@agent-native/core 0.169.1 → 0.171.0

package/dist/client/use-chat-models.js

@@ -5,6 +5,16 @@ import { buildChatModelGroups, } from "./chat-model-groups.js";
 import { fetchBuilderStatus, fetchEnvironmentStatus, } from "./client-status-requests.js";
 import { callAction } from "./use-action.js";
 const DEFAULT_STORAGE_KEY = "agent-native:chat-models:selection";
+/**
+ * `useChatModels` takes the raw localStorage key while `MultiTabAssistantChat`
+ * takes only the namespace suffix — a surface that hand-writes either one stops
+ * sharing the selection with the chat it sits next to.
+ */
+export function chatModelSelectionStorageKey(namespace) {
+    return namespace
+        ? `${DEFAULT_STORAGE_KEY}:${namespace}`
+        : DEFAULT_STORAGE_KEY;
+}
 export const CHAT_MODEL_SELECTION_CHANGED_EVENT = "agent-native:chat-model-selection-changed";
 const MODEL_DISCOVERY_RETRY_DELAYS_MS = [250, 1_000];
 async function fetchEngineCatalog() {

package/dist/client/use-db-sync.js

@@ -1,6 +1,7 @@
 import { useEffect, useRef, useState } from "react";
 import { ensureDemoModeFetchInterceptor } from "../demo/fetch-interceptor.js";
 import { parseHandshakeFrame, parseTokenFrame, REALTIME_PROTOCOL_VERSION, REALTIME_SSE_HANDSHAKE_EVENT, REALTIME_SSE_TOKEN_EVENT, } from "../realtime-protocol.js";
+import { addSurfaceVisibilityListener, isHostSurfaceHidden, isSurfaceHidden, } from "../shared/surface-visibility.js";
 import { agentNativePath } from "./api-path.js";
 import { getBrowserTabId } from "./browser-tab-id.js";
 import { ensureEmbedAuthFetchInterceptor, isEmbedAuthActive, } from "./embed-auth.js";
@@ -103,7 +104,7 @@ function getPollAbortMs(interval) {
     return Math.max(POLL_ABORT_MIN_MS, interval * 4);
 }
 function isDocumentHidden() {
-    return (typeof document !== "undefined" && document.visibilityState === "hidden");
+    return isSurfaceHidden();
 }
 function resolveSseUrl(sseUrl) {
     if (sseUrl === false)
@@ -269,6 +270,7 @@ class SyncTransport {
     subscribers = new Map();
     cursorRef = { ...INITIAL_SYNC_CURSOR };
     timer = null;
+    removeVisibilityListener;
     stopped = false;
     inFlight = false;
     eventSource = null;
@@ -470,6 +472,17 @@ class SyncTransport {
     // -------------------------------------------------------------------------
     // Derived settings (aggregate over active subscribers)
     // -------------------------------------------------------------------------
+    /**
+     * Whether this transport must do nothing at all right now. A host that has
+     * stashed the surface off screen is a stronger statement than a backgrounded
+     * browser tab, so it pauses regardless of `pauseWhenHidden` — an embedder
+     * only sets it for a surface the user genuinely cannot see.
+     */
+    shouldStayIdle() {
+        if (isHostSurfaceHidden())
+            return true;
+        return this.effectivePauseWhenHidden && isDocumentHidden();
+    }
     get effectivePauseWhenHidden() {
         // Pause only if every subscriber has opted in.
         for (const sub of this.subscribers.values()) {
@@ -550,7 +563,7 @@ class SyncTransport {
     schedulePoll() {
         if (this.stopped)
             return;
-        if (this.effectivePauseWhenHidden && isDocumentHidden())
+        if (this.shouldStayIdle())
             return;
         if (this.timer)
             clearTimeout(this.timer);
@@ -743,7 +756,7 @@ class SyncTransport {
         if (this.stopped ||
             this.eventSource ||
             typeof EventSource === "undefined" ||
-            (this.effectivePauseWhenHidden && isDocumentHidden())) {
+            this.shouldStayIdle()) {
             return;
         }
         // One tab per origin holds the stream; the rest follow it over
@@ -896,6 +909,10 @@ class SyncTransport {
     async poll() {
         if (this.stopped || this.inFlight)
             return;
+        // Re-checked here, not only at the schedule sites: whatever path
+        // reached poll(), a host-hidden surface must not issue a request.
+        if (this.shouldStayIdle())
+            return;
         this.inFlight = true;
         try {
             if (this.mode === "hosted" && this.gateway && !this.token) {
@@ -947,7 +964,7 @@ class SyncTransport {
         }
     }
     pollNow() {
-        if (this.effectivePauseWhenHidden && isDocumentHidden())
+        if (this.shouldStayIdle())
             return;
         if (this.authFailureDelayMs() > 0) {
             this.schedulePoll();
@@ -961,11 +978,11 @@ class SyncTransport {
         void this.poll();
     }
     handleVisibilityChange = () => {
-        if (document.visibilityState === "visible") {
+        if (!isSurfaceHidden()) {
             this.connectEvents();
             this.pollNow();
         }
-        else if (this.effectivePauseWhenHidden) {
+        else if (this.shouldStayIdle()) {
             this.closeEvents();
             // A hidden leader stops streaming, so it must not keep holding the
             // origin's stream slot — that would leave every visible tab following a
@@ -1030,13 +1047,13 @@ class SyncTransport {
         // already mounts useDbSync, so this needs zero per-template wiring.
         ensureEmbedAuthFetchInterceptor();
         ensureDemoModeFetchInterceptor();
-        if (!this.effectivePauseWhenHidden || !isDocumentHidden()) {
+        if (!this.shouldStayIdle()) {
             this.connectEvents();
             void this.poll();
         }
         window.addEventListener("focus", this.handleFocus);
         window.addEventListener("agentNative.chatRunning", this.handleChatRunning);
-        document.addEventListener("visibilitychange", this.handleVisibilityChange);
+        this.removeVisibilityListener = addSurfaceVisibilityListener(this.handleVisibilityChange);
     }
     teardown() {
         this.stopped = true;
@@ -1060,7 +1077,8 @@ class SyncTransport {
         }
         window.removeEventListener("focus", this.handleFocus);
         window.removeEventListener("agentNative.chatRunning", this.handleChatRunning);
-        document.removeEventListener("visibilitychange", this.handleVisibilityChange);
+        this.removeVisibilityListener?.();
+        this.removeVisibilityListener = undefined;
     }
 }
 /**

