodArray<z.ZodString, "many">]>;
 }, "strip", z.ZodTypeAny, {
     type: "decision";
+    scope: string[] | "global";
     schema_version: 1;
     id: string;
     title: string;
@@ -55,7 +56,6 @@ export declare const DecisionRecord: z.ZodObject<{
     }[];
     rationale: string;
     alternatives_considered: string[];
-    scope: string[] | "global";
     superseded_by?: string | undefined;
     evidence?: {
         commits?: string[] | undefined;
@@ -64,6 +64,7 @@ export declare const DecisionRecord: z.ZodObject<{
     } | undefined;
 }, {
     type: "decision";
+    scope: string[] | "global";
     schema_version: 1;
     id: string;
     title: string;
@@ -73,7 +74,6 @@ export declare const DecisionRecord: z.ZodObject<{
     last_validated_against_commit: string;
     rationale: string;
     alternatives_considered: string[];
-    scope: string[] | "global";
     superseded_by?: string | undefined;
     evidence?: {
         commits?: string[] | undefined;

package/dist/records/glossary.d.ts

@@ -43,11 +43,11 @@ export declare const GlossaryRecord: z.ZodObject<{
         entity: z.ZodOptional<z.ZodString>;
         files: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
-        entity?: string | undefined;
         files?: string[] | undefined;
-    }, {
         entity?: string | undefined;
+    }, {
         files?: string[] | undefined;
+        entity?: string | undefined;
     }>;
     see_also: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -68,8 +68,8 @@ export declare const GlossaryRecord: z.ZodObject<{
     synonyms: string[];
     definition: string;
     code_anchors: {
-        entity?: string | undefined;
         files?: string[] | undefined;
+        entity?: string | undefined;
     };
     see_also: string[];
     superseded_by?: string | undefined;
@@ -91,8 +91,8 @@ export declare const GlossaryRecord: z.ZodObject<{
     synonyms: string[];
     definition: string;
     code_anchors: {
-        entity?: string | undefined;
         files?: string[] | undefined;
+        entity?: string | undefined;
     };
     see_also: string[];
     superseded_by?: string | undefined;

package/dist/records/principle.d.ts

@@ -44,6 +44,7 @@ export declare const PrincipleRecord: z.ZodObject<{
     enforcement: z.ZodDefault<z.ZodEnum<["advisory", "block"]>>;
 }, "strip", z.ZodTypeAny, {
     type: "principle";
+    scope: string[];
     schema_version: 1;
     id: string;
     title: string;
@@ -58,7 +59,6 @@ export declare const PrincipleRecord: z.ZodObject<{
     }[];
     examples: string[];
     rationale: string;
-    scope: string[];
     statement: string;
     counter_examples: string[];
     enforcement: "advisory" | "block";
@@ -70,6 +70,7 @@ export declare const PrincipleRecord: z.ZodObject<{
     } | undefined;
 }, {
     type: "principle";
+    scope: string[];
     schema_version: 1;
     id: string;
     title: string;
@@ -79,7 +80,6 @@ export declare const PrincipleRecord: z.ZodObject<{
     last_validated_against_commit: string;
     examples: string[];
     rationale: string;
-    scope: string[];
     statement: string;
     counter_examples: string[];
     superseded_by?: string | undefined;

package/dist/scope.d.ts

@@ -0,0 +1,16 @@
+/** A consumer-side output filter over fully-qualified node names. */
+export interface Scope {
+    /** Absent or empty means "everything". */
+    readonly include?: readonly string[];
+    /** Applied after `include`. */
+    readonly exclude?: readonly string[];
+}
+export interface CompiledScope {
+    readonly include: readonly RegExp[];
+    readonly exclude: readonly RegExp[];
+}
+export declare function compilePattern(pattern: string): RegExp;
+export declare function compileScope(scope: Scope): CompiledScope;
+/** True when `fqn` is inside the scope. An empty `include` means everything. */
+export declare function matchesScope(fqn: string, compiled: CompiledScope): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAkBA,qEAAqE;AACrE,MAAM,WAAW,KAAK;IACpB,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAuCD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYtD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,aAAa,CAKxD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAI1E"}

