@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/deferred-index-build-BqmEHGaD.js

@@ -0,0 +1,1051 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-V7rFbMRe.js";
+import { h as searchIndexStatements, n as SEARCH_TEXT_FN, r as SEARCH_UNACCENT_FN, u as searchColumnStamps } from "./search-column-BM-GV6vH.js";
+import { n as extractPgError } from "./pg-error-utils-Bs_Ue4wn.js";
+import { u as vectorIndexStatement } from "./vector-index-BFhyEaiz.js";
+import { _ as sortIndexSpecs, l as collectionIndexStatement } from "./source-DB6xJv3p.js";
+import { a as triggerStatements, i as SET_UPDATED_AT_FN, r as quoteSqlLiteral } from "./plan-schema-CsNgK0qi.js";
+import { n as renderEnableRls, r as renderPgType, s as renderPrimaryKeyConstraint, t as renderColumnDefinition } from "./render-ddl-CrfEe__B.js";
+import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, o as isMultiStatementRefusal, r as atomicBatch } from "./boot-ddl-B9ZmBJ75.js";
+import { logger } from "@rebasepro/server";
+//#region src/schema/column-type-drift.ts
+/**
+* Types that mean the same thing to everything above the driver.
+*
+* Keyed by every spelling either side can produce: `information_schema` reports
+* `udt_name` (`int4`, `_numeric`, `bpchar`), while the generators emit SQL
+* (`INTEGER`, `NUMERIC[]`, `CHAR(3)`). Both are normalised through here.
+*/
+var FAMILIES = {
+	int2: "number",
+	smallint: "number",
+	int4: "number",
+	int: "number",
+	integer: "number",
+	int8: "number",
+	bigint: "number",
+	numeric: "number",
+	decimal: "number",
+	float4: "number",
+	real: "number",
+	float8: "number",
+	"double precision": "number",
+	money: "number",
+	text: "text",
+	varchar: "text",
+	"character varying": "text",
+	bpchar: "text",
+	char: "text",
+	character: "text",
+	citext: "text",
+	bool: "boolean",
+	boolean: "boolean",
+	json: "json",
+	jsonb: "jsonb",
+	uuid: "uuid",
+	bytea: "bytea",
+	date: "date",
+	time: "time",
+	"time without time zone": "time",
+	timetz: "time",
+	"time with time zone": "time",
+	timestamp: "timestamp",
+	"timestamp without time zone": "timestamp",
+	timestamptz: "timestamptz",
+	"timestamp with time zone": "timestamptz",
+	interval: "interval",
+	tsvector: "tsvector",
+	vector: "vector",
+	halfvec: "halfvec",
+	sparsevec: "sparsevec"
+};
+/**
+* One SQL or `udt_name` spelling reduced to its family, or `null` when this
+* module has no opinion about it.
+*
+* `null` is not a failure. It is the answer for an enum type, a domain, a
+* PostGIS column, a quoted qualified name — everything whose identity is a
+* *name* rather than a shape, where two spellings being different says nothing
+* about whether the values are compatible.
+*/
+function typeFamily(raw) {
+	if (!raw) return null;
+	let type = raw.trim().toLowerCase();
+	if (!type) return null;
+	if (type.startsWith("\"")) return null;
+	const generated = type.indexOf(" generated ");
+	if (generated > 0) type = type.slice(0, generated).trim();
+	if (type.endsWith("[]")) {
+		const element = typeFamily(type.slice(0, -2));
+		return element && `array:${element}`;
+	}
+	if (type.startsWith("_")) {
+		const element = typeFamily(type.slice(1));
+		return element && `array:${element}`;
+	}
+	const paren = type.indexOf("(");
+	if (paren > 0) type = type.slice(0, paren).trim();
+	return FAMILIES[type] ?? null;
+}
+/**
+* Do these two spellings describe columns that hold the same kind of value?
+*
+* `true` whenever the answer is not confidently "no" — an unrecognised type on
+* either side agrees with everything, because a report needs evidence and an
+* unknown type is the absence of it.
+*/
+function typesAgree(declared, actual) {
+	const a = typeFamily(declared);
+	const b = typeFamily(actual);
+	if (a === null || b === null) return true;
+	if (a !== b) return false;
+	if (!isNumeric(declared) || !isNumeric(actual)) return true;
+	const declaredModifier = numericModifier(declared);
+	if (declaredModifier === null) return true;
+	return declaredModifier === numericModifier(actual);
+}
+/** `NUMERIC`, `numeric(10,2)`, `DECIMAL(10, 2)` — the arbitrary-precision type itself. */
+function isNumeric(raw) {
+	return /^\s*(?:numeric|decimal)\s*(?:\(|$)/i.test(raw);
+}
+/**
+* `numeric(10,2)` / `NUMERIC(10, 2)` → `10,2`; a bare `numeric` → `null`. A
+* precision alone means a scale of 0, which is how the catalogue reports it:
+* `NUMERIC(10)` → `10,0`.
+*/
+function numericModifier(raw) {
+	const match = raw.match(/\(([^)]*)\)/);
+	if (!match) return null;
+	const [precision, scale = "0"] = match[1].split(",").map((part) => part.trim());
+	return `${precision},${scale}`;
+}
+/**
+* The sentence a boot log says about one drifted column.
+*
+* Written to be actionable in the place it is read, which is a runtime log with
+* no way to run a migration from it: it names both types, says which surface
+* will break first, and gives the statement that resolves it.
