reverseport 0.0.0-stage → 1.2.0

package/dist/application/ReconstructionObligationOriginalCases.js

@@ -0,0 +1,34 @@
+import { evidenceSupportsOriginalAuthority } from "./ReconstructionObligationAuthority.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+/** Merge generated and manifest-supplied original observations canonically. */
+export const originalCasesFor = (candidate, binding) => [
+    ...new Map([...candidate.observed_cases, ...(binding?.original_cases ?? [])].map((observed) => [
+        `${observed.kind}:${observed.evidence_id}:${observed.location}`,
+        observed,
+    ])).values(),
+].sort((left, right) => compareUnicodeCodePoints(`${left.kind}:${left.evidence_id}:${left.location}`, `${right.kind}:${right.evidence_id}:${right.location}`));
+/** Report original cases that are absent or lack comparable Evidence authority. */
+export const originalCaseDiagnostics = (candidate, binding, evidenceById) => {
+    const diagnostics = [];
+    const originalCases = originalCasesFor(candidate, binding);
+    for (const caseKind of candidate.required_case_kinds) {
+        const cases = originalCases.filter(({ kind }) => kind === caseKind);
+        if (cases.length === 0) {
+            diagnostics.push({
+                code: "missing-original-case",
+                detail: `Original ${caseKind} behavior has not been observed.`,
+            });
+            continue;
+        }
+        if (!cases.some(({ evidence_id: evidenceId }) => {
+            const evidence = evidenceById.get(evidenceId);
+            return (evidence !== undefined &&
+                evidenceSupportsOriginalAuthority(evidence, candidate.required_original_authority));
+        }))
+            diagnostics.push({
+                code: "weak-original-case-authority",
+                detail: `Original ${caseKind} behavior lacks ${candidate.required_original_authority} Evidence.`,
+            });
+    }
+    return diagnostics;
+};

package/dist/application/ReconstructionObligationPolicies.js

@@ -0,0 +1,132 @@
+const APPLICATION_NODE_POLICIES = {
+    package: policy("packaging", "package-lifecycle", "packaged-process", [
+        "positive",
+        "negative",
+        "teardown",
+    ]),
+    installer: policy("packaging", "installer", "packaged-process", [
+        "positive",
+        "negative",
+        "teardown",
+    ]),
+    "context-bridge-api": policy("electron", "context-bridge", "renderer", [
+        "positive",
+        "negative",
+        "malformed",
+    ]),
+    "ipc-channel": policy("electron", "ipc", "renderer", [
+        "positive",
+        "negative",
+        "malformed",
+    ]),
+    "ipc-handler": policy("electron", "ipc", "renderer", [
+        "positive",
+        "negative",
+        "malformed",
+    ]),
+    endpoint: policy("protocol", "endpoint", "protocol", [
+        "positive",
+        "negative",
+        "malformed",
+    ]),
+    storage: policy("persistence", "persistence", "integration", [
+        "positive",
+        "negative",
+        "malformed",
+    ]),
+    worker: policy("process", "worker-lifecycle", "packaged-process", [
+        "positive",
+        "cancellation",
+        "teardown",
+    ]),
+    "service-worker": policy("process", "worker-lifecycle", "packaged-process", [
+        "positive",
+        "cancellation",
+        "teardown",
+    ]),
+    "native-addon": nativePolicy("native-addon"),
+    "native-export": nativePolicy("native-export"),
+    "managed-pinvoke-import": nativePolicy("managed-pinvoke"),
+    "managed-native-implementation": nativePolicy("managed-native"),
+};
+const SEMANTIC_NODE_POLICIES = {
+    "child-process": policy("process", "child-process", "packaged-process", [
+        "positive",
+        "negative",
+        "cancellation",
+        "teardown",
+    ]),
+    stdio: policy("process", "stdio", "packaged-process", [
+        "positive",
+        "negative",
+        "teardown",
+    ]),
+    signal: policy("process", "signal", "packaged-process", [
+        "positive",
+        "cancellation",
+        "teardown",
+    ]),
+    "config-source": parserPolicy("cli", "configuration", "integration"),
+    request: parserPolicy("protocol", "request", "protocol"),
+    response: parserPolicy("protocol", "response", "protocol"),
+    boundary: parserPolicy("application", "parser-boundary", "integration"),
+    resource: policy("persistence", "resource-lifecycle", "integration", [
+        "positive",
+        "negative",
+        "teardown",
+    ]),
+    event: policy("runtime", "event", "packaged-process", [
+        "positive",
+        "negative",
+        "cancellation",
+    ]),