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/connections/catalog.d.ts

@@ -1,6 +1,6 @@
 export type WorkspaceConnectionCapability = "search" | "import" | "messages" | "meetings" | "crm" | "code" | "docs";
 export type WorkspaceConnectionTemplateUse = "analytics" | "brain" | "calendar" | "clips" | "content" | "crm" | "design" | "dispatch" | "factory" | "forms" | "mail" | "slides";
-export type WorkspaceConnectionProviderId = "slack" | "github" | "figma" | "notion" | "gmail" | "google_drive" | "hubspot" | "salesforce" | "jira" | "sentry" | "granola" | "clips" | "generic";
+export type WorkspaceConnectionProviderId = "slack" | "github" | "figma" | "notion" | "gmail" | "google_calendar" | "google_drive" | "google_docs" | "google_sheets" | "google_slides" | "hubspot" | "salesforce" | "jira" | "sentry" | "granola" | "clips" | "generic";
 export interface WorkspaceConnectionCredentialKey {
     key: string;
     label: string;
@@ -97,35 +97,137 @@ export declare const WORKSPACE_CONNECTION_PROVIDERS: readonly [{
     readonly description: "Mailbox messages and threads for search, triage, customer context, and agent replies.";
     readonly credentialKeys: readonly [{
         readonly key: "GOOGLE_CLIENT_ID";
-        readonly label: "Google OAuth client ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }, {
         readonly key: "GOOGLE_CLIENT_SECRET";
-        readonly label: "Google OAuth client secret";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }];
     readonly capabilities: readonly ["search", "import", "messages"];
     readonly recommendedTemplateUses: readonly ["mail", "brain", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_calendar";
+    readonly label: "Google Calendar";
+    readonly description: "Calendars and events for scheduling, availability, reminders, and meeting workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "meetings"];
+    readonly recommendedTemplateUses: readonly ["calendar", "brain", "dispatch", "mail"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
 }, {
     readonly id: "google_drive";
     readonly label: "Google Drive";
     readonly description: "Drive files, Docs, Sheets, and Slides for document search and import workflows.";
     readonly credentialKeys: readonly [{
         readonly key: "GOOGLE_CLIENT_ID";
-        readonly label: "Google OAuth client ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }, {
         readonly key: "GOOGLE_CLIENT_SECRET";
-        readonly label: "Google OAuth client secret";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }];
     readonly capabilities: readonly ["search", "import", "docs"];
     readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch", "analytics"];
     readonly oauth: {
-        readonly provider: "google";
-        readonly authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
-        readonly tokenUrl: "https://oauth2.googleapis.com/token";
-        readonly scopes: readonly ["https://www.googleapis.com/auth/drive.file"];
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_docs";
+    readonly label: "Google Docs";
+    readonly description: "Google Docs files for source material, document search, and agent-assisted writing workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_sheets";
+    readonly label: "Google Sheets";
+    readonly description: "Google Sheets workbooks for analysis, reporting, imports, and structured agent workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["analytics", "brain", "content", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_slides";
+    readonly label: "Google Slides";
+    readonly description: "Google Slides presentations for reference imports, visual context, and presentation workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
     };
 }, {
     readonly id: "hubspot";

package/dist/connections/catalog.js

@@ -1,6 +1,29 @@
 export function defineWorkspaceConnectionProvider(provider) {
     return provider;
 }
+const GOOGLE_CREDENTIAL_KEYS = [
+    {
+        key: "GOOGLE_CLIENT_ID",
+        label: "Managed Google OAuth client ID",
+        description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.",
+        required: true,
+    },
+    {
+        key: "GOOGLE_CLIENT_SECRET",
+        label: "Managed Google OAuth client secret",
