@mastra/factory 0.2.0 → 0.2.1-alpha.1

package/dist/integrations/github/project-lock.d.ts

@@ -27,6 +27,20 @@ export interface LockClient {
     query(sql: string, params?: unknown[]): Promise<unknown>;
     release(): void;
 }
+/**
+ * Default hard cap on how long a critical section may run inside the project
+ * lock. Prevents an untimed outbound call (sandbox HTTP, GitHub App API, git
+ * push, etc.) from pinning both the advisory lock and the pg pool connection
+ * indefinitely — the failure mode behind the 2025-07-23 shipyard 30s plateau
+ * incident. Callers can override per call via `timeoutMs`.
+ */
+export declare const DEFAULT_PROJECT_LOCK_TIMEOUT_MS = 60000;
+/** Thrown when the critical section under `withProjectLock` exceeds the timeout. */
+export declare class ProjectLockTimeoutError extends Error {
+    readonly key: string;
+    readonly timeoutMs: number;
+    constructor(key: string, timeoutMs: number);
+}
 /**
  * True when the cross-replica lock layer should be used: not force-disabled
  * via env, and the factory storage backend exposes the
@@ -52,9 +66,16 @@ export declare function withProjectLock<T>(options: {
     key: string;
     /** Factory storage backend supplying the `withDistributedLock` capability, when available. */
     storage?: FactoryStorage;
-    fn: () => Promise<T>;
+    fn: (signal: AbortSignal) => Promise<T>;
     /** Test seam: fake pg pool standing in for the distributed layer. */
     pool?: LockPool;
+    /**
+     * Hard cap on the critical section. Defaults to
+     * {@link DEFAULT_PROJECT_LOCK_TIMEOUT_MS}. On timeout `fn`'s abort signal
+     * fires and the outer lock throws `ProjectLockTimeoutError`, releasing the
+     * advisory lock + pool connection.
+     */
+    timeoutMs?: number;
 }): Promise<T>;
 /**
  * Acquire only the cross-replica lock for `key` and run `fn` under it. This is
@@ -70,8 +91,9 @@ export declare function withProjectLock<T>(options: {
 export declare function withDbAdvisoryLock<T>(options: {
     key: string;
     storage?: FactoryStorage;
-    fn: () => Promise<T>;
+    fn: (signal: AbortSignal) => Promise<T>;
     pool?: LockPool;
+    timeoutMs?: number;
 }): Promise<T>;
 /** For tests: clear the in-process lock chains. */
 export declare function __resetProjectLocksForTests(): void;

package/dist/integrations/github/project-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-lock.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/project-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAChC;AACD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,qEAAqE;IACrE,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB,GAAG,OAAO,CAAC,CAAC,CAAC,CAmBb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB,GAAG,OAAO,CAAC,CAAC,CAAC,CAYb;AAwBD,mDAAmD;AACnD,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}
+{"version":3,"file":"project-lock.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/project-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAChC;AACD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAM3C;AA+BD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,qEAAqE;IACrE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,CAAC,CAAC,CAmBb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,CAAC,CAAC,CAgBb;AAqCD,mDAAmD;AACnD,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/integrations/github/project-lock.js

@@ -1,6 +1,34 @@
 // src/integrations/github/project-lock.ts
 import { createHash } from "crypto";
 var inProcessLocks = /* @__PURE__ */ new Map();
+var DEFAULT_PROJECT_LOCK_TIMEOUT_MS = 6e4;
+var ProjectLockTimeoutError = class extends Error {
