@metaobjectsdev/sdk 0.23.2 → 0.24.1

package/src/discovery.ts

@@ -0,0 +1,110 @@
+// server/typescript/packages/sdk/src/discovery.ts
+//
+// Phase-1 metadata-source-resolution — nearest-ancestor collection discovery.
+//
+// Walks up from a starting directory to find the nearest directory that IS a
+// project root. This is what makes a CLI *contextual*: run it inside an app in
+// a monorepo and it finds that app's configuration rather than the repo root's.
+//
+// Three properties are load-bearing.
+//
+// 1. **One marker.** A directory is a project root when it carries
+//    `.metaobjects/config.json`, and on no other evidence. A directory that
+//    merely *holds* metadata is not a project boundary: where metadata lives is
+//    the `sources` key's answer, and `metaobjects/` is only that key's default
+//    value. Stopping on a bare `metaobjects/` directory would put a second
+//    definition of "where metadata lives" back into the walk — the exact
+//    duplication `resolveCollection` exists to be the only instance of — and it
+//    would ignore a project whose config points its `sources` somewhere else
+//    entirely. See design §4.6.1.
+// 2. **Nearest wins** — the walk returns on the FIRST directory carrying the
+//    marker, so a config in a subdirectory beats one in an ancestor.
+// 3. **The walk stops at a repository boundary** (`.git`), so a monorepo
+//    checkout can never silently adopt a *parent checkout's* configuration. The
+//    marker check runs BEFORE the `.git` check within each directory —
+//    reversed, a root-level project (where `.git` also lives) would be
+//    unreachable from any subdirectory, since the boundary would stop the walk
+//    one directory too early.
+import { stat } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { CONFIG_FILE } from "./config.js";
+import { DEFAULT_METAOBJECTS_DIR } from "./metadata-files.js";
+
+const GIT_DIR = ".git";
+
+/** Exported for reuse — `collection.ts` had its own byte-identical copy
+ *  (`fileExists`); one definition, imported. */
+export async function exists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** `exists`, narrowed to directories — `collection.ts`'s default-source probe
+ *  needs that distinction to raise its friendlier `ERR_COLLECTION_NOT_FOUND`
+ *  (a plain FILE where the default source directory should be is not a
+ *  metadata home). Lives here beside `exists` so there is one filesystem
+ *  predicate pair in the package rather than a copy per caller. */
+export async function isDir(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** Where the discovery walk stopped, and what it found there. */
+export interface DiscoveredRoot {
+  /** The project root the walk settled on. Always absolute; falls back to the
+   *  resolved start directory when the walk found no marker at all. */
+  readonly dir: string;
+  /** Whether `dir` carries `.metaobjects/config.json`. False only on the
+   *  no-marker fallback, where the DEFAULT sources apply. */
+  readonly hasConfig: boolean;
+}
+
+/**
+ * Walk up from `startDir` for the nearest project root — a directory holding
+ * `.metaobjects/config.json`, and nothing else (see the file header). The walk
+ * stops after examining a directory that contains `.git`, so a monorepo can
+ * never silently adopt a parent checkout's configuration.
+ *
+ * Never fails: with no config anywhere below the boundary it reports the
+ * resolved `startDir` with `hasConfig: false`, which is what
+ * `resolveCollection` turns into either the default source or
+ * `ERR_COLLECTION_NOT_FOUND`.
+ */
+export async function discoverCollectionRoot(startDir: string): Promise<DiscoveredRoot> {
+  const start = resolve(startDir);
+  let dir = start;
+  for (;;) {
+    if (await exists(join(dir, DEFAULT_METAOBJECTS_DIR, CONFIG_FILE))) {
+      return { dir, hasConfig: true };
+    }
+    // Boundary check AFTER the marker check: a repo-root project (sharing its
+    // directory with `.git`) is still findable from any subdirectory.
+    if (await exists(join(dir, GIT_DIR))) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return { dir: start, hasConfig: false };
+}
+
+/**
+ * The directory whose configuration governs a run started in `startDir` — the
+ * `dir` half of {@link discoverCollectionRoot}.
+ *
+ * Exists as its own export for the callers that must NOT require metadata to
+ * exist: `meta migrate apply-pending` and `--rollback` replay committed SQL and
+ * load no model at all, so they resolve their `.metaobjects/` directory through
+ * this rather than through `resolveCollection`. Sharing the walk is the point —
+ * a second "find the project root" implementation is how the migrations
+ * directory and the metadata directory come to disagree.
+ */
+export async function resolveConfigDir(startDir: string): Promise<string> {
+  return (await discoverCollectionRoot(startDir)).dir;
+}

package/src/index.ts

@@ -76,17 +76,34 @@ export {
 } from "./forge-types.js";
 export type { ForgeType, ForgeAttr } from "./forge-types.js";
 