+        description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.",
+        required: true,
+    },
+];
+const GOOGLE_OAUTH_BASE = {
+    provider: "google",
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+};
+function googleOAuth(scopes) {
+    return { ...GOOGLE_OAUTH_BASE, scopes };
+}
+const GOOGLE_IDENTITY_SCOPES = ["openid", "email", "profile"];
 export const WORKSPACE_CONNECTION_PROVIDERS = [
     defineWorkspaceConnectionProvider({
         id: "slack",
@@ -84,37 +107,35 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
         id: "gmail",
         label: "Gmail",
         description: "Mailbox messages and threads for search, triage, customer context, and agent replies.",
-        credentialKeys: [
-            {
-                key: "GOOGLE_CLIENT_ID",
-                label: "Google OAuth client ID",
-                required: true,
-            },
-            {
-                key: "GOOGLE_CLIENT_SECRET",
-                label: "Google OAuth client secret",
-                required: true,
-            },
-        ],
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
         capabilities: ["search", "import", "messages"],
         recommendedTemplateUses: ["mail", "brain", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/gmail.readonly",
+            "https://www.googleapis.com/auth/gmail.send",
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.settings.basic",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_calendar",
+        label: "Google Calendar",
+        description: "Calendars and events for scheduling, availability, reminders, and meeting workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "meetings"],
+        recommendedTemplateUses: ["calendar", "brain", "dispatch", "mail"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/calendar.readonly",
+            "https://www.googleapis.com/auth/calendar.events",
+        ]),
     }),
     defineWorkspaceConnectionProvider({
         id: "google_drive",
         label: "Google Drive",
         description: "Drive files, Docs, Sheets, and Slides for document search and import workflows.",
-        credentialKeys: [
-            {
-                key: "GOOGLE_CLIENT_ID",
-                label: "Google OAuth client ID",
-                required: true,
-            },
-            {
-                key: "GOOGLE_CLIENT_SECRET",
-                label: "Google OAuth client secret",
-                required: true,
-            },
-        ],
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
         capabilities: ["search", "import", "docs"],
         recommendedTemplateUses: [
             "brain",
@@ -123,12 +144,47 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
             "dispatch",
             "analytics",
         ],
-        oauth: {
-            provider: "google",
-            authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-            tokenUrl: "https://oauth2.googleapis.com/token",
-            scopes: ["https://www.googleapis.com/auth/drive.file"],
-        },
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/drive.file",
+            "https://www.googleapis.com/auth/drive.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_docs",
+        label: "Google Docs",
+        description: "Google Docs files for source material, document search, and agent-assisted writing workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["brain", "content", "slides", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/documents.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_sheets",
+        label: "Google Sheets",
+        description: "Google Sheets workbooks for analysis, reporting, imports, and structured agent workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["analytics", "brain", "content", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/spreadsheets.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_slides",
+        label: "Google Slides",
+        description: "Google Slides presentations for reference imports, visual context, and presentation workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["brain", "content", "slides", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/presentations.readonly",
+        ]),
     }),
     defineWorkspaceConnectionProvider({
         id: "hubspot",