package/dist/scope.js

@@ -0,0 +1,75 @@
+// server/typescript/packages/sdk/src/scope.ts
+//
+// Phase-1 metadata-source-resolution — the scope pattern engine.
+//
+// A pure, no-I/O module deciding whether a fully-qualified node name falls
+// inside a consumer's declared `include`/`exclude` scope. Source resolution
+// and discovery (later phase-1 tasks) build on this; a cross-language
+// conformance corpus pins its semantics, so exact pattern behavior matters.
+// NOTE: PACKAGE_SEPARATOR is NOT re-exported from the browser-safe
+// `@metaobjectsdev/metadata/constants` barrel (that barrel only re-exports
+// the per-concern `*-constants.ts` modules; `PACKAGE_SEPARATOR` lives in
+// `shared/structural.ts`, exported from the package root). This package
+// (`@metaobjectsdev/sdk`) is server-side, not a `client/web/**` browser
+// package, so importing metamodel values from the root — the same thing
+// `memory.ts` and `forge-types.ts` in this package already do — is correct.
+import { PACKAGE_SEPARATOR, ParseError, codeSource } from "@metaobjectsdev/metadata";
+/** One package segment: any run of characters containing no separator char. */
+const SEGMENT = "[^:]+";
+/** One or more segments, separator-joined — the `**` expansion. */
+const SEGMENTS = `${SEGMENT}(?:${PACKAGE_SEPARATOR}${SEGMENT})*`;
+function escapeLiteral(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Compile one segment. `**` spans segments; `*` never crosses a separator. */
+function compileSegment(segment, pattern) {
+    if (segment.length === 0) {
+        throw new ParseError(`empty segment in scope pattern "${pattern}"`, {
+            code: "ERR_SCOPE_PATTERN_INVALID",
+            source: codeSource("compileSegment"),
+        });
+    }
+    // A segment surviving the split on the two-character PACKAGE_SEPARATOR
+    // ("::") can still contain a lone ":" when the pattern has an odd colon
+    // run — e.g. "acme:::Order".split("::") => ["acme", ":Order"]. SEGMENT
+    // ([^:]+) already excludes ":" from a well-formed segment, so a leftover
+    // ":" here means the separator was malformed, not that ":" is meant
+    // literally. Left unchecked, escapeLiteral treats it as a literal
+    // character and compiles a regex requiring three colons in a row — which
+    // no legal "::"-joined fully-qualified name can ever contain, so the
+    // pattern silently matches nothing instead of failing loud.
+    if (segment.includes(":")) {
+        throw new ParseError(`scope pattern "${pattern}" has a malformed separator (an odd run of ":") — segments are joined by "::", never a single ":"`, { code: "ERR_SCOPE_PATTERN_INVALID", source: codeSource("compileSegment") });
+    }
+    if (segment === "**")
+        return `(?:${SEGMENTS})`;
+    // `*` inside a segment matches any characters except the separator char.
+    return segment.split("*").map(escapeLiteral).join("[^:]*");
+}
+export function compilePattern(pattern) {
+    if (pattern.length === 0) {
+        throw new ParseError(`scope pattern must not be empty`, {
+            code: "ERR_SCOPE_PATTERN_INVALID",
+            source: codeSource("compilePattern"),
+        });
+    }
+    const body = pattern
+        .split(PACKAGE_SEPARATOR)
+        .map((segment) => compileSegment(segment, pattern))
+        .join(PACKAGE_SEPARATOR);
+    return new RegExp(`^${body}$`);
+}
+export function compileScope(scope) {
+    return {
+        include: (scope.include ?? []).map(compilePattern),
+        exclude: (scope.exclude ?? []).map(compilePattern),
+    };
+}
+/** True when `fqn` is inside the scope. An empty `include` means everything. */
+export function matchesScope(fqn, compiled) {
+    const included = compiled.include.length === 0 || compiled.include.some((re) => re.test(fqn));
+    if (!included)
+        return false;
+    return !compiled.exclude.some((re) => re.test(fqn));
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAE5E,mEAAmE;AACnE,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAerF,+EAA+E;AAC/E,MAAM,OAAO,GAAG,OAAO,CAAC;AACxB,mEAAmE;AACnE,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,iBAAiB,GAAG,OAAO,IAAI,CAAC;AAEjE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,mCAAmC,OAAO,GAAG,EAAE;YAClE,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,kEAAkE;IAClE,yEAAyE;IACzE,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAClB,kBAAkB,OAAO,mGAAmG,EAC5H,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,QAAQ,GAAG,CAAC;IAC/C,yEAAyE;IACzE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iCAAiC,EAAE;YACtD,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO;SACjB,KAAK,CAAC,iBAAiB,CAAC;SACxB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SAClD,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAY;IACvC,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAuB;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/sources.d.ts

