@withtruing/companion 0.13.2 → 0.14.0

package/dist/repository-provider.js

@@ -0,0 +1,608 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { resolve } from 'node:path';
+import { configuredManagedRepository, githubAuthEnvironment, githubCloneUrl, githubLabel, networkGitEnvironment, } from './managed-repo.js';
+import { checkRepositoryReadiness } from './local-scan.js';
+import { AttemptSourceError, } from './whole-read-temp.js';
+const SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+const MAX_LEASE_MS = 30 * 60_000;
+const COMMAND_TIMEOUT_MS = 120_000;
+const OUTPUT_LIMIT = 16 * 1024 * 1024;
+export class RepositoryProviderError extends Error {
+    code;
+    cleanup;
+    constructor(code, cleanup) {
+        super(code);
+        this.code = code;
+        this.cleanup = cleanup;
+        this.name = 'RepositoryProviderError';
+    }
+}
+class GitCommandFailure extends Error {
+}
+function runGitCommand(input) {
+    if (input.signal.aborted)
+        return Promise.reject(new GitCommandFailure());
+    return new Promise((resolveRun, rejectRun) => {
+        let child;
+        try {
+            child = spawn('git', [...input.args], {
+                cwd: input.cwd,
+                env: input.env,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                windowsHide: true,
+            });
+        }
+        catch {
+            rejectRun(new GitCommandFailure());
+            return;
+        }
+        const chunks = [];
+        let bytes = 0;
+        let settled = false;
+        let closeProcess;
+        const processClosed = new Promise((resolveClosed) => { closeProcess = resolveClosed; });
+        const unregisterReader = input.registerReader({
+            cancel: async () => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+                await processClosed;
+            },
+        });
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            input.signal.removeEventListener('abort', abort);
+            unregisterReader();
+            if (error)
+                rejectRun(error);
+            else
+                resolveRun({ stdout: Buffer.concat(chunks, bytes).toString('utf8') });
+        };
+        const stop = () => {
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL');
+        };
+        const abort = () => stop();
+        input.signal.addEventListener('abort', abort, { once: true });
+        child.stdout?.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > OUTPUT_LIMIT)
+                stop();
+            else
+                chunks.push(chunk);
+        });
+        // Git diagnostics can contain source paths or credentials, so they are drained, not retained.
+        child.stderr?.on('data', () => undefined);
+        child.on('error', () => {
+            closeProcess();
+            finish(new GitCommandFailure());
+        });
+        child.on('close', (code, signal) => {
+            closeProcess();
+            finish(code === 0 && signal === null && bytes <= OUTPUT_LIMIT
+                ? undefined : new GitCommandFailure());
+        });
+        const timeout = setTimeout(stop, COMMAND_TIMEOUT_MS);
+    });
+}
+function runReadinessProbe(cwd, args, env) {
+    return new Promise((resolveProbe, rejectProbe) => {
+        let child;
+        try {
+            child = spawn('git', [...args], {
+                cwd, env, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true,
+            });
+        }
+        catch {
+            rejectProbe(new GitCommandFailure());
+            return;
+        }
+        const chunks = [];
+        let bytes = 0;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            if (error)
+                rejectProbe(error);
+            else
+                resolveProbe(Buffer.concat(chunks, bytes).toString('utf8'));
+        };
+        child.stdout?.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > 64 * 1024) {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+            }
+            else {
+                chunks.push(chunk);
+            }
+        });
+        child.on('error', () => finish(new GitCommandFailure()));
+        child.on('close', (code, signal) => finish(code === 0 && signal === null && bytes <= 64 * 1024
+            ? undefined : new GitCommandFailure()));
+        const timeout = setTimeout(() => {
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL');
+            finish(new GitCommandFailure());
+        }, 15_000);
+    });
+}
+function validBranchSelector(branch) {
+    return branch.length > 0 && branch.length <= 255 && !branch.startsWith('-')
+        && !/[\x00-\x20\x7f~^:?*[\\]/.test(branch) && !branch.includes('..')