package/dist/db/create-get-db.js

@@ -519,6 +519,24 @@ export function createGetDb(schema) {
                     });
                     return promise[prop].bind(promise);
                 }
+                // drizzle-orm duck-types "is this an SQL entity" by reading these two
+                // properties directly off a value — synchronously, without awaiting
+                // (see `isSQLWrapper` in drizzle-orm/sql/sql.js). Because this proxy's
+                // target is a function, answering that probe with another proxy would
+                // make an un-awaited chain (e.g. a subquery chain embedded as a raw
+                // value instead of being awaited — the pattern that broke
+                // list-recordings.ts) masquerade as a resolved SQL entity. drizzle
+                // then calls `.getSQL()` on it, which duck-types as a wrapper again,
+                // forever — `RangeError: Maximum call stack size exceeded` deep
+                // inside drizzle internals instead of a message pointing at the
+                // actual bug. Fail loudly here instead, at the point of misuse.
+                if (prop === "getSQL" || prop === "shouldOmitSQLParens") {
+                    throw new Error("getDb(): accessed an unresolved query chain synchronously " +
+                        `(reading '${String(prop)}'). This chain was embedded as a raw ` +
+                        "value instead of being awaited first — e.g. a subquery passed " +
+                        "straight into another expression. Await the chain before " +
+                        "using its result.");
+                }
                 // Symbol.toStringTag, Symbol.iterator, etc. — return another proxy
                 // Property access (e.g. db.query) — record and return another proxy
                 return createLazyProxy(ready, [...chain, { prop }]);

package/dist/db/ddl-guard.d.ts

@@ -125,10 +125,6 @@ export declare function ensureColumnExists(table: string, column: string, addCol
     lockTimeout?: string;
     injectedClient?: DbExec;
 }): Promise<boolean>;
-/**
- * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).
- * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.
- */
 export declare function ensureIndexExists(indexName: string, createIndexSql: string, options?: {
     lockTimeout?: string;
     injectedClient?: DbExec;