@@ -0,0 +1,86 @@
+/** Tagged union of source kinds. `resource` and `package` are declared now so
+ *  the config shape is stable across phases; only `path` resolves in phase 1 —
+ *  `resource`/`package` throw `ERR_SOURCE_KIND_UNSUPPORTED`. */
+export type SourceSpec = {
+    readonly path: string;
+} | {
+    readonly resource: string;
+} | {
+    readonly package: string;
+};
+export interface ResolvedSource {
+    /** Absolute path of one metadata file. */
+    readonly file: string;
+    /** The spec that contributed it — provenance for diagnostics. */
+    readonly spec: SourceSpec;
+}
+/** Used when `sources` is absent or empty in `.metaobjects/config.json`. A
+ *  DEFAULT, never a requirement — a project that declares `sources` explicitly
+ *  need not include the default directory at all. Built from
+ *  `DEFAULT_METADATA_DIR` (`metadata-files.ts`'s single definition) rather than
+ *  restating that name here: a second independent encoding of the same
+ *  default would let `resolveCollection`'s "does the default dir exist"
+ *  check (`collection.ts`) desync from what `resolveSources` actually
+ *  resolves the moment the default ever changed — silently reproducing the
+ *  "two code paths disagree about where metadata lives" class of bug this
+ *  whole mechanism exists to eliminate. */
+export declare const DEFAULT_SOURCES: readonly SourceSpec[];
+/**
+ * The declared source SET in CANONICAL order — kind-validated, then sorted by
+ * spec CONTENT rather than by declaration order.
+ *
+ * This is the ONE place declaration order is discarded, and the module's "pure
+ * function of the SET" invariant rests on it: the emitted file order, the spec
+ * attributed to a file two specs both reach, and which of several unresolvable
+ * paths reports its `ERR_SOURCE_UNRESOLVED` first are all decided here.
+ * Validation runs across the WHOLE list before any sorting or filesystem I/O —
+ * interleaved with resolution, which error code came back would depend on
+ * declaration order, contradicting that same invariant.
+ *
+ * Exported because `resolveCollection` derives `sourceRoots` from the declared
+ * specs and must use this identical ordering; a second sort would be a second
+ * definition of "canonical".
+ */
+export declare function orderedPathSpecs(specs: readonly SourceSpec[]): {
+    readonly path: string;
+}[];
+/**
+ * Where a declared `path` source lives on disk: absolute as written, otherwise
+ * relative to the DECLARING config's directory — never to ambient
+ * `process.cwd()`.
+ *
+ * One definition, because this expression *is* the rule for where a declared
+ * source lives, which is the single piece of knowledge this module exists to
+ * own. A caller that needs a source's root directory (rather than its files)
+ * calls this rather than restating it.
+ */
+export declare function resolveSpecPath(configDir: string, spec: {
+    readonly path: string;
+}): string;
+/**
+ * Resolve a declared source SET to a canonically-ordered list of metadata files.
+ *
+ * The full result — each entry's `.file` AND its `.spec` — is a pure function
+ * of the SET of `specs`: permuting `specs` cannot change the output. One thing
+ * makes that hold: the specs are processed in CONTENT order
+ * (`JSON.stringify(spec)`, ascending) rather than declared order, so both the
+ * emitted file order and the spec attributed to a file overlapping two specs
+ * are decided by content alone. Declared order carries no information anywhere
+ * in this function.
+ *
+ * Within one directory spec the file order is `listMetadataFiles`'s — files at
+ * a level, then that level's subdirectories, depth-first. That is deliberately
+ * NOT a flat sort of absolute paths: see the file header, and
+ * `test/source-order.test.ts`.
+ *
+ * Only `path` specs resolve in phase 1: a directory is walked recursively, a
+ * file is taken as-is. An unresolvable `path` throws `ERR_SOURCE_UNRESOLVED`
+ * rather than silently contributing nothing; `resource`/`package` specs throw
+ * `ERR_SOURCE_KIND_UNSUPPORTED`.
+ *
+ * @param configDir absolute directory of the declaring config (the parent of
+ *   `.metaobjects/`) — relative `path` specs resolve against it, never against
+ *   ambient `process.cwd()`.
+ */
+export declare function resolveSources(configDir: string, specs: readonly SourceSpec[]): Promise<ResolvedSource[]>;
+//# sourceMappingURL=sources.d.ts.map

package/dist/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../src/sources.ts"],"names":[],"mappings":"AA2BA;;gEAEgE;AAChE,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED;;;;;;;;;2CAS2C;AAC3C,eAAO,MAAM,eAAe,EAAE,SAAS,UAAU,EAAqC,CAAC;AAgBvF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAK1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,UAAU,EAAE,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC,CA0B3B"}