+        && !branch.includes('@{') && !branch.includes('//') && !branch.endsWith('/')
+        && branch.split('/').every((part) => part !== '' && !part.startsWith('.') && !part.endsWith('.lock'));
+}
+/** Bounded, non-interactive proof used by `connect --repo` before it records an identity. */
+export async function proveManagedRepositoryAccess(input, dependencies = {}) {
+    if (!input.credential)
+        throw new RepositoryProviderError('repository_access_denied');
+    if (input.branch !== undefined && !validBranchSelector(input.branch)) {
+        throw new RepositoryProviderError('repository_access_denied');
+    }
+    const source = (dependencies.managedRepositoryUrl ?? githubCloneUrl)(input.repository);
+    if (!source || source.startsWith('-') || source.includes('\0')) {
+        throw new RepositoryProviderError('repository_access_denied');
+    }
+    const environment = githubAuthEnvironment(input.credential);
+    const requested = input.branch ? `refs/heads/${input.branch}` : 'HEAD';
+    const args = ['ls-remote', '--symref', '--exit-code', source, requested];
+    dependencies.observeGit?.(args, environment);
+    let stdout;
+    try {
+        stdout = await runReadinessProbe(process.cwd(), args, environment);
+    }
+    catch {
+        throw new RepositoryProviderError('repository_access_denied');
+    }
+    const lines = stdout.trimEnd().split(/\r?\n/);
+    const objectLine = lines.find((line) => /^(?:[0-9a-f]{40}|[0-9a-f]{64})\t/.test(line)
+        && line.endsWith(`\t${requested}`));
+    if (!objectLine)
+        throw new RepositoryProviderError('repository_access_denied');
+    if (input.branch)
+        return { defaultBranch: input.branch };
+    const symref = lines.find((line) => line.startsWith('ref: refs/heads/') && line.endsWith('\tHEAD'));
+    const defaultBranch = symref?.slice('ref: refs/heads/'.length, -'\tHEAD'.length);
+    if (!defaultBranch || !validBranchSelector(defaultBranch)) {
+        throw new RepositoryProviderError('repository_access_denied');
+    }
+    return { defaultBranch };
+}
+export async function checkConnectionRepositoryReadiness(connection, temporaryRepositories, dependencies) {
+    if (!temporaryRepositories || connection.managed !== true) {
+        return checkRepositoryReadiness(connection.repoPath);
+    }
+    try {
+        const repository = configuredManagedRepository(connection);
+        const credential = await dependencies.getCredential(connection, repository);
+        if (!credential)
+            throw new GitCommandFailure();
+        const source = (dependencies.managedRepositoryUrl ?? githubCloneUrl)(repository, connection);
+        if (!source || source.startsWith('-') || source.includes('\0'))
+            throw new GitCommandFailure();
+        const environment = githubAuthEnvironment(credential);
+        const args = ['ls-remote', '--exit-code', source,
+            connection.branch ? `refs/heads/${connection.branch}` : 'HEAD'];
+        dependencies.observeGit?.(args, environment);
+        await runReadinessProbe(process.cwd(), args, environment);
+        return { state: 'ready' };
+    }
+    catch {
+        return {
+            state: 'repository_access_denied',
+            reason: 'GitHub access is not ready for this repository.',
+        };
+    }
+}
+function normalizedExpiry(value, now) {
+    const requested = Date.parse(value);
+    if (!Number.isFinite(requested) || requested <= now.getTime())
+        return null;
+    return new Date(Math.min(requested, now.getTime() + MAX_LEASE_MS)).toISOString();
+}
+function nonBlank(value) {
+    return value.trim().length > 0;
+}
+function providerFailure(error, fallback) {
+    return error instanceof RepositoryProviderError ? error : new RepositoryProviderError(fallback);
+}
+function checkoutArgs(gitDirectory, path, commit) {
+    return [
+        '-c', 'core.longpaths=true',
+        '-c', 'core.symlinks=false',
+        '-c', 'core.autocrlf=false',
+        '--git-dir', gitDirectory,
+        'worktree', 'add', '--detach', path, commit,
+    ];
+}
+export function createRepositoryProvider(dependencies) {
+    const clock = dependencies.now ?? (() => new Date());
+    const scheduleTimeout = dependencies.setTimeout ?? setTimeout;
+    const cancelTimeout = dependencies.clearTimeout ?? clearTimeout;
+    const gitRunner = dependencies.runGit ?? runGitCommand;
+    const activeOwners = new Set();
+    const runGit = (sourceLease, args, env, signal) => {
+        dependencies.observeGit?.(args, env);
+        return gitRunner({
+            cwd: sourceLease.path,
+            args,
+            env,
+            signal,
+            registerReader: (reader) => sourceLease.registerReader(reader),