+  key;
+  timeoutMs;
+  constructor(key, timeoutMs) {
+    super(`Project lock critical section for "${key}" exceeded ${timeoutMs}ms`);
+    this.name = "ProjectLockTimeoutError";
+    this.key = key;
+    this.timeoutMs = timeoutMs;
+  }
+};
+async function runWithTimeout(key, timeoutMs, fn) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const abortError = new Promise((_, reject) => {
+    controller.signal.addEventListener("abort", () => reject(new ProjectLockTimeoutError(key, timeoutMs)), {
+      once: true
+    });
+  });
+  const work = fn(controller.signal);
+  work.catch(() => {
+  });
+  try {
+    return await Promise.race([work, abortError]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function isDistributedLockEnabled(storage) {
   if (process.env.MASTRACODE_DISTRIBUTED_LOCK === "0") return false;
   return typeof storage?.withDistributedLock === "function";
@@ -12,9 +40,9 @@ function hashKey(key) {
   return [a, b];
 }
 function withProjectLock(options) {
-  const { key, storage, fn, pool } = options;
+  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;
   const prev = inProcessLocks.get(key) ?? Promise.resolve();
-  const run = () => withDbAdvisoryLock({ key, storage, fn, pool });
+  const run = () => withDbAdvisoryLock({ key, storage, fn, pool, timeoutMs });
   const next = prev.then(run, run);
   const tail = next.then(
     () => void 0,
@@ -29,28 +57,31 @@ function withProjectLock(options) {
   return next;
 }
 async function withDbAdvisoryLock(options) {
-  const { key, storage, fn, pool } = options;
+  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;
   if (process.env.MASTRACODE_DISTRIBUTED_LOCK === "0") {
-    return fn();
+    return runWithTimeout(key, timeoutMs, fn);
   }
-  if (pool) return advisoryLockOver(pool, key, fn);
+  if (pool) return advisoryLockOver(pool, key, timeoutMs, fn);
   if (typeof storage?.withDistributedLock !== "function") {
-    return fn();
+    return runWithTimeout(key, timeoutMs, fn);
   }
-  return storage.withDistributedLock(key, fn);
+  return storage.withDistributedLock(key, () => runWithTimeout(key, timeoutMs, fn));
 }
-async function advisoryLockOver(pool, key, fn) {
+async function advisoryLockOver(pool, key, timeoutMs, fn) {
   const [k1, k2] = hashKey(key);
   const client = await pool.connect();
   try {
     await client.query("BEGIN");
     await client.query("SELECT pg_advisory_xact_lock($1, $2)", [k1, k2]);
     try {
-      const result = await fn();
+      const result = await runWithTimeout(key, timeoutMs, fn);
       await client.query("COMMIT");
       return result;
     } catch (err) {
-      await client.query("ROLLBACK");
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
       throw err;
     }
   } finally {
@@ -61,6 +92,8 @@ function __resetProjectLocksForTests() {
   inProcessLocks.clear();
 }
 export {
+  DEFAULT_PROJECT_LOCK_TIMEOUT_MS,
+  ProjectLockTimeoutError,
   __resetProjectLocksForTests,
   hashKey,
   isDistributedLockEnabled,

package/dist/integrations/github/project-lock.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/integrations/github/project-lock.ts"],"sourcesContent":["/**\n * Per-(project, user) lock that serializes the worktree/commit/push/PR flows.\n *\n * The push/PR flows temporarily rewrite the sandbox git remote to a tokenized\n * URL and scrub it again in a `finally`; two concurrent operations on the same\n * `(project, user)` sandbox could interleave those rewrites and leak a tokenized\n * remote. Serializing per `(project, user)` removes that race.