+    timer: policy("runtime", "timer", "packaged-process", [
+        "positive",
+        "cancellation",
+        "teardown",
+    ]),
+    promise: policy("runtime", "promise-ownership", "packaged-process", [
+        "positive",
+        "negative",
+        "cancellation",
+    ]),
+    task: policy("runtime", "task-lifecycle", "packaged-process", [
+        "positive",
+        "cancellation",
+        "teardown",
+    ]),
+};
+export const applicationObligationPolicy = (nodeKind) => APPLICATION_NODE_POLICIES[nodeKind];
+export const semanticObligationPolicy = (nodeKind) => SEMANTIC_NODE_POLICIES[nodeKind];
+function policy(applicationLayer, family, authority, cases) {
+    return {
+        applicationLayer,
+        family,
+        fixtureAuthority: authority,
+        verifierAuthority: authority,
+        originalAuthority: "runtime",
+        cases,
+        requiresParserType: false,
+    };
+}
+function parserPolicy(applicationLayer, family, authority) {
+    return {
+        ...policy(applicationLayer, family, authority, [
+            "positive",
+            "negative",
+            "malformed",
+        ]),
+        requiresParserType: true,
+    };
+}
+function nativePolicy(family) {
+    return {
+        applicationLayer: "native-abi",
+        family,
+        fixtureAuthority: "native-abi",
+        verifierAuthority: "native-abi",
+        originalAuthority: "static",
+        cases: ["positive", "negative"],
+        requiresParserType: false,
+    };
+}

package/dist/application/ReferenceSourceImport.js

@@ -0,0 +1,200 @@
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+import { createHistoricalSourceGraph, historicalSourceLanguages, historicalSourceManifests, historicalSourceParseFailureKey, } from "../domain/referenceSourceGraph.js";
+import { err, ok } from "../domain/result.js";
+import { readReferenceSource } from "../reference/ReferenceSourceReader.js";
+import { parseReferenceSourceEntries } from "./ReferenceSourceImportEntries.js";
+import { readReferenceSourceVcs } from "./ReferenceSourceVcsAdapter.js";
+import { prepareReferenceSourceImport, } from "./ReferenceSourceImportPolicy.js";
+const failure = (code, message) => ({
+    tag: "reference-source-import",
+    code,
+    message,
+});
+const cancelled = (partial) => ({
+    ...failure("cancelled", "Reference source import cancelled"),
+    ...(partial === undefined ? {} : { partial }),
+});
+const isAborted = (signal) => signal?.aborted === true;
+const relationshipKey = (relationship) => `${relationship.from_path}\u0000${relationship.to}\u0000${relationship.kind}\u0000${relationship.resolution}\u0000${relationship.parse_state}`;
+const deduplicateRelationships = (relationships) => {
+    const seen = new Set();
+    const result = [];
+    for (const relationship of relationships) {
+        const key = relationshipKey(relationship);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(relationship);
+    }
+    return result;
+};
+/** Sort parse failures deterministically while retaining distinct reasons. */
+export const normalizeHistoricalSourceParseFailures = (failures) => [...failures]
+    .sort((left, right) => compareUnicodeCodePoints(historicalSourceParseFailureKey(left), historicalSourceParseFailureKey(right)))
+    .filter((value, index, array) => {
+    if (index === 0)
+        return true;
+    const previous = array[index - 1];
+    return (previous === undefined ||
+        historicalSourceParseFailureKey(value) !==
+            historicalSourceParseFailureKey(previous));
+});
+const buildProvenance = (options) => ({
+    importer: options.importer ?? "rea-reference-source-import",
+    importer_version: options.importerVersion ?? null,
+    caller: options.caller,
+});
+const deriveInventoryState = (input) => {
+    if (input.limitations.length > 0)
+        return "partial";
+    if (input.exclusions.length > 0)
+        return "partial";
+    if (input.parse_failures.length > 0)
+        return "partial";
+    const partialEntry = input.entries.some((entry) => entry.limitations.length > 0 ||
+        (entry.kind === "file" && entry.content_state !== "hashed") ||
+        (entry.kind === "directory" && entry.tree_state !== "enumerated") ||
+        (entry.kind === "symlink" && entry.target_state !== "internal"));
+    if (partialEntry)
+        return "partial";
+    const partialRelationship = input.relationships.some(({ parse_state, resolution }) => parse_state !== "parsed" ||
+        ["unresolved", "unknown"].includes(resolution));
+    if (partialRelationship)
+        return "partial";
+    return "complete";
+};
+const sortExclusions = (exclusions) => [...exclusions].sort((left, right) => {