+        });
+    };
+    const acquireRepository = async (input) => {
+        const snapshotSha = input.target.kind === 'snapshot' ? input.target.sha : null;
+        if (!nonBlank(input.owner.attemptId) || !nonBlank(input.owner.claimToken)
+            || (snapshotSha !== null && !SHA.test(snapshotSha))
+            || (input.target.kind === 'range'
+                && (!(input.target.base === null || SHA.test(input.target.base))
+                    || !nonBlank(input.target.head) || input.target.head.startsWith('-')
+                    || input.target.head.includes('\0')))) {
+            throw new RepositoryProviderError('snapshot_unavailable');
+        }
+        const firstExpiry = normalizedExpiry(input.owner.expiresAt, clock());
+        if (firstExpiry === null)
+            throw new RepositoryProviderError('repository_lease_lost');
+        let claimLive = false;
+        try {
+            claimLive = await dependencies.isClaimLive(input.owner, input.connection);
+        }
+        catch {
+            // A claim that cannot be confirmed is not live.
+        }
+        const ownerKey = JSON.stringify([
+            input.owner.attemptId,
+            input.connection.connectionId,
+            input.target,
+        ]);
+        if (!claimLive || activeOwners.has(ownerKey)) {
+            throw new RepositoryProviderError('repository_lease_lost');
+        }
+        activeOwners.add(ownerKey);
+        const abandonOwner = (code) => {
+            activeOwners.delete(ownerKey);
+            throw new RepositoryProviderError(code);
+        };
+        let repositoryIdentity;
+        let sourceLocation;
+        let environment = networkGitEnvironment();
+        if (input.connection.managed === true) {
+            let repository;
+            try {
+                repository = configuredManagedRepository(input.connection);
+            }
+            catch {
+                return abandonOwner('repository_access_denied');
+            }
+            let credential = null;
+            try {
+                credential = await dependencies.getCredential(input.connection, repository);
+            }
+            catch {
+                // Credentials are deliberately represented only by the fixed failure below.
+            }
+            if (!credential)
+                return abandonOwner('repository_access_denied');
+            repositoryIdentity = `github:${githubLabel(repository)}`;
+            try {
+                sourceLocation = (dependencies.managedRepositoryUrl ?? githubCloneUrl)(repository, input.connection);
+            }
+            catch {
+                return abandonOwner('repository_access_denied');
+            }
+            if (!sourceLocation || sourceLocation.startsWith('-') || sourceLocation.includes('\0')) {
+                return abandonOwner('repository_access_denied');
+            }
+            environment = githubAuthEnvironment(credential);
+        }
+        else {
+            if (!nonBlank(input.connection.repoPath)) {
+                return abandonOwner('repository_access_denied');
+            }
+            sourceLocation = resolve(input.connection.repoPath);
+            repositoryIdentity = `developer:${sourceLocation}`;
+        }
+        let sourceLease;
+        try {
+            sourceLease = await dependencies.sourceManager.acquireAttemptSource({
+                workspaceId: dependencies.workspaceId,
+                buildId: `repository-task:${input.connection.connectionId}`,
+                attemptId: input.owner.attemptId,
+                hostId: dependencies.hostId,
+                leaseExpiresAt: firstExpiry,
+            });
+        }
+        catch (error) {
+            activeOwners.delete(ownerKey);
+            throw error instanceof AttemptSourceError && error.code === 'source_lease_lost'
+                ? new RepositoryProviderError('repository_lease_lost')
+                : new RepositoryProviderError('repository_access_denied');
+        }
+        const releaseSource = async () => {
+            let cleanup;
+            try {
+                cleanup = await sourceLease.release();
+            }
+            catch {
+                throw new RepositoryProviderError('cleanup_pending');
+            }
+            if (cleanup.state === 'cleanup_pending') {
+                throw new RepositoryProviderError('cleanup_pending', cleanup);
+            }
+            return cleanup;
+        };
+        let failureCode = 'repository_access_denied';
+        let resolvedSource = snapshotSha;
+        let acquiredRange;
+        try {
+            if (!input.connection.managed) {