\n *\n * There are two layers:\n *  1. An **in-process** promise-chain mutex keyed by the lock key, so repeated\n *     same-replica callers stay cheap and never touch the database for ordering.\n *  2. The factory storage backend's **`withDistributedLock` capability** (pg:\n *     transaction-scoped advisory locks) so that *different replicas*\n *     operating on the same key also serialize. Backends without the\n *     capability (libsql: local single-writer) fall back to the in-process\n *     mutex alone — correct for single-replica deployments.\n *\n * Set `MASTRACODE_DISTRIBUTED_LOCK=0` to force-disable the distributed layer\n * (local dev, single replica) and fall back to the pure in-process mutex.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport type { FactoryStorage } from '@mastra/core/storage';\n\n/** Minimal pg pool surface used by the distributed lock (for testability). */\nexport interface LockPool {\n  connect(): Promise<LockClient>;\n}\nexport interface LockClient {\n  query(sql: string, params?: unknown[]): Promise<unknown>;\n  release(): void;\n}\n\nconst inProcessLocks = new Map<string, Promise<unknown>>();\n\n/**\n * True when the cross-replica lock layer should be used: not force-disabled\n * via env, and the factory storage backend exposes the\n * `withDistributedLock` capability.\n */\nexport function isDistributedLockEnabled(storage: FactoryStorage | undefined): boolean {\n  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === '0') return false;\n  return typeof storage?.withDistributedLock === 'function';\n}\n\n/**\n * Hash a lock key into the two signed 32-bit integers that the two-arg form of\n * `pg_advisory_xact_lock(int4, int4)` expects. Using two int4 args (rather than\n * one int8) keeps the key inside the GitHub-feature advisory-lock namespace and\n * avoids collisions with other single-int8 advisory locks.\n */\nexport function hashKey(key: string): [number, number] {\n  const digest = createHash('sha256').update(key).digest();\n  // Read two independent 32-bit halves as signed int4 values.\n  const a = digest.readInt32BE(0);\n  const b = digest.readInt32BE(4);\n  return [a, b];\n}\n\n/**\n * Run `fn` while holding the lock for `key`. Same-replica callers serialize via\n * the in-process mutex; cross-replica callers additionally serialize via a\n * Postgres transaction-scoped advisory lock (unless disabled).\n *\n * The in-process chain swallows rejections so one failed operation does not\n * poison the lock for subsequent callers.\n */\nexport function withProjectLock<T>(options: {\n  key: string;\n  /** Factory storage backend supplying the `withDistributedLock` capability, when available. */\n  storage?: FactoryStorage;\n  fn: () => Promise<T>;\n  /** Test seam: fake pg pool standing in for the distributed layer. */\n  pool?: LockPool;\n}): Promise<T> {\n  const { key, storage, fn, pool } = options;\n  const prev = inProcessLocks.get(key) ?? Promise.resolve();\n  const run = () => withDbAdvisoryLock({ key, storage, fn, pool });\n  const next = prev.then(run, run);\n  const tail = next.then(\n    () => undefined,\n    () => undefined,\n  );\n  inProcessLocks.set(key, tail);\n  // Drop the entry once this operation settles, but only if no later caller has\n  // chained onto it in the meantime — otherwise we'd evict a live waiter's tail.\n  // This keeps the map from growing unbounded across many distinct project keys.