-// Memory loader — read metaobjects/ into a MetaData tree
-// (workspace-aware: walks extends: deps via pnpm-workspace.yaml or
-//  package.json workspaces field if present)
-export {
-  loadMemory,
-  defaultLoadMemoryProviders,
-  DEFAULT_METADATA_DIR,
-  DEFAULT_METAOBJECTS_DIR,
-} from "./memory.js";
+// Memory loader — read a project's resolved metadata into a MetaData tree.
+// Where those files come from is `resolveCollection`'s decision (below), which
+// `loadMemory` calls when the caller supplies no explicit file set.
+export { loadMemory, defaultLoadMemoryProviders } from "./memory.js";
 export type { LoadMemoryOptions } from "./memory.js";
 
+// Default project layout — the DEFAULT value of `sources` (applied by
+// `resolveCollection` alone) and the fixed directory holding the config that
+// declares them. Exported for `meta init`, which SCAFFOLDS that layout.
+export { DEFAULT_METADATA_DIR, DEFAULT_METAOBJECTS_DIR } from "./metadata-files.js";
+
+// Scope — output filter over fully-qualified node names
+export { compileScope, matchesScope } from "./scope.js";
+export type { Scope, CompiledScope } from "./scope.js";
+
+// Source resolution — a declared source SET to a canonically-sorted file list
+export { resolveSources, resolveSpecPath, orderedPathSpecs, DEFAULT_SOURCES } from "./sources.js";
+export type { SourceSpec, ResolvedSource } from "./sources.js";
+
+// Discovery — nearest-ancestor project root (a `.metaobjects/config.json`,
+// the only marker), bounded by the repo root
+export { discoverCollectionRoot, resolveConfigDir } from "./discovery.js";
+export type { DiscoveredRoot } from "./discovery.js";
+
+// Collection — the single authority on where a project's metadata lives
+export { resolveCollection } from "./collection.js";
+export type { Collection } from "./collection.js";
+
 // Workspace discovery — finds peer metadata packages in a monorepo
 export { discoverWorkspace, resolveExtendsOrder, packageLabel } from "./workspace.js";
 export type { Workspace, WorkspacePackage } from "./workspace.js";

package/src/memory.ts

@@ -1,5 +1,3 @@
-import { join } from "node:path";
-import { readdir, stat } from "node:fs/promises";
 import {
   composeRegistry,
   coreProviders,
@@ -8,21 +6,8 @@ import {
   type MetaRoot,
 } from "@metaobjectsdev/metadata";
 import { FileSource } from "@metaobjectsdev/metadata/core";
+import { resolveCollection } from "./collection.js";
 import { forgeTypesProvider } from "./forge-types.js";
-import { discoverWorkspace, resolveExtendsOrder } from "./workspace.js";
-
-/**
- * Default directory name (relative to project root) where metadata JSON files
- * are scanned. Scaffold via `meta init`; the directory is committed to git.
- */
-export const DEFAULT_METADATA_DIR = "metaobjects";
-
-/**
- * Default directory name (relative to project root) for MetaObjects' own
- * runtime state: config.json, .gen-state/, package.meta.json, agent docs.
- * Scaffold via `meta init`; most contents are committed to git.
- */
-export const DEFAULT_METAOBJECTS_DIR = ".metaobjects";
 