+                const top = await runGit(sourceLease, ['-C', sourceLocation, 'rev-parse', '--show-toplevel'], environment, input.signal);
+                if (resolve(top.stdout.trim()) !== sourceLocation) {
+                    throw new RepositoryProviderError('repository_access_denied');
+                }
+            }
+            await runGit(sourceLease, ['init', '--bare', sourceLease.bareRepositoryPath], networkGitEnvironment(), input.signal);
+            if (input.connection.managed) {
+                await runGit(sourceLease, ['ls-remote', '--exit-code', sourceLocation], environment, input.signal);
+            }
+            failureCode = 'snapshot_unavailable';
+            if (input.target.kind === 'snapshot') {
+                await runGit(sourceLease, [
+                    '--git-dir', sourceLease.bareRepositoryPath,
+                    'fetch', '--no-tags', '--depth=1', sourceLocation, input.target.sha,
+                ], environment, input.signal);
+                const type = await runGit(sourceLease, [
+                    '--git-dir', sourceLease.bareRepositoryPath, 'cat-file', '-t', input.target.sha,
+                ], networkGitEnvironment(), input.signal);
+                const resolvedCommit = await runGit(sourceLease, [
+                    '--git-dir', sourceLease.bareRepositoryPath,
+                    'rev-parse', '--verify', `${input.target.sha}^{commit}`,
+                ], networkGitEnvironment(), input.signal);
+                if (type.stdout.trim() !== 'commit' || resolvedCommit.stdout.trim() !== input.target.sha) {
+                    throw new RepositoryProviderError('snapshot_unavailable');
+                }
+            }
+            else {
+                const branchRef = `refs/heads/${input.target.head}`;
+                await runGit(sourceLease, ['check-ref-format', '--branch', input.target.head], networkGitEnvironment(), input.signal);
+                const advertised = await runGit(sourceLease, ['ls-remote', '--exit-code', sourceLocation, branchRef], environment, input.signal);
+                const advertisedLines = advertised.stdout.trimEnd().split(/\r?\n/)
+                    .filter((line) => line.endsWith(`\t${branchRef}`));
+                if (advertisedLines.length !== 1)
+                    throw new RepositoryProviderError('snapshot_unavailable');
+                const advertisedHead = advertisedLines[0].split('\t')[0];
+                if (!SHA.test(advertisedHead))
+                    throw new RepositoryProviderError('snapshot_unavailable');
+                const operation = randomUUID();
+                const headRef = `refs/product-console/repository-provider/${operation}/head`;
+                const baseRef = `refs/product-console/repository-provider/${operation}/base`;
+                const remote = `repository-provider-${operation}`;
+                await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                    'remote', 'add', remote, sourceLocation], networkGitEnvironment(), input.signal);
+                await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                    'config', `remote.${remote}.promisor`, 'true'], networkGitEnvironment(), input.signal);
+                await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                    'config', `remote.${remote}.partialclonefilter`, 'blob:none'], networkGitEnvironment(), input.signal);
+                await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                    'fetch', '--filter=blob:none', '--depth=64', '--update-shallow', '--no-tags', '--refmap=', '--no-write-fetch-head',
+                    '--no-recurse-submodules', remote, `+${branchRef}:${headRef}`], environment, input.signal);
+                const resolvedHead = (await runGit(sourceLease, ['--no-replace-objects',
+                    '--git-dir', sourceLease.bareRepositoryPath, 'rev-parse', '--verify', `${headRef}^{commit}`], networkGitEnvironment(), input.signal)).stdout.trim();
+                if (resolvedHead !== advertisedHead)
+                    throw new RepositoryProviderError('snapshot_unavailable');
+                resolvedSource = resolvedHead;
+                const objectEnvironment = { ...networkGitEnvironment(), GIT_NO_LAZY_FETCH: '1' };
+                const isShallow = async () => (await runGit(sourceLease, ['--no-replace-objects',
+                    '--git-dir', sourceLease.bareRepositoryPath, 'rev-parse', '--is-shallow-repository'], objectEnvironment, input.signal)).stdout.trim() === 'true';
+                const hasBase = async (base) => {
+                    try {
+                        await runGit(sourceLease, ['--no-replace-objects', '--git-dir', sourceLease.bareRepositoryPath,