\n  void tail.then(() => {\n    if (inProcessLocks.get(key) === tail) {\n      inProcessLocks.delete(key);\n    }\n  });\n  return next;\n}\n\n/**\n * Acquire only the cross-replica lock for `key` and run `fn` under it. This is\n * the distributed serialization layer; `withProjectLock` wraps it with an\n * in-process mutex for same-replica callers. Delegates to the factory storage\n * backend's `withDistributedLock` capability; backends without it (or a\n * force-disabled env) run `fn` directly — the in-process mutex still holds.\n *\n * `poolOverride` keeps the pg advisory-lock path directly testable with a fake\n * pool (each simulated replica has its own in-process state but shares one\n * database).\n */\nexport async function withDbAdvisoryLock<T>(options: {\n  key: string;\n  storage?: FactoryStorage;\n  fn: () => Promise<T>;\n  pool?: LockPool;\n}): Promise<T> {\n  const { key, storage, fn, pool } = options;\n  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === '0') {\n    return fn();\n  }\n\n  if (pool) return advisoryLockOver(pool, key, fn);\n\n  if (typeof storage?.withDistributedLock !== 'function') {\n    return fn();\n  }\n  return storage.withDistributedLock(key, fn);\n}\n\n/** The pg advisory-lock body, kept for the `poolOverride` test seam. */\nasync function advisoryLockOver<T>(pool: LockPool, key: string, fn: () => Promise<T>): Promise<T> {\n  const [k1, k2] = hashKey(key);\n  const client = await pool.connect();\n  try {\n    await client.query('BEGIN');\n    // Blocks until no other transaction holds this advisory key. Auto-released\n    // when the transaction ends below.\n    await client.query('SELECT pg_advisory_xact_lock($1, $2)', [k1, k2]);\n    try {\n      const result = await fn();\n      await client.query('COMMIT');\n      return result;\n    } catch (err) {\n      await client.query('ROLLBACK');\n      throw err;\n    }\n  } finally {\n    client.release();\n  }\n}\n\n/** For tests: clear the in-process lock chains. */\nexport function __resetProjectLocksForTests(): void {\n  inProcessLocks.clear();\n}\n"],"mappings":";AAqBA,SAAS,kBAAkB;AAa3B,IAAM,iBAAiB,oBAAI,IAA8B;AAOlD,SAAS,yBAAyB,SAA8C;AACrF,MAAI,QAAQ,IAAI,gCAAgC,IAAK,QAAO;AAC5D,SAAO,OAAO,SAAS,wBAAwB;AACjD;AAQO,SAAS,QAAQ,KAA+B;AACrD,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO;AAEvD,QAAM,IAAI,OAAO,YAAY,CAAC;AAC9B,QAAM,IAAI,OAAO,YAAY,CAAC;AAC9B,SAAO,CAAC,GAAG,CAAC;AACd;AAUO,SAAS,gBAAmB,SAOpB;AACb,QAAM,EAAE,KAAK,SAAS,IAAI,KAAK,IAAI;AACnC,QAAM,OAAO,eAAe,IAAI,GAAG,KAAK,QAAQ,QAAQ;AACxD,QAAM,MAAM,MAAM,mBAAmB,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC;AAC/D,QAAM,OAAO,KAAK,KAAK,KAAK,GAAG;AAC/B,QAAM,OAAO,KAAK;AAAA,IAChB,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,iBAAe,IAAI,KAAK,IAAI;AAI5B,OAAK,KAAK,KAAK,MAAM;AACnB,QAAI,eAAe,IAAI,GAAG,MAAM,MAAM;AACpC,qBAAe,OAAO,GAAG;AAAA,IAC3B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAaA,eAAsB,mBAAsB,SAK7B;AACb,QAAM,EAAE,KAAK,SAAS,IAAI,KAAK,IAAI;AACnC,MAAI,QAAQ,IAAI,gCAAgC,KAAK;AACnD,WAAO,GAAG;AAAA,EACZ;AAEA,MAAI,KAAM,QAAO,iBAAiB,MAAM,KAAK,EAAE;AAE/C,MAAI,OAAO,SAAS,wBAAwB,YAAY;AACtD,WAAO,GAAG;AAAA,EACZ;AACA,SAAO,QAAQ,oBAAoB,KAAK,EAAE;AAC5C;AAGA,eAAe,iBAAoB,MAAgB,KAAa,IAAkC;AAChG,QAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;AAC5B,QAAM,SAAS,MAAM,KAAK,QAAQ;AAClC,MAAI;AACF,UAAM,OAAO,MAAM,OAAO;AAG1B,UAAM,OAAO,MAAM,wCAAwC,CAAC,IAAI,EAAE,CAAC;AACnE,QAAI;AACF,YAAM,SAAS,MAAM,GAAG;AACxB,YAAM,OAAO,MAAM,QAAQ;AAC3B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,OAAO,MAAM,UAAU;AAC7B,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,WAAO,QAAQ;AAAA,EACjB;AACF;AAGO,SAAS,8BAAoC;AAClD,iBAAe,MAAM;AACvB;","names":[]}