+*/
+function columnTypeDriftMessage(drift) {
+	const [schema, table] = drift.table.split(".");
+	return `Column "${drift.table}"."${drift.column}" is ${drift.actual} in the database, but this collection declares ${drift.declared}. Boot does not change an existing column's type, so the database keeps what it has and writes that match the declaration will be rejected by Postgres. Change it deliberately, when you can watch it:
+    ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${drift.column}" TYPE ${drift.declared} USING "${drift.column}"::${drift.declared};`;
+}
+//#endregion
+//#region src/schema/plan/diff-plan.ts
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* Validation used to run only on the names read back OUT of the catalogue,
+* which is the direction that cannot hurt anyone: those came from Postgres. The
+* names going IN — the schema and table a collection declares — were quoted and
+* concatenated on trust, and quoting is not escaping. A table named
+* `x" (id int); DROP TABLE users; --` closes the quote and the statement, and
+* the whole thing runs on the owner connection, which is the one connection in
+* the system that is exempt from every RLS policy.
+*
+* That is only a config file on a self-hosted project, where the person writing
+* it could run the SQL directly anyway. It is not only a config file where a
+* collection can be defined over the wire — the live-schema and source editors
+* both do that — and there the caller is an admin on the app, not an operator
+* of the database.
+*/
+function assertSafeIdentifier(value, what) {
+	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
+	return value;
+}
+/**
+* The functions the plan creates with `CREATE OR REPLACE`, which the catalogue
+* reader looks up so a boot that finds them unchanged plans nothing.
+*
+* A helper missing from this list is not wrong, only re-created on every boot,
+* which is what all of them were before.
+*/
+var HELPER_FUNCTIONS = [
+	SEARCH_TEXT_FN,
+	SEARCH_UNACCENT_FN,
+	SET_UPDATED_AT_FN
+];
+var helperFunctionKey = (schema, name, args) => `${schema}.${name}(${args.replace(/\s+/g, " ").trim().toLowerCase()})`;
+var describeHelperFunction = (facts) => JSON.stringify([
+	facts.returns.toLowerCase(),
+	facts.language.toLowerCase(),
+	facts.volatility,
+	facts.strict,
+	facts.parallel,
+	facts.securityDefiner,
+	facts.leakproof,
+	Number(facts.cost),
+	facts.hasConfig,
+	facts.body
+]);
+var HELPER_FUNCTION_RE = /* @__PURE__ */ new RegExp("^\\s*CREATE OR REPLACE FUNCTION\\s+([A-Za-z_]\\w*)\\.([A-Za-z_]\\w*)\\(([^)]*)\\)\\s+RETURNS\\s+([\\w\\[\\]]+)\\s+LANGUAGE\\s+(\\w+)((?:\\s+(?:IMMUTABLE|STABLE|VOLATILE|STRICT|PARALLEL\\s+(?:SAFE|RESTRICTED|UNSAFE)))*)\\s+AS\\s+\\$\\$([\\s\\S]*)\\$\\$;?\\s*$", "i");
+/**
+* What a helper's `CREATE OR REPLACE FUNCTION` statement would leave in the
+* catalogue, or `undefined` for a statement this does not recognise — which is
+* then planned unconditionally, as every statement was before.
+*
+* Only ever given statements this package renders (`searchHelperFunctions`,
+* `setUpdatedAtFunction`), so a strict pattern is the right tool: anything it
+* does not match exactly falls back to the safe behaviour.
+*/
+function parseHelperFunction(statement) {
+	const match = HELPER_FUNCTION_RE.exec(statement);
+	if (!match) return void 0;
+	const [, schema, name, args, returns, language, attributes, body] = match;
+	const words = attributes.toUpperCase();
+	const parallel = /PARALLEL\s+SAFE/.test(words) ? "s" : /PARALLEL\s+RESTRICTED/.test(words) ? "r" : "u";
+	const volatility = /\bIMMUTABLE\b/.test(words) ? "i" : /\bSTABLE\b/.test(words) ? "s" : "v";
+	return {
+		key: helperFunctionKey(schema, name, args),
+		definition: describeHelperFunction({
+			returns,
+			language,
+			volatility,
+			strict: /\bSTRICT\b/.test(words),
+			parallel,
+			securityDefiner: false,
+			leakproof: false,
+			cost: 100,
+			hasConfig: false,
+			body
+		})
+	};
+}
+/** The name a rendered `CREATE [UNIQUE] INDEX [CONCURRENTLY] IF NOT EXISTS "<name>"` creates. */
+var indexNameOf = (statement) => /^\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?IF\s+NOT\s+EXISTS\s+"([^"]+)"/i.exec(statement)?.[1];
+/** The extension a rendered `CREATE EXTENSION IF NOT EXISTS <name> …` installs. */
+var extensionNameOf = (statement) => /^\s*CREATE\s+EXTENSION\s+IF\s+NOT\s+EXISTS\s+"?([\w-]+)"?/i.exec(statement)?.[1];
+/**
+* Whether a column is part of the table's primary key.
+*
+* Those are created with the table, in step 2, and never added afterwards: a
+* key column missing from a table that already exists cannot be made part of
+* its key by an additive change, so there is nothing safe to plan for one.
+*
+* A relation's entry for a column a declared property owns is not the column —
+* it carries only the constraint — so it is not a key column either, or the
+* key would be created twice.