+                            'cat-file', '-e', `${base}^{commit}`], objectEnvironment, input.signal);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                };
+                const baseIsAncestor = async (base) => {
+                    try {
+                        return (await runGit(sourceLease, ['--no-replace-objects',
+                            '--git-dir', sourceLease.bareRepositoryPath, 'merge-base', base, resolvedHead], objectEnvironment, input.signal)).stdout.trim() === base;
+                    }
+                    catch {
+                        return false;
+                    }
+                };
+                let shallow = await isShallow();
+                let unavailable;
+                const base = input.target.base;
+                if (base !== null && base !== resolvedHead) {
+                    let basePresent = await hasBase(base);
+                    let ancestryComplete = basePresent && await baseIsAncestor(base);
+                    for (const deepen of [256, 1_024, 4_096]) {
+                        if (ancestryComplete || !shallow)
+                            break;
+                        await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                            'fetch', '--filter=blob:none', `--deepen=${deepen}`, '--update-shallow', '--no-tags',
+                            '--refmap=', '--no-write-fetch-head', '--no-recurse-submodules', remote,
+                            `+${branchRef}:${headRef}`], environment, input.signal);
+                        shallow = await isShallow();
+                        basePresent = await hasBase(base);
+                        ancestryComplete = basePresent && await baseIsAncestor(base);
+                    }
+                    if (!ancestryComplete && !basePresent) {
+                        try {
+                            await runGit(sourceLease, ['--git-dir', sourceLease.bareRepositoryPath,
+                                'fetch', '--filter=blob:none', '--no-tags', '--refmap=', '--no-write-fetch-head',
+                                '--no-recurse-submodules', remote, `+${base}:${baseRef}`], environment, input.signal);
+                            basePresent = await hasBase(base);
+                            if (!basePresent)
+                                unavailable = 'object_missing';
+                        }
+                        catch {
+                            unavailable = shallow ? 'shallow_history' : 'object_missing';
+                        }
+                    }
+                    if (!unavailable && !ancestryComplete && basePresent) {
+                        unavailable = shallow ? 'shallow_history'
+                            : await baseIsAncestor(base) ? undefined : 'not_ancestor';
+                    }
+                }
+                acquiredRange = {
+                    base, head: resolvedHead, historyShallow: shallow,
+                    ...(unavailable ? { baseUnavailableReason: unavailable } : {}),
+                };
+            }
+        }
+        catch (error) {
+            try {
+                await releaseSource();
+            }
+            catch (cleanupError) {
+                throw providerFailure(cleanupError, 'cleanup_pending');
+            }
+            activeOwners.delete(ownerKey);
+            throw providerFailure(error, input.signal.aborted ? 'repository_lease_lost' : failureCode);
+        }
+        const publicOwner = { ...input.owner, expiresAt: firstExpiry };
+        const identities = {
+            connectionId: input.connection.connectionId,
+            repository: repositoryIdentity,
+            source: `commit:${resolvedSource}`,
+            target: input.target.kind === 'snapshot'
+                ? { ...input.target }
+                : { kind: 'range', base: input.target.base, head: resolvedSource },
+        };
+        let state = 'live';
+        let releasePromise = null;
+        let checkoutPromise = null;
+        let expiryTimer = null;
+        const assertLive = () => {
+            if (state !== 'live' || clock().getTime() >= Date.parse(publicOwner.expiresAt)) {
+                if (state === 'live')
+                    void release().catch(() => undefined);
+                throw new RepositoryProviderError('repository_lease_lost');
+            }
+        };
+        const scheduleExpiry = (expiresAt) => {
+            if (expiryTimer !== null)
+                cancelTimeout(expiryTimer);
+            expiryTimer = scheduleTimeout(() => { void release().catch(() => undefined); }, Math.max(0, Date.parse(expiresAt) - clock().getTime()));