+{"version":3,"sources":["../../../src/integrations/github/project-lock.ts"],"sourcesContent":["/**\n * Per-(project, user) lock that serializes the worktree/commit/push/PR flows.\n *\n * The push/PR flows temporarily rewrite the sandbox git remote to a tokenized\n * URL and scrub it again in a `finally`; two concurrent operations on the same\n * `(project, user)` sandbox could interleave those rewrites and leak a tokenized\n * remote. Serializing per `(project, user)` removes that race.\n *\n * There are two layers:\n *  1. An **in-process** promise-chain mutex keyed by the lock key, so repeated\n *     same-replica callers stay cheap and never touch the database for ordering.\n *  2. The factory storage backend's **`withDistributedLock` capability** (pg:\n *     transaction-scoped advisory locks) so that *different replicas*\n *     operating on the same key also serialize. Backends without the\n *     capability (libsql: local single-writer) fall back to the in-process\n *     mutex alone — correct for single-replica deployments.\n *\n * Set `MASTRACODE_DISTRIBUTED_LOCK=0` to force-disable the distributed layer\n * (local dev, single replica) and fall back to the pure in-process mutex.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport type { FactoryStorage } from '@mastra/core/storage';\n\n/** Minimal pg pool surface used by the distributed lock (for testability). */\nexport interface LockPool {\n  connect(): Promise<LockClient>;\n}\nexport interface LockClient {\n  query(sql: string, params?: unknown[]): Promise<unknown>;\n  release(): void;\n}\n\nconst inProcessLocks = new Map<string, Promise<unknown>>();\n\n/**\n * Default hard cap on how long a critical section may run inside the project\n * lock. Prevents an untimed outbound call (sandbox HTTP, GitHub App API, git\n * push, etc.) from pinning both the advisory lock and the pg pool connection\n * indefinitely — the failure mode behind the 2025-07-23 shipyard 30s plateau\n * incident. Callers can override per call via `timeoutMs`.\n */\nexport const DEFAULT_PROJECT_LOCK_TIMEOUT_MS = 60_000;\n\n/** Thrown when the critical section under `withProjectLock` exceeds the timeout. */\nexport class ProjectLockTimeoutError extends Error {\n  readonly key: string;\n  readonly timeoutMs: number;\n  constructor(key: string, timeoutMs: number) {\n    super(`Project lock critical section for \"${key}\" exceeded ${timeoutMs}ms`);\n    this.name = 'ProjectLockTimeoutError';\n    this.key = key;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Race `fn()` against a timeout, throwing `ProjectLockTimeoutError` if the\n * timeout fires first. `fn()` receives an `AbortSignal` so it can (optionally)\n * abort in-flight outbound I/O when the timeout trips. If `fn()` ignores the\n * signal it will still resolve/reject eventually — but the caller sees the\n * timeout error immediately, which is what lets the outer lock wrapper roll\n * back and release the connection.\n */\nasync function runWithTimeout<T>(key: string, timeoutMs: number, fn: (signal: AbortSignal) => Promise<T>): Promise<T> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  const abortError = new Promise<never>((_, reject) => {\n    controller.signal.addEventListener('abort', () => reject(new ProjectLockTimeoutError(key, timeoutMs)), {\n      once: true,\n    });\n  });\n  const work = fn(controller.signal);\n  // If `fn` eventually rejects (e.g. its own fetch observes the abort signal\n  // after we already rejected via timeout), swallow it — the outer caller\n  // has already been rejected with our timeout error and we don't want an\n  // unhandled rejection.\n  work.catch(() => {});\n  try {\n    return await Promise.race([work, abortError]);\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * True when the cross-replica lock layer should be used: not force-disabled\n * via env, and the factory storage backend exposes the\n * `withDistributedLock` capability.