+*/
+var isKeyColumn = (table, column) => !column.columnOwnedByProperty && table.primaryKey.includes(column.column);
+/**
+* A declared key whose default is the built-in uuid generator: the default
+* `isId: "uuid"` plans. It is the one declared-key default boot sets on an
+* existing table, because it is the one that cannot fail there.
+*/
+var isUuidKeyDefault = (column) => column.source.kind === "property" && column.default?.kind === "sql" && column.default.expression === "gen_random_uuid()";
+/** Which pass a column belongs to. The order below is the order they run in. */
+var isScalarProperty = (table, column) => (column.source.kind === "property" || column.source.kind === "implicit-id") && !isKeyColumn(table, column);
+/**
+* `ENABLE ROW LEVEL SECURITY` on a table this plan has just created — the
+* statement immediately after its `CREATE TABLE`, never later.
+*
+* The user role every authenticated request runs as holds DML on a new table
+* the moment it exists: the schema's default privileges grant it, and boot's
+* `ensureAppRole` grants it on every table before the policies run. The
+* policies — which also switch RLS on — come after the driver and auth have
+* initialised, so any failure in between left a table with full DML and no row
+* filtering, served by every process in the deployment that does not
+* provision. Born locked, a table denies until its policies arrive, which is
+* the state a failure is allowed to leave behind. Idempotent, so a table a
+* concurrent boot created gets the same statement and nothing changes.
+*/
+var lockAction = (table) => ({
+	kind: "enable-rls",
+	target: table.qualified,
+	sql: renderEnableRls(table)
+});
+function diffPlanAgainstCatalogue(plan, existing, options = {}) {
+	const constraintPolicy = options.constraints ?? "additive";
+	const actions = [];
+	const withheldConstraints = [];
+	const columnTypeDrift = [];
+	const legacyForeignKeys = [];
+	const searchDrift = [];
+	const searchAdopted = [];
+	const collectionTables = plan.tables.filter((t) => t.kind === "collection");
+	const junctionTables = plan.tables.filter((t) => t.kind === "junction");
+	for (const enumPlan of plan.enums) {
+		assertSafeIdentifier(enumPlan.schema, "schema name");
+		if (existing.enums.has(enumPlan.qualified)) {
+			const current = existing.enumValues?.get(enumPlan.qualified);
+			if (!current) continue;
+			for (const value of enumPlan.labels) {
+				if (current.includes(value)) continue;
+				actions.push({
+					kind: "add-enum-value",
+					target: `${enumPlan.qualified}.${value}`,
+					sql: `ALTER TYPE "${enumPlan.schema}"."${enumPlan.name}" ADD VALUE IF NOT EXISTS ${quoteSqlLiteral(value)};`
+				});
+			}
+			continue;
+		}
+		actions.push({
+			kind: "create-enum",
+			target: enumPlan.qualified,
+			sql: `CREATE TYPE "${enumPlan.schema}"."${enumPlan.name}" AS ENUM (${enumPlan.labels.map(quoteSqlLiteral).join(", ")});`
+		});
+	}
+	for (const statement of plan.extensions) {
+		const extension = extensionNameOf(statement);
+		if (extension && existing.extensions?.has(extension)) continue;
+		actions.push({
+			kind: "create-extension",
+			target: statement.replace(/^CREATE EXTENSION IF NOT EXISTS |;$/g, ""),
+			sql: statement
+		});
+	}
+	for (const statement of plan.functions) {
+		const helper = parseHelperFunction(statement);
+		if (helper && existing.functions?.get(helper.key) === helper.definition) continue;
+		actions.push({
+			kind: "create-function",
+			target: functionTarget(statement),
+			sql: statement
+		});
+	}
+	const created = /* @__PURE__ */ new Set();
+	for (const table of collectionTables) {
+		if (existing.tables.has(table.qualified) || created.has(table.qualified)) continue;
+		created.add(table.qualified);
+		const schema = assertSafeIdentifier(table.schema, "schema name");
+		const name = assertSafeIdentifier(table.table, "table name");
+		const keyColumns = table.columns.filter((c) => isKeyColumn(table, c));
+		const definitions = keyColumns.length > 0 ? keyColumns.map((c) => `"${assertSafeIdentifier(c.column, "column name")}" ${renderColumnDefinition(c)}`) : ["\"id\" TEXT PRIMARY KEY"];
+		if (keyColumns.length > 1) definitions.push(renderPrimaryKeyConstraint(table));
+		actions.push({
+			kind: "create-table",
+			target: table.qualified,
+			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${name}" (${definitions.join(", ")});`
+		});
+		actions.push(lockAction(table));
+	}
+	for (const table of junctionTables) {
+		if (existing.tables.has(table.qualified) || created.has(table.qualified)) continue;
+		created.add(table.qualified);
+		const columns = table.columns.map((c) => `"${c.column}" ${renderColumnDefinition(c)}`).join(", ");
+		actions.push({
+			kind: "create-table",
+			target: table.qualified,
+			sql: `CREATE TABLE IF NOT EXISTS "${table.schema}"."${table.table}" (${columns}, ${renderPrimaryKeyConstraint(table)});`
+		});
+		actions.push(lockAction(table));
+	}
+	const addColumn = (table, column, definition) => {
+		if (existing.tables.get(table.qualified)?.has(column)) return;
+		assertSafeIdentifier(column, "column name");
+		actions.push({
+			kind: "add-column",
+			target: `${table.qualified}.${column}`,
+			sql: `ALTER TABLE "${table.schema}"."${table.table}" ADD COLUMN IF NOT EXISTS "${column}" ${definition};`
+		});
+	};
+	/**
+	* Move a column that is only missing because it was renamed.