+            if (typeof expiryTimer === 'object' && expiryTimer !== null && 'unref' in expiryTimer) {
+                expiryTimer.unref();
+            }
+        };
+        const abort = () => { void release().catch(() => undefined); };
+        const release = () => {
+            if (releasePromise !== null)
+                return releasePromise;
+            state = 'releasing';
+            if (expiryTimer !== null)
+                cancelTimeout(expiryTimer);
+            input.signal.removeEventListener('abort', abort);
+            releasePromise = releaseSource().then((cleanup) => {
+                activeOwners.delete(ownerKey);
+                return cleanup;
+            }).finally(() => { state = 'released'; });
+            return releasePromise;
+        };
+        const loseLease = async () => {
+            await release();
+            throw new RepositoryProviderError('repository_lease_lost');
+        };
+        const lease = {
+            identities,
+            owner: publicOwner,
+            temporaryPath: sourceLease.path,
+            gitDirectory: sourceLease.bareRepositoryPath,
+            ...(acquiredRange ? { range: acquiredRange } : {}),
+            assertLive,
+            gitEnvironment() {
+                assertLive();
+                return { ...environment };
+            },
+            checkout() {
+                assertLive();
+                checkoutPromise ??= (async () => {
+                    const path = resolve(sourceLease.path, 'checkout');
+                    try {
+                        await runGit(sourceLease, checkoutArgs(sourceLease.bareRepositoryPath, path, resolvedSource), networkGitEnvironment(), input.signal);
+                        const observed = await runGit(sourceLease, ['-C', path, 'rev-parse', '--verify', 'HEAD^{commit}'], networkGitEnvironment(), input.signal);
+                        if (observed.stdout.trim() !== resolvedSource) {
+                            throw new RepositoryProviderError('snapshot_unavailable');
+                        }
+                        return { path, commit: resolvedSource };
+                    }
+                    catch (error) {
+                        throw providerFailure(error, state === 'live'
+                            ? 'snapshot_unavailable' : 'repository_lease_lost');
+                    }
+                })();
+                return checkoutPromise;
+            },
+            registerReader(reader) {
+                assertLive();
+                try {
+                    return sourceLease.registerReader(reader);
+                }
+                catch {
+                    throw new RepositoryProviderError('repository_lease_lost');
+                }
+            },
+            async heartbeat(heartbeat) {
+                if (heartbeat.claimToken !== publicOwner.claimToken || state !== 'live'
+                    || clock().getTime() >= Date.parse(publicOwner.expiresAt))
+                    return loseLease();
+                let live = false;
+                try {
+                    live = await dependencies.isClaimLive({
+                        attemptId: publicOwner.attemptId,
+                        claimToken: heartbeat.claimToken,
+                        expiresAt: heartbeat.expiresAt,
+                    }, input.connection);
+                }
+                catch {
+                    // A failed ownership check is fenced just like an explicit stale response.
+                }
+                const expiresAt = normalizedExpiry(heartbeat.expiresAt, clock());
+                if (!live || expiresAt === null || Date.parse(expiresAt) < Date.parse(publicOwner.expiresAt)) {
+                    return loseLease();
+                }
+                try {
+                    await sourceLease.renew(expiresAt);
+                }
+                catch {
+                    return loseLease();
+                }
+                publicOwner.expiresAt = expiresAt;
+                scheduleExpiry(expiresAt);
+                return { expiresAt };
+            },
+            release,
+        };
+        input.signal.addEventListener('abort', abort, { once: true });
+        scheduleExpiry(firstExpiry);
+        if (input.signal.aborted)
+            await loseLease();
+        return lease;
+    };
+    return {
+        acquireRepository,
+        async sweepRepositories(at = clock().toISOString()) {
+            try {
+                return await dependencies.sourceManager.sweepAttemptSources(at);
+            }
+            catch {
+                throw new RepositoryProviderError('cleanup_pending');
+            }
+        },
+    };
+}