\n */\nexport function isDistributedLockEnabled(storage: FactoryStorage | undefined): boolean {\n  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === '0') return false;\n  return typeof storage?.withDistributedLock === 'function';\n}\n\n/**\n * Hash a lock key into the two signed 32-bit integers that the two-arg form of\n * `pg_advisory_xact_lock(int4, int4)` expects. Using two int4 args (rather than\n * one int8) keeps the key inside the GitHub-feature advisory-lock namespace and\n * avoids collisions with other single-int8 advisory locks.\n */\nexport function hashKey(key: string): [number, number] {\n  const digest = createHash('sha256').update(key).digest();\n  // Read two independent 32-bit halves as signed int4 values.\n  const a = digest.readInt32BE(0);\n  const b = digest.readInt32BE(4);\n  return [a, b];\n}\n\n/**\n * Run `fn` while holding the lock for `key`. Same-replica callers serialize via\n * the in-process mutex; cross-replica callers additionally serialize via a\n * Postgres transaction-scoped advisory lock (unless disabled).\n *\n * The in-process chain swallows rejections so one failed operation does not\n * poison the lock for subsequent callers.\n */\nexport function withProjectLock<T>(options: {\n  key: string;\n  /** Factory storage backend supplying the `withDistributedLock` capability, when available. */\n  storage?: FactoryStorage;\n  fn: (signal: AbortSignal) => Promise<T>;\n  /** Test seam: fake pg pool standing in for the distributed layer. */\n  pool?: LockPool;\n  /**\n   * Hard cap on the critical section. Defaults to\n   * {@link DEFAULT_PROJECT_LOCK_TIMEOUT_MS}. On timeout `fn`'s abort signal\n   * fires and the outer lock throws `ProjectLockTimeoutError`, releasing the\n   * advisory lock + pool connection.\n   */\n  timeoutMs?: number;\n}): Promise<T> {\n  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;\n  const prev = inProcessLocks.get(key) ?? Promise.resolve();\n  const run = () => withDbAdvisoryLock({ key, storage, fn, pool, timeoutMs });\n  const next = prev.then(run, run);\n  const tail = next.then(\n    () => undefined,\n    () => undefined,\n  );\n  inProcessLocks.set(key, tail);\n  // Drop the entry once this operation settles, but only if no later caller has\n  // chained onto it in the meantime — otherwise we'd evict a live waiter's tail.\n  // This keeps the map from growing unbounded across many distinct project keys.\n  void tail.then(() => {\n    if (inProcessLocks.get(key) === tail) {\n      inProcessLocks.delete(key);\n    }\n  });\n  return next;\n}\n\n/**\n * Acquire only the cross-replica lock for `key` and run `fn` under it. This is\n * the distributed serialization layer; `withProjectLock` wraps it with an\n * in-process mutex for same-replica callers. Delegates to the factory storage\n * backend's `withDistributedLock` capability; backends without it (or a\n * force-disabled env) run `fn` directly — the in-process mutex still holds.\n *\n * `poolOverride` keeps the pg advisory-lock path directly testable with a fake\n * pool (each simulated replica has its own in-process state but shares one\n * database).\n */\nexport async function withDbAdvisoryLock<T>(options: {\n  key: string;\n  storage?: FactoryStorage;\n  fn: (signal: AbortSignal) => Promise<T>;\n  pool?: LockPool;\n  timeoutMs?: number;\n}): Promise<T> {\n  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;\n  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === '0') {\n    return runWithTimeout(key, timeoutMs, fn);\n  }\n\n  if (pool) return advisoryLockOver(pool, key, timeoutMs, fn);\n\n  if (typeof storage?.withDistributedLock !