+	*
+	* Returns true when it handled the column, so the caller skips the ordinary
+	* ADD. Adding would be the wrong move and a quiet one: the data is in the
+	* old column, `ADD COLUMN` creates the new one empty beside it, every
+	* statement succeeds, and the relation reads the empty one. A rename is
+	* metadata-only in Postgres, keeps the values, and carries the column's
+	* indexes and constraints with it.
+	*/
+	const renameLegacyColumn = (table, column) => {
+		const present = existing.tables.get(table.qualified);
+		if (!column.legacyColumn || !present) return false;
+		if (present.has(column.column) || !present.has(column.legacyColumn)) return false;
+		legacyForeignKeys.push({
+			table: table.qualified,
+			expected: column.column,
+			legacy: column.legacyColumn
+		});
+		actions.push({
+			kind: "rename-column",
+			target: `${table.qualified}.${column.column}`,
+			sql: `ALTER TABLE "${table.schema}"."${table.table}" RENAME COLUMN "${column.legacyColumn}" TO "${column.column}";`
+		});
+		return true;
+	};
+	/**
+	* A `NOT NULL` is safe exactly when it cannot fail against rows that are
+	* already there, and there are three ways to know that:
+	*
+	*  - the table is being created by this plan (no rows yet);
+	*  - the table exists and is empty;
+	*  - the column arrives with a DEFAULT, which Postgres backfills into every
+	*    existing row as part of ADD COLUMN.
+	*
+	* `populatedTables` absent means the caller does not know, and not knowing
+	* has to read as "assume rows" — the other direction emits a NOT NULL that
+	* is checked against live data and aborts the boot. Written as an explicit
+	* `!== undefined` because the optional-chain form quietly says *empty* when
+	* the fact is missing, which is the wrong way to be wrong.
+	*/
+	const tableIsEmpty = (table) => existing.populatedTables !== void 0 && existing.tables.has(table.qualified) && !existing.populatedTables.has(table.qualified);
+	/**
+	* The column is there and holds a different kind of value than the
+	* collection says it does. Reported, never altered: an unattended `ALTER
+	* COLUMN … TYPE` over customer data is not a thing to do quietly, and the
+	* *quiet* is what this fixes. A deploy that changed a `columnType` used to
+	* report success while the column stayed as it was, and the divergence
+	* surfaced later as every write failing. A column whose definition is owned
+	* elsewhere (auth, or a generated search column) is not compared: the
+	* declaration there is a rendered string rather than a type, and auth's own
+	* reconcile owns it.
+	*/
+	const reportTypeDrift = (table, column) => {
+		const key = `${table.qualified}.${column.column}`;
+		if (existing.tables.get(table.qualified)?.has(column.column) !== true || column.sqlDefinition) return;
+		const declaredType = renderPgType(column.type);
+		const actualType = existing.columnTypes?.get(key);
+		if (actualType && !typesAgree(declaredType, actualType)) columnTypeDrift.push({
+			table: table.qualified,
+			column: column.column,
+			declared: declaredType,
+			actual: actualType
+		});
+	};
+	/**
+	* `SET DEFAULT` on a column that is already there and has none.
+	*
+	* A DEFAULT binds future writes only, so `SET DEFAULT` cannot fail on data
+	* and cannot touch a row that already exists. That makes it the one
+	* convergence this path may do unattended — and it has to, because
+	* `ADD COLUMN IF NOT EXISTS` is a no-op against an existing column, so a
+	* `defaultValue` added to a live collection would otherwise never reach the
+	* database at all.
+	*/
+	const planMissingDefault = (table, column) => {
+		if (!column.default || column.default.kind === "identity" || column.generated) return;
+		const key = `${table.qualified}.${column.column}`;
+		if (existing.columnDefaults?.has(key)) return;
+		const expression = column.default.kind === "sql" ? column.default.expression : column.default.sql;
+		actions.push({
+			kind: "set-default",
+			target: key,
+			sql: `ALTER TABLE "${table.schema}"."${table.table}" ALTER COLUMN "${column.column}" SET DEFAULT ${expression};`
+		});
+	};
+	/**
+	* Plan one column, with the constraints this database can safely take.
+	*
+	* The definition comes from the same renderer `schema.sql` uses, minus the
+	* constraints that are checked against live rows. That subtraction is the
+	* whole of what this path is allowed to decide for itself.
+	*/
+	const planColumn = (table, column) => {
+		const key = `${table.qualified}.${column.column}`;
+		const columnExists = existing.tables.get(table.qualified)?.has(column.column) === true;
+		const fresh = created.has(table.qualified);
+		const empty = tableIsEmpty(table);
+		const required = !column.nullable;
+		const hasDefault = column.default !== void 0;
+		reportTypeDrift(table, column);
+		const notNullIsSafe = fresh || empty || hasDefault;
+		const uniqueIsSafe = fresh || empty || !hasDefault;
+		const applicable = {
+			...column,
+			unique: column.unique && !columnExists && uniqueIsSafe,
+			nullable: column.nullable || !(notNullIsSafe || columnExists)
+		};
+		if (column.unique && !columnExists && !uniqueIsSafe) withheldConstraints.push({
+			target: key,
+			kind: "unique",
+			reason: `"${column.column}" is unique, but "${table.qualified}" ` + (existing.populatedTables === void 0 ? "may already hold rows" : "already holds rows") + " and the column's default would give every one of them the same value, so UNIQUE would fail as it was added.",
+			remedy: `Give each existing row its own value, then add the constraint — \`ALTER TABLE "${table.schema}"."${table.table}" ADD UNIQUE ("${column.column}")\` — or drop the property's default.`
+		});
+		if (required && !columnExists && !notNullIsSafe) withheldConstraints.push({
+			target: key,
+			kind: "not-null",
+			reason: column.source.kind === "relation" || column.source.kind === "reference" ? `"${column.column}" is a required link, but "${table.qualified}" already holds rows and the column has no default to backfill them with, so NOT NULL would be checked against data that does not have a value yet.` : `"${column.column}" is required, but "${table.qualified}" already holds rows and the column has no default to backfill them with, so NOT NULL would be checked against data that does not have a value yet.`,
+			remedy: column.source.kind === "relation" || column.source.kind === "reference" ? "Backfill the column, then add the constraint — or make the relation optional." : "Backfill the column, then add the constraint — or give the property a default so every existing row gets one."