 /**
  * Options for {@link loadMemory}. Consumers can supply additional
@@ -50,6 +35,31 @@ export interface LoadMemoryOptions {
    * the `meta verify` command opts in to `true` (strict-by-default, #96).
    */
   strict?: boolean;
+  /**
+   * An already-resolved, absolute metadata file list — normally
+   * `resolveCollection(...).files`. When supplied, `loadMemory` loads exactly
+   * these files and resolves nothing itself.
+   *
+   * Omitting it is not a different WAY of finding metadata, only a different
+   * place the same resolution happens: `loadMemory` then calls
+   * `resolveCollection(repoRoot)` itself. Passing it saves the second
+   * resolution when the caller already holds a collection (every routed CLI
+   * command does) and lets a caller load a file set it computed some other
+   * way; it can no longer diverge from what the config declares.
+   */
+  files?: readonly string[];
+  /**
+   * MetaObjects-shipped library packages to load ALONGSIDE the project's own files
+   * (e.g. `["ai"]` for `metaobjects::ai::LlmCallBase`). Prepended, so an
+   * `extends: "metaobjects::ai::LlmCallBase"` in project metadata resolves.
+   *
+   * Opt-in rather than always-on: a library package registers real top-level nodes, and
+   * a project that never references one should not have them appear in its model, its
+   * generated output or its docs. Without this the CLI could not load the metadata that
+   * shipped generators like `trace-helper` exist to consume, so the generator was
+   * reachable from the command line while its input was not (#333).
+   */
+  libraries?: readonly string[];
 }
 
 /** Default provider bundle threaded by {@link loadMemory} when no options
@@ -62,10 +72,15 @@ export const defaultLoadMemoryProviders: readonly MetaDataTypeProvider[] = [
 ];
 
 /**
- * Load all metadata files from `<repoRoot>/metaobjects/` into a single
- * MetaData. If `<repoRoot>/.meta/package.meta.json` declares `extends:` deps
- * and a workspace can be discovered (pnpm-workspace.yaml or package.json
- * workspaces), peer packages are loaded too in topological dep-first order.
+ * Load a project's metadata into a single MetaData tree.
+ *
+ * Which files those are is `resolveCollection`'s decision, never this
+ * function's: with no {@link LoadMemoryOptions.files} it calls
+ * `resolveCollection(repoRoot)` — nearest-ancestor `.metaobjects/config.json`,
+ * then that config's declared `sources`, falling back to the default source
+ * directory only when a project declares none. `loadMemory` names no directory
+ * of its own, so a caller cannot end up loading from somewhere the rest of the
+ * toolchain does not.
  *
  * Excludes `_pending/`. Registers metaobjects core types plus Meta Forge's
  * descriptive top-level types (decision, principle, etc.) so mixed content
@@ -73,11 +88,15 @@ export const defaultLoadMemoryProviders: readonly MetaDataTypeProvider[] = [
  * {@link LoadMemoryOptions.providers}) are composed AFTER the defaults so
  * they may depend on core/forge ids.
  *
- * Throws if `metaobjects/` doesn't exist (callers should run `meta init`).
+ * Throws `ERR_COLLECTION_NOT_FOUND` when nothing resolves (callers should run
+ * `meta init`), unless `options.files` is supplied.
  *
- * @param repoRoot The project's working-directory root (e.g. process.cwd()).
- *   `loadMemory` resolves `metaobjects/` and (if workspace-aware) the
- *   transitive `extends:` graph automatically.
+ * @param repoRoot Where resolution STARTS — the working directory, typically
+ *   `process.cwd()`. The walk goes up from here for the governing config, so
+ *   this need not be the project root itself.
+ *   **Ignored entirely when `options.files` is supplied**: that list is already
+ *   resolved, so nothing reads this path. Every routed CLI command passes both,
+ *   and the argument is inert at all of them.
  * @param options Optional {@link LoadMemoryOptions} — supply additional
  *   providers or replace the default bundle entirely.
  */
@@ -99,16 +118,33 @@ export async function loadMemory(
   }
   const registry = composeRegistry(providers);
 
-  // Collect all metadata file paths to load. Order matters for the parser's
-  // deferred-resolution pass (it parses in array order, then resolves supers
-  // against the merged tree afterwards) — dep packages first, current last.
-  const paths = await collectMetadataPaths(repoRoot);
+  // Both arms are `resolveCollection`'s answer — one already computed by the
+  // caller, one computed here. There is no third way to find metadata, and
+  // that is the whole of this line's design: the previous no-`files` arm
+  // scanned `<repoRoot>/<default dir>` directly, so a caller that copied the
+  // routed shape but forgot `files` silently loaded from a directory the
+  // project's config may never have mentioned.
+  const paths = options?.files !== undefined
+    ? [...options.files]
+    : [...(await resolveCollection(repoRoot)).files];
 