+    const byPath = compareUnicodeCodePoints(left.path, right.path);
+    if (byPath !== 0)
+        return byPath;
+    const byReason = compareUnicodeCodePoints(left.reason, right.reason);
+    if (byReason !== 0)
+        return byReason;
+    return compareUnicodeCodePoints("pattern" in left ? left.pattern : "", "pattern" in right ? right.pattern : "");
+});
+const createShouldExclude = (exclusions, secrets, ignored) => (path, kind) => {
+    const patternPath = kind === "directory" ? `${path}/` : path;
+    const secretMatch = secrets.test(patternPath);
+    if (secretMatch.ignored) {
+        if (!secretMatch.rule)
+            throw new Error(`Ignored secret path has no matching rule: ${path}`);
+        exclusions.push({
+            path,
+            reason: "configured-secret",
+            pattern: secretMatch.rule.pattern,
+        });
+        return true;
+    }
+    const match = ignored.test(patternPath);
+    if (!match.ignored)
+        return false;
+    if (!match.rule)
+        throw new Error(`Ignored path has no matching rule: ${path}`);
+    const reason = match.rule.mark;
+    if (reason !== "project-ignored" &&
+        reason !== "default-ignored" &&
+        reason !== "caller-excluded")
+        throw new Error(`Ignored path has unknown rule origin: ${path}`);
+    exclusions.push({ path, reason, pattern: match.rule.pattern });
+    return true;
+};
+/**
+ * Import a reference source directory into a committed historical source graph.
+ *
+ * The import is deterministic, parallel-safe, and never executes source, hooks,
+ * git subprocesses, or network requests. Paths explicitly excluded by the
+ * caller's reference-source policy are omitted from the graph.
+ */
+export const importReferenceSource = async (options, resources) => {
+    if (isAborted(options.signal))
+        return err(cancelled());
+    const prepared = await prepareReferenceSourceImport(options, resources);
+    if (!prepared.ok)
+        return prepared;
+    const { ignored, root, secrets } = prepared.value;
+    if (isAborted(options.signal))
+        return err(cancelled());
+    const exclusions = [];
+    const shouldExclude = createShouldExclude(exclusions, secrets, ignored);
+    const [readResult, vcsResult] = await Promise.all([
+        readReferenceSource(root, resources, {
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+            shouldExclude,
+        }),
+        readReferenceSourceVcs(root, resources, options.signal),
+    ]);
+    if (!readResult.ok)
+        return err(combineReadFailures(readResult.error, vcsResult.ok ? undefined : vcsResult.error, readResult.error.partial));
+    if (!vcsResult.ok)
+        return err(combineReadFailures(vcsResult.error, undefined, readResult.value));
+    const vcs = vcsResult.value;
+    if (isAborted(options.signal))
+        return err(cancelled(readResult.value));
+    const read = readResult.value;
+    const filePaths = new Set(read.entries
+        .filter((entry) => entry.status === "read" && entry.kind === "file")
+        .map((entry) => entry.path));
+    const { entries, relationships, parseFailures, limitations } = parseReferenceSourceEntries(read, filePaths, options.signal);
+    if (isAborted(options.signal))
+        return err(cancelled(read));
+    const uniqueRelationships = deduplicateRelationships(relationships);
+    const uniqueFailures = normalizeHistoricalSourceParseFailures(parseFailures);
+    const sortedEntries = [...entries].sort((left, right) => compareUnicodeCodePoints(left.path, right.path));
+    const sortedExclusions = sortExclusions(exclusions);
+    const sortedLimitations = [...limitations].sort(compareUnicodeCodePoints);
+    const input = {
+        schema: "HistoricalSourceGraph",
+        authority: "historical-reference",
+        root_alias: "$REFERENCE_ROOT",
+        inventory_state: deriveInventoryState({
+            entries: sortedEntries,
+            relationships: uniqueRelationships,
+            parse_failures: uniqueFailures,
+            exclusions: sortedExclusions,
+            limitations: sortedLimitations,
+        }),
+        entries: sortedEntries,
+        relationships: uniqueRelationships.sort((left, right) => compareUnicodeCodePoints(relationshipKey(left), relationshipKey(right))),
+        parse_failures: uniqueFailures,
+        exclusions: sortedExclusions,
+        languages: historicalSourceLanguages(sortedEntries),
+        manifests: historicalSourceManifests(sortedEntries),
+        vcs,
+        provenance: buildProvenance(options),
+        limitations: sortedLimitations,
+    };
+    try {