+		});
+		addColumn(table, column.column, renderColumnDefinition(applicable));
+		if (!columnExists) return;
+		planMissingDefault(table, column);
+		if (constraintPolicy !== "converge") return;
+		const isNotNull = existing.notNullColumns?.has(key) === true;
+		if (required && !isNotNull) if (empty) actions.push({
+			kind: "set-not-null",
+			target: key,
+			sql: `ALTER TABLE "${table.schema}"."${table.table}" ALTER COLUMN "${column.column}" SET NOT NULL;`
+		});
+		else withheldConstraints.push({
+			target: key,
+			kind: "not-null",
+			reason: `"${column.column}" became required, but "${table.qualified}" holds rows and any of them with no value would make SET NOT NULL fail.`,
+			remedy: "Backfill the column first — `UPDATE … SET \"" + column.column + "\" = … WHERE \"" + column.column + "\" IS NULL` — then apply this again."
+		});
+		if (!required && isNotNull) actions.push({
+			kind: "drop-not-null",
+			target: key,
+			sql: `ALTER TABLE "${table.schema}"."${table.table}" ALTER COLUMN "${column.column}" DROP NOT NULL;`
+		});
+	};
+	for (const table of collectionTables) {
+		assertSafeIdentifier(table.schema, "schema name");
+		assertSafeIdentifier(table.table, "table name");
+		for (const column of table.columns) {
+			if (!isScalarProperty(table, column)) continue;
+			planColumn(table, column);
+		}
+		for (const column of table.columns) {
+			if (!column.primaryKey) continue;
+			if (column.source.kind !== "implicit-id" && !isUuidKeyDefault(column)) continue;
+			if (existing.tables.get(table.qualified)?.has(column.column) !== true) continue;
+			planMissingDefault(table, column);
+		}
+		for (const column of table.columns) {
+			if (column.source.kind !== "auth") continue;
+			addColumn(table, column.column, renderColumnDefinition(column));
+		}
+	}
+	for (const table of collectionTables) {
+		if (!table.search) continue;
+		const definitions = new Map(table.columns.filter((c) => c.source.kind === "search").map((c) => [c.column, renderColumnDefinition(c)]));
+		for (const stamp of searchColumnStamps(table.search)) {
+			const definition = definitions.get(stamp.column);
+			const exists = existing.tables.get(table.qualified)?.has(stamp.column) === true;
+			const recorded = existing.columnComments?.get(`${table.qualified}.${stamp.column}`);
+			if (exists && recorded?.startsWith("rebase:search:v1:") && recorded !== stamp.fingerprint) {
+				searchDrift.push({
+					table: table.qualified,
+					column: stamp.column,
+					found: recorded,
+					expected: stamp.fingerprint,
+					rebuild: [
+						`ALTER TABLE "${table.schema}"."${table.table}" DROP COLUMN "${stamp.column}";`,
+						`ALTER TABLE "${table.schema}"."${table.table}" ADD COLUMN "${stamp.column}" ${definition};`,
+						stamp.sql
+					]
+				});
+				continue;
+			}
+			addColumn(table, stamp.column, definition);
+			if (exists && recorded === void 0) searchAdopted.push({
+				table: table.qualified,
+				column: stamp.column
+			});
+			if (recorded !== stamp.fingerprint) actions.push({
+				kind: "comment-column",
+				target: `${table.qualified}.${stamp.column}`,
+				sql: stamp.sql
+			});
+		}
+	}
+	for (const table of junctionTables) {
+		if (created.has(table.qualified)) continue;
+		for (const column of table.columns) {
+			if (renameLegacyColumn(table, column)) continue;
+			if (column.source.kind === "property") {
+				planColumn(table, column);
+				continue;
+			}
+			reportTypeDrift(table, column);
+			addColumn(table, column.column, renderPgType(column.type));
+		}
+	}
+	for (const table of collectionTables) for (const column of table.columns) {
+		if (column.source.kind !== "relation" && column.source.kind !== "reference") continue;
+		if (column.columnOwnedByProperty) continue;
+		if (isKeyColumn(table, column)) continue;
+		if (renameLegacyColumn(table, column)) continue;
+		planColumn(table, column);
+	}
+	const knownConstraints = existing.constraints ?? /* @__PURE__ */ new Set();
+	const plannedConstraints = /* @__PURE__ */ new Set();
+	for (const table of [...collectionTables, ...junctionTables]) for (const column of table.columns) {
+		const fk = column.foreignKey;
+		if (!fk) continue;
+		const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
+		if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
+		plannedConstraints.add(name);
+		actions.push({
+			kind: "add-constraint",
+			target: name,
+			sql: `${fk.sql};`
+		});
+	}
+	const concurrent = (schema, table) => !created.has(`${schema}.${table}`);
+	const indexExists = (schema, name) => name !== void 0 && existing.indexes?.has(`${schema}.${name}`) === true;
+	const deferredIndexes = [];
+	const toBuilder = (schema, table, derived) => concurrent(schema, table) && (derived || options.deferLiveIndexes === true);
+	const deferIndex = (build) => {
+		const invalid = existing.invalidIndexes?.has(`${build.schema}.${build.indexName}`) === true;
+		if (indexExists(build.schema, build.indexName) && !invalid) return;
+		deferredIndexes.push({
+			...build,
+			invalid
+		});
+	};