   const loader = new MetaDataLoader({
     registry,
     ...(options?.strict === true ? { strict: true } : {}),
   });
-  const result = await loader.load(paths.map((p) => new FileSource(p)));
+
+  // Library sources are imported lazily and only when asked for — the same reason
+  // `MetaDataLoader.fromDirectory` does it. `library-sources.ts` reads `node:fs`, so a
+  // static import from a root-reachable module drags Node built-ins into every consumer's
+  // graph; that is the #287 bundle defect, and the `./library` subpath exists for exactly
+  // the reason `./constants` does. Prepended, so a project's `extends` onto a
+  // library-shipped abstract base resolves — super resolution is order-independent, but
+  // prepending is the deterministic choice and matches `fromDirectory`.
+  const libSources =
+    options?.libraries !== undefined && options.libraries.length > 0
+      ? (await import("@metaobjectsdev/metadata/library")).librarySources([...options.libraries])
+      : [];
+  const result = await loader.load([...libSources, ...paths.map((p) => new FileSource(p))]);
 
   if (result.errors.length > 0) {
     const first = result.errors[0]!;
@@ -117,73 +153,3 @@ export async function loadMemory(
 
   return result.root;
 }
-
-// Dep packages' metaobjects/ files first (topological order), then current.
-async function collectMetadataPaths(repoRoot: string): Promise<string[]> {
-  const currentMetaDir = join(repoRoot, ".meta");
-  const ws = await discoverWorkspace(repoRoot);
-
-  // Workspace path: walk extends, load dep metaobjects/ dirs first
-  if (ws !== undefined) {
-    const currentPkg = ws.packages.find((p) => p.metaDir === currentMetaDir);
-    if (currentPkg !== undefined && currentPkg.manifest.extends.length > 0) {
-      const ordered = resolveExtendsOrder(ws, currentMetaDir);
-      const paths: string[] = [];
-      for (const pkg of ordered) {
-        // Each workspace package's metadata lives alongside its .meta/ dir
-        const pkgRoot = join(pkg.metaDir, "..");
-        paths.push(...(await listMetadataFiles(join(pkgRoot, DEFAULT_METADATA_DIR))));
-      }
-      return paths;
-    }
-  }
-
-  // Single-package path: scan metaobjects/ at the project root
-  return listMetadataFiles(join(repoRoot, DEFAULT_METADATA_DIR));
-}
-
-/**
- * Recursively list metadata files (*.json, *.yaml, *.yml) under a directory,
- * excluding _pending/ at any level. Subdirectories (e.g. projections/) are
- * walked depth-first. Files within a directory are sorted alphabetically for
- * deterministic load order; subdirectories are visited after files at the
- * same level.
- *
- * Format selection (parsing) happens downstream in `FileSource` from
- * `@metaobjectsdev/metadata`, which infers the parser from file extension.
- */
-async function listMetadataFiles(dir: string): Promise<string[]> {
-  let entries: string[];
-  try {
-    entries = await readdir(dir);
-  } catch (err) {
-    throw new Error(`loadMemory: cannot read ${dir}: ${(err as Error).message}`);
-  }
-  const paths: string[] = [];
-  const subdirs: string[] = [];
-  // #188: sort the raw `readdir` entries so file order is deterministic across
-  // runtimes/filesystems (Node vs Bun return different `readdir` orders), matching
-  // this function's docstring and the metadata package's own `DirectorySource`.
-  // (Resolution is now order-INDEPENDENT — super-resolve.ts #188 — so this is the
-  // deterministic-enumeration FLOOR, not the fix; it keeps every derived artifact
-  // that preserves declaration order, e.g. serialization, stable across runtimes.)
-  for (const entry of [...entries].sort()) {
-    if (entry === "_pending") continue;
-    const full = join(dir, entry);
-    const s = await stat(full);
-    if (s.isDirectory()) {
-      subdirs.push(full);
-    } else if (s.isFile() && isMetadataFile(entry)) {
-      paths.push(full);
-    }
-  }
-  // Recurse into subdirectories after collecting files at this level
-  for (const sub of subdirs.sort()) {
-    paths.push(...(await listMetadataFiles(sub)));
-  }
-  return paths;
-}
-
-function isMetadataFile(name: string): boolean {
-  return name.endsWith(".json") || name.endsWith(".yaml") || name.endsWith(".yml");
-}