+        return ok(createHistoricalSourceGraph(input));
+    }
+    catch (cause) {
+        return err(failure("parse", cause instanceof Error ? cause.message : "Graph failed validation"));
+    }
+};
+const combineReadFailures = (primary, other, partial) => {
+    const code = primary.code === "cancelled" || other?.code === "cancelled"
+        ? "cancelled"
+        : primary.code;
+    const cleanup = mergeCleanup(primary.cleanup, other?.cleanup);
+    const message = other === undefined
+        ? primary.message
+        : `${primary.message}; additional reference metadata failure: ${other.message}`;
+    const cause = other === undefined
+        ? primary.cause
+        : new AggregateError([primary, other], "Reference source inventory and metadata both failed", { cause: primary });
+    return {
+        ...failure(code, message),
+        ...(cleanup === undefined ? {} : { cleanup }),
+        ...(partial === undefined ? {} : { partial }),
+        ...(cause === undefined ? {} : { cause }),
+    };
+};
+const mergeCleanup = (first, second) => {
+    if (first === undefined)
+        return second;
+    if (second === undefined)
+        return first;
+    return {
+        reason: `${first.reason}; ${second.reason}`,
+        resources: [...new Set([...first.resources, ...second.resources])],
+    };
+};

package/dist/application/ReferenceSourceImportEntries.js

@@ -0,0 +1,151 @@
+import { createHash } from "node:crypto";
+import { posix } from "node:path";
+import { logicalPathEscapesRoot } from "../domain/artifactIdentity.js";
+import { createReferenceSourcePathLookup, isPortableAbsoluteReferenceTarget, } from "../domain/referenceSourcePathIdentity.js";
+import { classifyReferenceSourcePath, detectReferenceSourceLanguage, } from "../domain/referenceSourceClassification.js";
+import { parseReferenceSourceImports } from "../domain/referenceSourceImportParsing.js";
+import { PARSEABLE_REFERENCE_SOURCE_LANGUAGES } from "./ReferenceSourceImportTypes.js";
+import { typescriptEmittedSourceCandidates } from "./TypeScriptEmittedSourceCandidates.js";
+/** Preserve the observed reader failure and add entry-specific recovery guidance. */
+export const projectReferenceSourceEntryFailure = (entry) => `${entry.message} ${entryRecoveryGuidance(entry)}`;
+const entryRecoveryGuidance = (entry) => {
+    if (entry.code === "cancelled")
+        return "This entry was not read because the import was cancelled. Start the import again when ready.";
+    if (entry.code === "unsupported")
+        return "Exclude this entry or replace it with a regular file.";
+    if (entry.kind === "directory")
+        return "This directory could not be read. Check its permissions, then try again.";
+    if (entry.kind === "symlink")
+        return "This symbolic link could not be read safely. Check the link and its permissions, then try again.";
+    return "This file could not be read. Check its permissions, then try again.";
+};
+const hashBytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const failedEntry = (entry) => {
+    const classifications = classifyReferenceSourcePath(entry.path);
+    const limitation = projectReferenceSourceEntryFailure(entry);
+    if (entry.kind === "directory")
+        return {
+            path: entry.path,
+            kind: "directory",
+            classifications,
+            tree_state: "unreadable",
+            limitations: [limitation],
+        };
+    if (entry.kind === "symlink")
+        return {
+            path: entry.path,
+            kind: "symlink",
+            target: null,
+            target_state: "unreadable",
+            classifications,
+            limitations: [limitation],
+        };
+    return {
+        path: entry.path,
+        kind: "file",
+        sha256: null,
+        size: entry.size ?? null,
+        language: null,
+        classifications: entry.kind === "file" ? classifications : ["unknown"],
+        content_state: "unreadable",
+        limitations: [limitation],
+    };
+};
+const resolveInternalSpecifier = (fromPath, specifier, lookupPath) => {
+    if (posix.isAbsolute(specifier))
+        return { to: specifier, resolution: "unresolved" };
+    const normalized = posix.normalize(posix.join(posix.dirname(fromPath), specifier));
+    if (logicalPathEscapesRoot(normalized))
+        return { to: normalized, resolution: "unresolved" };
+    const suffixes = ["", ".ts", ".js", ".mjs", ".cjs", ".tsx", ".jsx"];
+    const candidates = suffixes.flatMap((suffix) => [
+        `${normalized}${suffix}`,
+        `${normalized}/index${suffix}`,
+    ]);
+    // Retain present runtime files first; substitute only a missing counterpart.