+	/** A search or vector statement in its concurrent form, or undefined if it has no plain `CREATE INDEX IF NOT EXISTS`. */
+	const concurrentForm = (statement) => {
+		const rewritten = statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS");
+		return rewritten === statement ? void 0 : rewritten;
+	};
+	for (const table of collectionTables) {
+		if (!table.search) continue;
+		const { schema, table: tableName } = table.search;
+		for (const statement of searchIndexStatements(table.search)) {
+			const name = indexNameOf(statement);
+			const sql = concurrentForm(statement);
+			if (name !== void 0 && sql !== void 0 && toBuilder(schema, tableName, false)) {
+				deferIndex({
+					schema,
+					table: tableName,
+					indexName: name,
+					sql
+				});
+				continue;
+			}
+			if (indexExists(table.schema, name)) continue;
+			actions.push({
+				kind: "create-index",
+				target: table.qualified,
+				sql: concurrent(table.schema, table.table) ? statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : statement
+			});
+		}
+	}
+	const vectorIndexSkipped = [];
+	for (const table of collectionTables) {
+		if (!table.vector) continue;
+		for (const spec of table.vector.specs) {
+			const sql = concurrentForm(vectorIndexStatement(spec));
+			if (sql !== void 0 && toBuilder(spec.schema, spec.table, false)) {
+				deferIndex({
+					schema: spec.schema,
+					table: spec.table,
+					indexName: spec.indexName,
+					sql
+				});
+				continue;
+			}
+			if (indexExists(spec.schema, spec.indexName)) continue;
+			actions.push({
+				kind: "create-index",
+				target: `${spec.schema}.${spec.table}`,
+				sql: concurrent(spec.schema, spec.table) ? vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : vectorIndexStatement(spec)
+			});
+		}
+		vectorIndexSkipped.push(...table.vector.skipped);
+	}
+	for (const spec of sortIndexSpecs([...collectionTables, ...junctionTables].flatMap((t) => t.indexes))) {
+		if (toBuilder(spec.schema, spec.table, spec.derived === "foreign-key")) {
+			deferIndex({
+				schema: spec.schema,
+				table: spec.table,
+				indexName: spec.indexName,
+				sql: collectionIndexStatement(spec, {
+					concurrently: true,
+					ifNotExists: true
+				}),
+				...spec.unique ? { unique: true } : {}
+			});
+			continue;
+		}
+		if (indexExists(spec.schema, spec.indexName)) continue;
+		actions.push({
+			kind: "create-index",
+			target: `${spec.schema}.${spec.table}`,
+			sql: collectionIndexStatement(spec, {
+				concurrently: concurrent(spec.schema, spec.table),
+				ifNotExists: true
+			})
+		});
+	}
+	for (const table of collectionTables) for (const trigger of table.triggers) {
+		if (existing.triggers?.has(`${table.qualified}.${trigger.name}`)) continue;
+		for (const statement of triggerStatements(trigger)) actions.push({
+			kind: "create-trigger",
+			target: `${table.qualified}.${trigger.name}`,
+			sql: statement
+		});
+	}
+	const orphanedRequiredColumns = [];
+	if (existing.notNullColumns && existing.columnDefaults) for (const table of collectionTables) {
+		const live = existing.tables.get(table.qualified);
+		if (!live || created.has(table.qualified)) continue;
+		const declared = /* @__PURE__ */ new Set();
+		for (const column of table.columns) {
+			declared.add(column.column);
+			if (column.legacyColumn) declared.add(column.legacyColumn);
+		}
+		for (const column of live) {
+			const key = `${table.qualified}.${column}`;
+			if (declared.has(column)) continue;
+			if (!existing.notNullColumns.has(key)) continue;
+			if (existing.columnDefaults.has(key)) continue;
+			orphanedRequiredColumns.push({
+				table: table.qualified,
+				column,
+				slug: table.slug
+			});
+		}
+	}
+	return {
+		actions,
+		statements: actions.map((a) => a.sql),
+		legacyForeignKeys,
+		searchDrift,
+		searchAdopted,
+		vectorIndexSkipped,
+		withheldConstraints,
+		columnTypeDrift,
+		orphanedRequiredColumns,
+		deferredIndexes
+	};
+}
+/** What a `CREATE FUNCTION` statement is called, for the action log. */
+var functionTarget = (statement) => {
+	if (statement.includes("set_updated_at")) return SET_UPDATED_AT_FN;
+	return statement.includes("unaccent") ? SEARCH_UNACCENT_FN : SEARCH_TEXT_FN;
+};
+//#endregion
+//#region src/schema/deferred-index-build.ts
+var deferred_index_build_exports = /* @__PURE__ */ __exportAll({
+	TABLE_BUSY_REASON: () => TABLE_BUSY_REASON,
+	buildDeferredIndexes: () => buildDeferredIndexes,
+	isPgPool: () => isPgPool,
+	poolIndexBuildSession: () => poolIndexBuildSession,
+	scheduleDeferredIndexBuild: () => scheduleDeferredIndexBuild
+});
+/** A client-side read timeout no index build reaches. A pool's is 60 s. */
+var INDEX_BUILD_READ_TIMEOUT_MS = 1440 * 60 * 1e3;
+/** A `pg.Pool` — what `connect()` checks a client out of — and not a `pg.Client`, whose `connect()` opens a socket. */
+var isPgPool = (value) => typeof value === "object" && value !== null && "connect" in value && typeof value.connect === "function" && "totalCount" in value;
+/**
+* Sessions checked out of a `pg.Pool`, one connection each.