package/src/metadata-files.ts

@@ -0,0 +1,158 @@
+// server/typescript/packages/sdk/src/metadata-files.ts
+//
+// The project's default directory names, what counts as a metadata file, and
+// the one walk that turns a directory into an ordered file list.
+//
+// **This module imports nothing from its siblings, and that is the point.**
+// `resolveCollection` (`collection.ts`) is the single authority on where
+// metadata lives, so `memory.ts`'s `loadMemory` must call it — while
+// `collection.ts` and `sources.ts` need the constants and the walk below.
+// Homing those in `memory.ts` closes an ESM cycle whose failure mode is not a
+// warning but a crash: `DEFAULT_SOURCES` (`sources.ts`) reads
+// `DEFAULT_METADATA_DIR` at module top level, so the cycle surfaces as
+// `ReferenceError: Cannot access 'DEFAULT_METADATA_DIR' before initialization`
+// on whichever module the entry point happens to reach first. A leaf both
+// sides import is the fix; a lazy `await import()` inside `loadMemory` is not
+// — that hides the cycle rather than removing it.
+import { extname, join } from "node:path";
+import { readdir, realpath, stat } from "node:fs/promises";
+
+/**
+ * The DEFAULT value of `sources` — the directory scanned when
+ * `.metaobjects/config.json` declares no sources. Scaffold via `meta init`;
+ * the directory is committed to git.
+ *
+ * **A default, and nothing else.** No read path may assume a directory of this
+ * name exists or is where metadata lives: that question is answered by
+ * `resolveCollection`, which applies this constant exactly once (via
+ * `DEFAULT_SOURCES` in `sources.ts`) when a project declares nothing. A
+ * project that declares `sources` may put its metadata anywhere, and every
+ * command follows the config. `test/no-hardcoded-metadata-dir.test.ts` is the
+ * enforcer.
+ */
+export const DEFAULT_METADATA_DIR = "metaobjects";
+
+/**
+ * Default directory name (relative to project root) for MetaObjects' own
+ * runtime state: config.json, .gen-state/, package.meta.json, agent docs.
+ * Scaffold via `meta init`; most contents are committed to git.
+ *
+ * Unlike {@link DEFAULT_METADATA_DIR} this one IS a fixed convention — it is
+ * where the config that answers "where is the metadata?" lives, so it cannot
+ * itself be configured.
+ */
+export const DEFAULT_METAOBJECTS_DIR = ".metaobjects";
+
+/** Recognized metadata file extensions, matched case-insensitively — mirrors
+ *  `DirectorySource` in `@metaobjectsdev/metadata`, which checks
+ *  `extname().toLowerCase()`. The single definition every metadata-file
+ *  walker in this package uses — and since `resolveSources` (`sources.ts`)
+ *  calls {@link listMetadataFiles} outright rather than keeping a second
+ *  recursive walk of its own, there is exactly one walker to keep honest. */
+export const METADATA_EXTENSIONS = new Set([".json", ".yaml", ".yml"]);
+
+export function isMetadataFile(name: string): boolean {
+  return METADATA_EXTENSIONS.has(extname(name).toLowerCase());
+}
+
+/** Directory excluded at every level of {@link listMetadataFiles} — drafts
+ *  that are deliberately not part of the loaded model. */
+const PENDING_DIR = "_pending";
+
+/**
+ * Recursively list metadata files (*.json, *.yaml, *.yml, matched
+ * case-insensitively — see `isMetadataFile` above) under a directory,
+ * excluding _pending/ at any level. Subdirectories (e.g. projections/) are
+ * walked depth-first. Files within a directory are sorted alphabetically for
+ * deterministic load order; subdirectories are visited AFTER the files at the
+ * same level.
+ *
+ * That per-level rule is a contract, not an implementation detail. This is the
+ * order production has always handed the loader, and declaration order survives
+ * into generated output: `codegen-ts`'s barrel emits from `root.objects()`
+ * order, and so do the shared `enums.ts`, `meta docs` page ordering and `meta
+ * export`'s `canonicalSerialize` sibling order. A flat lexicographic sort of
+ * absolute paths is NOT the same list — it disagrees whenever a subdirectory
+ * name sorts before a sibling file (`common/` before `meta.users.json`) — so