package/dist/db/ddl-guard.js

@@ -391,7 +391,46 @@ export async function ensureColumnExists(table, column, addColumnSql, options =
  * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).
  * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.
  */
+/**
+ * Drop an index that exists under this name but is INVALID.
+ *
+ * A failed `CREATE INDEX CONCURRENTLY` leaves the index present but unusable
+ * (`indisvalid = false`). That is a trap for every repair attempt that follows:
+ * `pgIndexExists` correctly reports it missing, but `CREATE INDEX IF NOT
+ * EXISTS` sees the NAME is taken and skips, so the re-probe fails again and the
+ * release never recovers on its own. Found in production on
+ * `chat_threads_owner_lower_updated_idx` and `sync_events_created_at_id_idx`.
+ *
+ * Dropping is safe: an invalid index serves no query and cannot be repaired in
+ * place — Postgres' own guidance is to drop and rebuild it.
+ */
+async function dropInvalidIndex(indexName, client) {
+    if (!PLAIN_IDENTIFIER.test(indexName))
+        return;
+    const { rows } = await client.execute({
+        sql: `SELECT 1
+          FROM pg_class AS index_class
+          JOIN pg_namespace AS index_namespace
+            ON index_namespace.oid = index_class.relnamespace
+           AND index_namespace.nspname = 'public'
+          JOIN pg_index AS index_state
+            ON index_state.indexrelid = index_class.oid
+          WHERE index_class.relname = ?
+            AND NOT index_state.indisvalid
+          LIMIT 1`,
+        args: [indexName],
+    });
+    if (rows.length === 0)
+        return;
+    console.warn(`[db] dropping INVALID index "${indexName}" so it can be rebuilt; ` +
+        `a previous CREATE INDEX left it unusable.`);
+    await client.execute(`DROP INDEX IF EXISTS "${indexName}"`);
+    invalidateSchemaSnapshot(client);
+}
 export async function ensureIndexExists(indexName, createIndexSql, options = {}) {
+    if ((options.dialectIsPostgres ?? isPostgres()) && !schemaEnsureDisabled()) {
+        await dropInvalidIndex(indexName, options.injectedClient ?? getDbExec());
+    }
     return ensureSchemaObject({
         probe: () => pgIndexExists(indexName, options.injectedClient, options.dialectIsPostgres),
         ddl: createIndexSql,
@@ -420,6 +459,13 @@ export async function ensureIndexExistsConcurrently(indexName, createIndexSql, o
     if (initiallyExists === undefined) {
         throw new Error(`ensureIndexExistsConcurrently: could not probe required index "${indexName}"; refusing to issue DDL`);
     }
+    // This helper is what STRANDS an invalid index in the first place: an
+    // interrupted concurrent build leaves the name taken and the index unusable,
+    // and `CREATE INDEX CONCURRENTLY IF NOT EXISTS` then skips it forever. Clear
+    // it here too, or the one caller that creates the mess is the one caller that
+    // cannot recover from it — which is how `sync_events_created_at_id_idx` has
+    // stayed invalid in production.
+    await dropInvalidIndex(indexName, client);
     await client.execute(createIndexSql);
     invalidateSchemaSnapshot(client);
     const existsAfterCreate = await pgIndexExists(indexName, client, options.dialectIsPostgres);

package/dist/deploy/build.d.ts

@@ -246,6 +246,25 @@ export declare function findNonLinuxBetterSqlite3Binaries(serverDir: string): st
 export declare function bundleYjsRuntimeForServerlessOutput(serverDir: string, projectCwd: string): string[];
 /** Presets whose Node-style output needs the emitted Yjs runtime bundle. */
 export declare function shouldBundleYjsRuntimeForPreset(targetPreset: string): boolean;
+/**
+ * Replace the bundled `better-sqlite3` with a throwing stub in serverless
+ * output.
+ *
+ * The package is 27MB — a 9.1MB `sqlite3.c`, its object files, and a static
+ * archive, none of which a function can use: every consumer is gated on a
+ * `file:` or schemeless `DATABASE_URL`, and a serverless container holding a
+ * file-backed SQLite database is already broken, since the filesystem is
+ * ephemeral and each container gets its own copy.
+ *
+ * It cannot simply be deleted. Drizzle's bundled `_libs/drizzle-orm+postgres`
+ * chunk imports it at module scope, so removing the package turns every cold
+ * start into `ERR_MODULE_NOT_FOUND` — which is how this was first written, and
+ * what the SSR cold-start smoke caught. The stub keeps the specifier
+ * resolvable and moves the failure to the only place it can be acted on: a
+ * deploy that actually tries to open a file-backed database, which now throws
+ * with the reason instead of quietly serving an empty one.
+ */
+export declare function stubLocalOnlySqliteDriverForServerless(serverDir: string): number;
 export declare function assertSingleTemplateNetlifyBuildOutput(projectCwd: string): void;
 /**
  * Strip the harmful single-template catch-all rewrite that points at