+*
+* Its own connection rather than the pool's next free one, because a build
+* has to outlive both of a pool's timeouts: the server-side
+* `statement_timeout` (30 s on this framework's pools), which the builder
+* lifts for the session — something it may only do on a connection nobody
+* else is handed until it is reset — and the client-side read timeout, which
+* is lifted here per query.
+*/
+var poolIndexBuildSession = (pool) => async () => {
+	const client = await pool.connect();
+	return {
+		dedicated: true,
+		async query(text) {
+			const config = {
+				text,
+				query_timeout: INDEX_BUILD_READ_TIMEOUT_MS
+			};
+			return { rows: (await client.query(config)).rows };
+		},
+		release: () => client.release()
+	};
+};
+/** `42P01 undefined_table` — `pg_stat_progress_create_index` before Postgres 12. */
+var isUndefinedTable = (err) => extractPgError(err)?.code === "42P01";
+/** `25001 active_sql_transaction` — `CONCURRENTLY` on a connection inside a transaction block. */
+var isTransactionBlockRefusal = (err) => extractPgError(err)?.code === "25001";
+/**
+* The rows themselves violate a UNIQUE index being built: `23505` naming the
+* index (a lost catalogue race names a `pg_` index instead). Building it again
+* would only fail again, so it is not retried.
+*/
+var isDuplicateRows = (err, index) => {
+	const pg = extractPgError(err);
+	return pg?.code === "23505" && (pg.constraint === index.indexName || /could not create unique index/i.test(pg.message));
+};
+var CONCURRENTLY_RE = /\sCONCURRENTLY\s/i;
+/** Why an index is skipped while a build of another index holds its table. */
+var TABLE_BUSY_REASON = "another index on the table is being built";
+/**
+* Run a `CONCURRENTLY` statement — or its plain form, when the connection
+* turns out to be inside a transaction block. Only a shared handle can be: an
+* application that builds its own adapter may hand over a connection already
+* in one. The plain form is always accepted and takes a write lock for the
+* build, which is the cost of getting the index at all — the same fallback the
+* ensure's own index actions have.
+*/
+async function runConcurrently(session, sql, qualified) {
+	try {
+		await session.query(sql);
+	} catch (err) {
+		if (!isTransactionBlockRefusal(err) || !CONCURRENTLY_RE.test(sql)) throw err;
+		logger.warn(`[schema] ${qualified}: this connection is inside a transaction, so the index is built with a write lock rather than concurrently. Writes to the table block until it finishes.`);
+		await session.query(sql.replace(CONCURRENTLY_RE, " "));
+	}
+}
+async function readIndexState(session, index) {
+	const schema = quoteSqlLiteral(index.schema);
+	const name = quoteSqlLiteral(index.indexName);
+	const { rows } = await session.query(`SELECT i.indisvalid AS valid
+         FROM pg_index i
+         JOIN pg_class c ON c.oid = i.indexrelid
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         WHERE n.nspname = ${schema} AND c.relname = ${name}`);
+	const valid = rows.length === 0 ? null : rows[0].valid === true;
+	if (valid !== false) return {
+		valid,
+		building: false
+	};
+	return {
+		valid,
+		building: await tableIsBeingIndexed(session, index)
+	};
+}
+/**
+* Wait, within the boot's lock budget, until the table's lock is free.
+*
+* A probe rather than a `lock_timeout` on the build itself: the build waits on
+* lock *queues* in three phases, and only the first — getting the table — is
+* a wait worth bounding. The other two wait for transactions that were
+* already running, which block nobody while they run and must simply be let
+* finish. `true` when the table was free (or cannot be probed on this
+* handle), `false` when something held it for the whole budget.
+*/
+async function tableLockIsFree(session, index, options) {
+	const lock = resolveBootLockOptions(options);
+	const probe = atomicBatch([`LOCK TABLE "${index.schema}"."${index.table}" IN SHARE UPDATE EXCLUSIVE MODE`], lock.lockTimeoutMs);
+	const deadline = Date.now() + (options.retryBudgetMs ?? 1e4);
+	for (let round = 1;; round++) try {
+		await session.query(probe);
+		return true;
+	} catch (err) {
+		if (isMultiStatementRefusal(err)) return true;
+		if (!isLockTimeout(err)) throw err;
+		if (round >= lock.attempts || Date.now() >= deadline) return false;
+		await sleep(Math.min(lock.backoffMs(round), Math.max(0, deadline - Date.now())));
+	}
+}
+/** Whether another backend is running `CREATE INDEX` on the index's table right now. */
+async function tableIsBeingIndexed(session, index) {
+	const table = quoteSqlLiteral(`"${index.schema}"."${index.table}"`);
+	try {
+		const { rows } = await session.query(`SELECT EXISTS (
+                 SELECT 1 FROM pg_stat_progress_create_index
+                 WHERE relid = to_regclass(${table}) AND pid <> pg_backend_pid()
+             ) AS building`);
+		return rows[0]?.building === true;
+	} catch (err) {
+		if (isUndefinedTable(err)) return false;
+		throw err;
+	}
+}
+/**
+* The advisory-lock key one index is claimed under, across every instance.