+ * `resolveSources` calls this function rather than re-walking and re-sorting.
+ * Pinned by `test/source-order.test.ts`.
+ *
+ * Exported for that gate and for `sources.ts`; not re-exported from the package
+ * index — `resolveCollection` is the public door.
+ *
+ * An entry whose `stat` fails (a dangling symlink, a TOCTOU removal between
+ * `readdir` and `stat`, an EACCES entry) is SKIPPED, matching `DirectorySource`
+ * in `@metaobjectsdev/metadata`, which this walk otherwise mirrors. A failure to
+ * read the directory itself still throws — that is the "you have no metadata
+ * here" case callers report.
+ *
+ * A symlink CYCLE (e.g. `metaobjects/link -> ..`) is a loud error rather than
+ * unbounded recursion — see {@link listMetadataFilesGuarded}.
+ *
+ * Format selection (parsing) happens downstream in `FileSource` from
+ * `@metaobjectsdev/metadata`, which infers the parser from file extension.
+ */
+export async function listMetadataFiles(dir: string): Promise<string[]> {
+  return listMetadataFilesGuarded(dir, new Set());
+}
+
+/**
+ * {@link listMetadataFiles}'s recursive worker, carrying the REAL (symlink-
+ * resolved) ancestor directories already on this walk branch.
+ *
+ * This walk follows symlinked directories on purpose (`stat`, not `lstat`,
+ * below — matching `DirectorySource` in `@metaobjectsdev/metadata`), so an
+ * unguarded directory symlink that revisits an ancestor recurses forever:
+ * Java and Python both added this exact guard when this PR promoted
+ * symlink-following to a cross-port contract; the TypeScript reference itself
+ * did not, even though the corpus cites it as authoritative. `ancestors` is
+ * extended only on the recursive call (never mutated in place), so it
+ * reflects the current branch, not siblings visited earlier at the same
+ * level — a directory legitimately reachable via two different symlinked
+ * paths (not a cycle) is not falsely rejected.
+ */
+async function listMetadataFilesGuarded(dir: string, ancestors: ReadonlySet<string>): Promise<string[]> {
+  // `realpath` failing (e.g. `dir` vanished between being listed and now) is
+  // not this guard's problem — fall back to the given path and let `readdir`
+  // below raise its own coded error.
+  const real = await realpath(dir).catch(() => dir);
+  if (ancestors.has(real)) {
+    throw new Error(`symlink loop detected while expanding metadata directory: ${dir} revisits ${real}`);
+  }
+  const nextAncestors = new Set(ancestors);
+  nextAncestors.add(real);
+
+  let entries: string[];
+  try {
+    entries = await readdir(dir);
+  } catch (err) {
+    throw new Error(`cannot read metadata directory ${dir}: ${(err as Error).message}`);
+  }
+  const paths: string[] = [];
+  const subdirs: string[] = [];
+  // #188: sort the raw `readdir` entries so file order is deterministic across
+  // runtimes/filesystems (Node vs Bun return different `readdir` orders), matching
+  // this function's docstring and the metadata package's own `DirectorySource`.
+  // (Resolution is now order-INDEPENDENT — super-resolve.ts #188 — so this is the
+  // deterministic-enumeration FLOOR, not the fix; it keeps every derived artifact
+  // that preserves declaration order, e.g. serialization, stable across runtimes.)
+  for (const entry of [...entries].sort()) {
+    if (entry === PENDING_DIR) continue;
+    const full = join(dir, entry);
+    // `stat` (not `lstat`/`Dirent.isDirectory()`) so a symlinked subdirectory is
+    // traversed — `DirectorySource` has always followed symlinks this way.
+    const s = await stat(full).catch(() => undefined);
+    if (s === undefined) continue;
+    if (s.isDirectory()) {
+      subdirs.push(full);
+    } else if (s.isFile() && isMetadataFile(entry)) {
+      paths.push(full);
+    }
+  }
+  // Recurse into subdirectories after collecting files at this level.
+  // `subdirs` is already in sorted order (built from the sorted `entries` above).
+  for (const sub of subdirs) {
+    paths.push(...(await listMetadataFilesGuarded(sub, nextAncestors)));
+  }
+  return paths;
+}