== 'function') {\n    return runWithTimeout(key, timeoutMs, fn);\n  }\n  // Wrap the backend-provided lock so the critical section is bounded\n  // regardless of whether the backend implements its own timeout. The\n  // backend still owns lock acquisition/release; we own the timeout on\n  // `fn`.\n  return storage.withDistributedLock(key, () => runWithTimeout(key, timeoutMs, fn));\n}\n\n/** The pg advisory-lock body, kept for the `poolOverride` test seam. */\nasync function advisoryLockOver<T>(\n  pool: LockPool,\n  key: string,\n  timeoutMs: number,\n  fn: (signal: AbortSignal) => Promise<T>,\n): Promise<T> {\n  const [k1, k2] = hashKey(key);\n  const client = await pool.connect();\n  try {\n    await client.query('BEGIN');\n    // Blocks until no other transaction holds this advisory key. Auto-released\n    // when the transaction ends below.\n    await client.query('SELECT pg_advisory_xact_lock($1, $2)', [k1, k2]);\n    try {\n      const result = await runWithTimeout(key, timeoutMs, fn);\n      await client.query('COMMIT');\n      return result;\n    } catch (err) {\n      // COMMIT/ROLLBACK below releases the advisory lock. If the underlying\n      // connection is already dead (e.g. Neon killed it after IIT), the\n      // rollback throws — we swallow that specifically so the original error\n      // reaches the caller.\n      try {\n        await client.query('ROLLBACK');\n      } catch {\n        /* connection already gone; nothing to roll back */\n      }\n      throw err;\n    }\n  } finally {\n    client.release();\n  }\n}\n\n/** For tests: clear the in-process lock chains. */\nexport function __resetProjectLocksForTests(): void {\n  inProcessLocks.clear();\n}\n"],"mappings":";AAqBA,SAAS,kBAAkB;AAa3B,IAAM,iBAAiB,oBAAI,IAA8B;AASlD,IAAM,kCAAkC;AAGxC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EACA;AAAA,EACT,YAAY,KAAa,WAAmB;AAC1C,UAAM,sCAAsC,GAAG,cAAc,SAAS,IAAI;AAC1E,SAAK,OAAO;AACZ,SAAK,MAAM;AACX,SAAK,YAAY;AAAA,EACnB;AACF;AAUA,eAAe,eAAkB,KAAa,WAAmB,IAAqD;AACpH,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAM,aAAa,IAAI,QAAe,CAAC,GAAG,WAAW;AACnD,eAAW,OAAO,iBAAiB,SAAS,MAAM,OAAO,IAAI,wBAAwB,KAAK,SAAS,CAAC,GAAG;AAAA,MACrG,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACD,QAAM,OAAO,GAAG,WAAW,MAAM;AAKjC,OAAK,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,UAAU,CAAC;AAAA,EAC9C,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAOO,SAAS,yBAAyB,SAA8C;AACrF,MAAI,QAAQ,IAAI,gCAAgC,IAAK,QAAO;AAC5D,SAAO,OAAO,SAAS,wBAAwB;AACjD;AAQO,SAAS,QAAQ,KAA+B;AACrD,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO;AAEvD,QAAM,IAAI,OAAO,YAAY,CAAC;AAC9B,QAAM,IAAI,OAAO,YAAY,CAAC;AAC9B,SAAO,CAAC,GAAG,CAAC;AACd;AAUO,SAAS,gBAAmB,SAcpB;AACb,QAAM,EAAE,KAAK,SAAS,IAAI,MAAM,YAAY,gCAAgC,IAAI;AAChF,QAAM,OAAO,eAAe,IAAI,GAAG,KAAK,QAAQ,QAAQ;AACxD,QAAM,MAAM,MAAM,mBAAmB,EAAE,KAAK,SAAS,IAAI,MAAM,UAAU,CAAC;AAC1E,QAAM,OAAO,KAAK,KAAK,KAAK,GAAG;AAC/B,QAAM,OAAO,KAAK;AAAA,IAChB,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,iBAAe,IAAI,KAAK,IAAI;AAI5B,OAAK,KAAK,KAAK,MAAM;AACnB,QAAI,eAAe,IAAI,GAAG,MAAM,MAAM;AACpC,qBAAe,OAAO,GAAG;AAAA,IAC3B;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAaA,eAAsB,mBAAsB,SAM7B;AACb,QAAM,EAAE,KAAK,SAAS,IAAI,MAAM,YAAY,gCAAgC,IAAI;AAChF,MAAI,QAAQ,IAAI,gCAAgC,KAAK;AACnD,WAAO,eAAe,KAAK,WAAW,EAAE;AAAA,EAC1C;AAEA,MAAI,KAAM,QAAO,iBAAiB,MAAM,KAAK,WAAW,EAAE;AAE1D,MAAI,OAAO,SAAS,wBAAwB,YAAY;AACtD,WAAO,eAAe,KAAK,WAAW,EAAE;AAAA,EAC1C;AAKA,SAAO,QAAQ,oBAAoB,KAAK,MAAM,eAAe,KAAK,WAAW,EAAE,CAAC;AAClF;AAGA,eAAe,iBACb,MACA,KACA,WACA,IACY;AACZ,QAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;AAC5B,QAAM,SAAS,MAAM,KAAK,QAAQ;AAClC,MAAI;AACF,UAAM,OAAO,MAAM,OAAO;AAG1B,UAAM,OAAO,MAAM,wCAAwC,CAAC,IAAI,EAAE,CAAC;AACnE,QAAI;AACF,YAAM,SAAS,MAAM,eAAe,KAAK,WAAW,EAAE;AACtD,YAAM,OAAO,MAAM,QAAQ;AAC3B,aAAO;AAAA,IACT,SAAS,KAAK;AAKZ,UAAI;AACF,cAAM,OAAO,MAAM,UAAU;AAAA,MAC/B,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,WAAO,QAAQ;AAAA,EACjB;AACF;AAGO,SAAS,8BAAoC;AAClD,iBAAe,MAAM;AACvB;","names":[]}