+    // Counterparts cover explicit filenames, not directory/index resolution.
+    candidates.push(...typescriptEmittedSourceCandidates(fromPath, normalized));
+    const match = lookupPath.resolveCandidates(candidates);
+    return match === undefined
+        ? { to: normalized, resolution: "unresolved" }
+        : { to: match, resolution: "internal" };
+};
+const appendFile = (entry, lookupPath, output) => {
+    const language = detectReferenceSourceLanguage(entry.path);
+    output.entries.push({
+        path: entry.path,
+        kind: "file",
+        sha256: hashBytes(entry.bytes),
+        size: entry.size,
+        language,
+        classifications: classifyReferenceSourcePath(entry.path),
+        content_state: "hashed",
+        limitations: [],
+    });
+    if (language === null || !PARSEABLE_REFERENCE_SOURCE_LANGUAGES.has(language))
+        return;
+    const parsed = parseReferenceSourceImports(entry.path, entry.bytes, language);
+    for (const relationship of parsed.relationships) {
+        if (relationship.resolution !== "internal") {
+            output.relationships.push(relationship);
+            continue;
+        }
+        const resolved = resolveInternalSpecifier(relationship.from_path, relationship.to, lookupPath);
+        output.relationships.push({
+            ...relationship,
+            to: resolved.to,
+            resolution: resolved.resolution,
+        });
+    }
+    output.parseFailures.push(...parsed.parse_failures);
+};
+const appendReadEntry = (entry, lookupPath, output) => {
+    if (entry.kind === "file") {
+        appendFile(entry, lookupPath, output);
+        return;
+    }
+    const classifications = classifyReferenceSourcePath(entry.path);
+    if (entry.kind === "directory") {
+        output.entries.push({
+            path: entry.path,
+            kind: "directory",
+            classifications,
+            tree_state: "enumerated",
+            limitations: [],
+        });
+        return;
+    }
+    output.entries.push({
+        path: entry.path,
+        kind: "symlink",
+        // The reader resolves inventory identities from its root; the persisted
+        // graph represents relative symlink targets from the link's directory.
+        target: entry.targetState === "internal" ||
+            (entry.targetState === "missing" &&
+                !isPortableAbsoluteReferenceTarget(entry.target))
+            ? posix.relative(posix.dirname(entry.path), entry.target) || "."
+            : entry.target,
+        target_state: entry.targetState,
+        classifications,
+        limitations: [],
+    });
+};
+/** Convert bounded reader observations into graph entries and parsed edges. */
+export const parseReferenceSourceEntries = (read, filePaths, signal) => {
+    const output = {
+        entries: [],
+        relationships: [],
+        parseFailures: [],
+        limitations: [...read.limitations],
+    };
+    const lookupPath = createReferenceSourcePathLookup(filePaths);
+    for (const entry of read.entries) {
+        if (signal?.aborted === true)
+            break;
+        if (entry.status === "failed")
+            output.entries.push(failedEntry(entry));
+        else
+            appendReadEntry(entry, lookupPath, output);
+    }
+    return output;
+};

package/dist/application/ReferenceSourceImportPolicy.js

@@ -0,0 +1,125 @@
+import { lstat, realpath, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import ignore from "ignore";
+import { readRegularFileText, RegularFileCleanupFailure, retryRegularFileCleanup, } from "./RegularFileRead.js";
+import { err, ok } from "../domain/result.js";
+import { ArtifactReaderFailure } from "../artifacts/ArtifactReader.js";
+import { DEFAULT_REFERENCE_SOURCE_IGNORE_PATTERNS, } from "./ReferenceSourceImportTypes.js";
+import { rootFilesystemFailure } from "../reference/ReferenceSourceReaderErrors.js";
+const failure = (code, message) => ({
+    tag: "reference-source-import",
+    code,
+    message,
+});
+const isAborted = (signal) => signal?.aborted === true;
+const addMarkedPatterns = (matcher, patterns, mark) => {
+    for (const pattern of patterns)
+        for (const line of pattern.split(/\r?\n/u))
+            matcher.add({ pattern: line, mark });
+};
+const resolveRoot = async (requestedRoot, signal) => {
+    if (isAborted(signal))