package/src/scope.ts

@@ -0,0 +1,95 @@
+// server/typescript/packages/sdk/src/scope.ts
+//
+// Phase-1 metadata-source-resolution — the scope pattern engine.
+//
+// A pure, no-I/O module deciding whether a fully-qualified node name falls
+// inside a consumer's declared `include`/`exclude` scope. Source resolution
+// and discovery (later phase-1 tasks) build on this; a cross-language
+// conformance corpus pins its semantics, so exact pattern behavior matters.
+
+// NOTE: PACKAGE_SEPARATOR is NOT re-exported from the browser-safe
+// `@metaobjectsdev/metadata/constants` barrel (that barrel only re-exports
+// the per-concern `*-constants.ts` modules; `PACKAGE_SEPARATOR` lives in
+// `shared/structural.ts`, exported from the package root). This package
+// (`@metaobjectsdev/sdk`) is server-side, not a `client/web/**` browser
+// package, so importing metamodel values from the root — the same thing
+// `memory.ts` and `forge-types.ts` in this package already do — is correct.
+import { PACKAGE_SEPARATOR, ParseError, codeSource } from "@metaobjectsdev/metadata";
+
+/** A consumer-side output filter over fully-qualified node names. */
+export interface Scope {
+  /** Absent or empty means "everything". */
+  readonly include?: readonly string[];
+  /** Applied after `include`. */
+  readonly exclude?: readonly string[];
+}
+
+export interface CompiledScope {
+  readonly include: readonly RegExp[];
+  readonly exclude: readonly RegExp[];
+}
+
+/** One package segment: any run of characters containing no separator char. */
+const SEGMENT = "[^:]+";
+/** One or more segments, separator-joined — the `**` expansion. */
+const SEGMENTS = `${SEGMENT}(?:${PACKAGE_SEPARATOR}${SEGMENT})*`;
+
+function escapeLiteral(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Compile one segment. `**` spans segments; `*` never crosses a separator. */
+function compileSegment(segment: string, pattern: string): string {
+  if (segment.length === 0) {
+    throw new ParseError(`empty segment in scope pattern "${pattern}"`, {
+      code: "ERR_SCOPE_PATTERN_INVALID",
+      source: codeSource("compileSegment"),
+    });
+  }
+  // A segment surviving the split on the two-character PACKAGE_SEPARATOR
+  // ("::") can still contain a lone ":" when the pattern has an odd colon
+  // run — e.g. "acme:::Order".split("::") => ["acme", ":Order"]. SEGMENT
+  // ([^:]+) already excludes ":" from a well-formed segment, so a leftover
+  // ":" here means the separator was malformed, not that ":" is meant
+  // literally. Left unchecked, escapeLiteral treats it as a literal
+  // character and compiles a regex requiring three colons in a row — which
+  // no legal "::"-joined fully-qualified name can ever contain, so the
+  // pattern silently matches nothing instead of failing loud.
+  if (segment.includes(":")) {
+    throw new ParseError(
+      `scope pattern "${pattern}" has a malformed separator (an odd run of ":") — segments are joined by "::", never a single ":"`,
+      { code: "ERR_SCOPE_PATTERN_INVALID", source: codeSource("compileSegment") },
+    );
+  }
+  if (segment === "**") return `(?:${SEGMENTS})`;
+  // `*` inside a segment matches any characters except the separator char.
+  return segment.split("*").map(escapeLiteral).join("[^:]*");
+}
+
+export function compilePattern(pattern: string): RegExp {
+  if (pattern.length === 0) {
+    throw new ParseError(`scope pattern must not be empty`, {
+      code: "ERR_SCOPE_PATTERN_INVALID",
+      source: codeSource("compilePattern"),
+    });
+  }
+  const body = pattern
+    .split(PACKAGE_SEPARATOR)
+    .map((segment) => compileSegment(segment, pattern))
+    .join(PACKAGE_SEPARATOR);
+  return new RegExp(`^${body}$`);
+}
+
+export function compileScope(scope: Scope): CompiledScope {
+  return {
+    include: (scope.include ?? []).map(compilePattern),
+    exclude: (scope.exclude ?? []).map(compilePattern),
+  };
+}
+
+/** True when `fqn` is inside the scope. An empty `include` means everything. */
+export function matchesScope(fqn: string, compiled: CompiledScope): boolean {
+  const included = compiled.include.length === 0 || compiled.include.some((re) => re.test(fqn));
+  if (!included) return false;
+  return !compiled.exclude.some((re) => re.test(fqn));
+}