package/dist/integrations/github/routes.js

@@ -93,6 +93,34 @@ async function clearGithubPat(storage, orgId, kind = "default") {
 // src/integrations/github/project-lock.ts
 import { createHash } from "crypto";
 var inProcessLocks = /* @__PURE__ */ new Map();
+var DEFAULT_PROJECT_LOCK_TIMEOUT_MS = 6e4;
+var ProjectLockTimeoutError = class extends Error {
+  key;
+  timeoutMs;
+  constructor(key, timeoutMs) {
+    super(`Project lock critical section for "${key}" exceeded ${timeoutMs}ms`);
+    this.name = "ProjectLockTimeoutError";
+    this.key = key;
+    this.timeoutMs = timeoutMs;
+  }
+};
+async function runWithTimeout(key, timeoutMs, fn) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const abortError = new Promise((_, reject) => {
+    controller.signal.addEventListener("abort", () => reject(new ProjectLockTimeoutError(key, timeoutMs)), {
+      once: true
+    });
+  });
+  const work = fn(controller.signal);
+  work.catch(() => {
+  });
+  try {
+    return await Promise.race([work, abortError]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function hashKey(key) {
   const digest = createHash("sha256").update(key).digest();
   const a = digest.readInt32BE(0);
@@ -100,9 +128,9 @@ function hashKey(key) {
   return [a, b];
 }
 function withProjectLock(options) {
-  const { key, storage, fn, pool } = options;
+  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;
   const prev = inProcessLocks.get(key) ?? Promise.resolve();
-  const run = () => withDbAdvisoryLock({ key, storage, fn, pool });
+  const run = () => withDbAdvisoryLock({ key, storage, fn, pool, timeoutMs });
   const next = prev.then(run, run);
   const tail = next.then(
     () => void 0,
@@ -117,28 +145,31 @@ function withProjectLock(options) {
   return next;
 }
 async function withDbAdvisoryLock(options) {
-  const { key, storage, fn, pool } = options;
+  const { key, storage, fn, pool, timeoutMs = DEFAULT_PROJECT_LOCK_TIMEOUT_MS } = options;
   if (process.env.MASTRACODE_DISTRIBUTED_LOCK === "0") {
-    return fn();
+    return runWithTimeout(key, timeoutMs, fn);
   }
-  if (pool) return advisoryLockOver(pool, key, fn);
+  if (pool) return advisoryLockOver(pool, key, timeoutMs, fn);
   if (typeof storage?.withDistributedLock !== "function") {
-    return fn();
+    return runWithTimeout(key, timeoutMs, fn);
   }
-  return storage.withDistributedLock(key, fn);
+  return storage.withDistributedLock(key, () => runWithTimeout(key, timeoutMs, fn));
 }
-async function advisoryLockOver(pool, key, fn) {
+async function advisoryLockOver(pool, key, timeoutMs, fn) {
   const [k1, k2] = hashKey(key);
   const client = await pool.connect();
   try {
     await client.query("BEGIN");
     await client.query("SELECT pg_advisory_xact_lock($1, $2)", [k1, k2]);
     try {
-      const result = await fn();
+      const result = await runWithTimeout(key, timeoutMs, fn);
       await client.query("COMMIT");
       return result;
     } catch (err) {
-      await client.query("ROLLBACK");
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
       throw err;
     }
   } finally {