+        return err(failure("cancelled", "Reference source import cancelled"));
+    try {
+        const metadata = await stat(requestedRoot);
+        if (isAborted(signal))
+            return err(failure("cancelled", "Reference source import cancelled"));
+        if (!metadata.isDirectory())
+            return err(failure("invalid-root", `Reference source root is not a directory: ${requestedRoot}`));
+        const canonicalRoot = await realpath(resolve(requestedRoot));
+        if (isAborted(signal))
+            return err(failure("cancelled", "Reference source import cancelled"));
+        return ok(canonicalRoot);
+    }
+    catch (cause) {
+        if (isAborted(signal))
+            return err(failure("cancelled", "Reference source import cancelled"));
+        const rootFailure = rootFilesystemFailure(cause, "Reference source root could not be resolved");
+        if (rootFailure === undefined)
+            throw cause;
+        return err({ ...failure(rootFailure.code, rootFailure.message), cause });
+    }
+};
+const buildIgnored = async (root, excludePaths, resources, signal) => {
+    const ignored = ignore();
+    const policyPath = join(root, ".gitignore");
+    let present = true;
+    try {
+        await lstat(policyPath);
+    }
+    catch (cause) {
+        if (!(typeof cause === "object" &&
+            cause !== null &&
+            "code" in cause &&
+            cause.code === "ENOENT"))
+            throw cause;
+        present = false;
+    }
+    signal?.throwIfAborted();
+    if (present) {
+        let text;
+        try {
+            text = await readRegularFileText(policyPath, { signal });
+        }
+        catch (cause) {
+            if (!(cause instanceof RegularFileCleanupFailure))
+                throw cause;
+            const retry = await retryRegularFileCleanup(cause, resources);
+            if (retry.cleanup !== undefined) {
+                const primary = cause.outcome.kind === "failed"
+                    ? cause.outcome.cause
+                    : cause.cleanupCause;
+                return err({
+                    ...failure(signal?.aborted === true ? "cancelled" : "io", `Reference source ignore policy could not be read at ${policyPath}: ${errorMessage(primary)}`),
+                    cleanup: retry.cleanup,
+                    cause: primary,
+                });
+            }
+            if (retry.outcome.kind === "failed")
+                throw retry.outcome.cause;
+            text = retry.outcome.value;
+        }
+        addMarkedPatterns(ignored, [text], "project-ignored");
+    }
+    addMarkedPatterns(ignored, DEFAULT_REFERENCE_SOURCE_IGNORE_PATTERNS, "default-ignored");
+    for (const path of excludePaths) {
+        addMarkedPatterns(ignored, [path, `${path}/`], "caller-excluded");
+    }
+    return ok(ignored);
+};
+/** Resolve the caller-selected directory and build path filters. */
+export const prepareReferenceSourceImport = async (options, resources) => {
+    try {
+        return await resources.run(async () => {
+            const root = await resolveRoot(options.root, options.signal);
+            if (!root.ok)
+                return root;
+            try {
+                const ignored = await buildIgnored(root.value, options.excludePaths ?? [], resources, options.signal);
+                if (!ignored.ok)
+                    return ignored;
+                return ok({
+                    root: root.value,
+                    ignored: ignored.value,
+                    secrets: ignore().add([...options.policy.secretPatterns]),
+                });
+            }
+            catch (cause) {
+                return err({
+                    ...failure(options.signal?.aborted === true ? "cancelled" : "io", `Reference source ignore policy could not be read at ${join(root.value, ".gitignore")}: ${errorMessage(cause)}`),
+                    cause,
+                });
+            }
+        });
+    }
+    catch (cause) {
+        if (!(cause instanceof ArtifactReaderFailure))
+            throw cause;
+        return err({
+            ...failure(cause.reason === "cancelled" ? "cancelled" : "io", cause.message),
+            ...(cause.cleanup === undefined ? {} : { cleanup: cause.cleanup }),
+            cause,
+        });
+    }
+};
+const errorMessage = (cause) => cause instanceof Error ? cause.message : String(cause);