+*
+* Without a claim, instances booting together all issue the same
+* `CREATE INDEX CONCURRENTLY`: one wins, the others skip by name — reporting
+* success while the winner is still building — or wait on each other's
+* transactions until Postgres breaks the deadlock by cancelling one, which
+* leaves a husk. With it, one instance builds and the rest step aside.
+*/
+var claimKey = (index) => `hashtext(${quoteSqlLiteral(`rebase_fk_index:${index.schema}.${index.indexName}`)})`;
+/**
+* Build one index under its claim — session-level, so only on a connection
+* of our own. On a shared handle the claim could be taken on one backend and
+* released on another, so there is none, and concurrent instances fall back
+* on the state checks below.
+*/
+async function buildClaimed(session, index, options, outcome) {
+	if (!session.dedicated) return buildOne(session, index, options, outcome);
+	const { rows } = await session.query(`SELECT pg_try_advisory_lock(${claimKey(index)}) AS claimed`);
+	if (rows[0]?.claimed !== true) {
+		outcome.skipped.push({
+			index: `${index.schema}.${index.indexName}`,
+			reason: "another instance is building it"
+		});
+		options.log?.(`${index.schema}.${index.indexName}: another instance is building it — leaving it to that one`);
+		return;
+	}
+	try {
+		await buildOne(session, index, options, outcome);
+	} finally {
+		await session.query(`SELECT pg_advisory_unlock(${claimKey(index)})`);
+	}
+}
+/** One index, from whatever state it is in to valid — or a reason it is not. */
+async function buildOne(session, index, options, outcome) {
+	const qualified = `${index.schema}.${index.indexName}`;
+	const target = `"${index.schema}"."${index.indexName}"`;
+	const say = (message) => options.log?.(message);
+	for (let attempt = 1; attempt <= 2; attempt++) {
+		const before = await readIndexState(session, index);
+		if (before.valid === true) {
+			if (attempt === 1) outcome.skipped.push({
+				index: qualified,
+				reason: "already built"
+			});
+			else outcome.built.push(qualified);
+			return;
+		}
+		if (before.building) {
+			outcome.skipped.push({
+				index: qualified,
+				reason: "another instance is building it"
+			});
+			say(`${qualified}: another instance is building it — leaving it to that one`);
+			return;
+		}
+		if (!await tableLockIsFree(session, index, options)) {
+			if (await tableIsBeingIndexed(session, index)) {
+				outcome.skipped.push({
+					index: qualified,
+					reason: TABLE_BUSY_REASON
+				});
+				say(`${qualified}: another index on "${index.schema}"."${index.table}" is being built — leaving it for now`);
+				return;
+			}
+			outcome.failed.push({
+				index: qualified,
+				error: `"${index.schema}"."${index.table}" stayed locked by another session for the whole lock budget (an index build, a VACUUM, an ALTER TABLE). Nothing was changed; the next boot tries again.`
+			});
+			return;
+		}
+		if (before.valid === false) {
+			say(`${qualified}: an earlier build left it INVALID — dropping it to build it again`);
+			await runConcurrently(session, `DROP INDEX CONCURRENTLY IF EXISTS ${target};`, qualified);
+		}
+		const started = Date.now();
+		say(`${qualified}: building on "${index.schema}"."${index.table}"…`);
+		try {
+			await runConcurrently(session, index.sql, qualified);
+		} catch (err) {
+			const after = await readIndexState(session, index).catch(() => void 0);
+			if (after?.valid === true || after?.building) {
+				outcome.skipped.push({
+					index: qualified,
+					reason: "another instance built it"
+				});
+				return;
+			}
+			if (after?.valid === false && attempt === 1 && !isDuplicateRows(err, index)) {
+				say(`${qualified}: the build failed (${describe(err)}); retrying once`);
+				continue;
+			}
+			outcome.failed.push({
+				index: qualified,
+				error: describe(err)
+			});
+			return;
+		}
+		const after = await readIndexState(session, index);
+		if (after.valid === true) {
+			outcome.built.push(qualified);
+			say(`${qualified}: built in ${((Date.now() - started) / 1e3).toFixed(1)} s`);
+			return;
+		}
+		if (after.building) {
+			outcome.skipped.push({
+				index: qualified,
+				reason: "another instance is building it"
+			});
+			return;
+		}
+		if (attempt === 2) {
+			outcome.failed.push({
+				index: qualified,
+				error: "left INVALID by two builds in a row"
+			});
+			return;
+		}
+	}
+}
+var describe = (err) => {
+	const pg = extractPgError(err);
+	if (pg) return pg.code ? `${pg.message} [${pg.code}]` : pg.message;
+	return err instanceof Error ? err.message : String(err);
+};
+/**
+* Build every deferred index, one at a time, on one connection.
+*
+* Never throws for an index: each failure is recorded and the next one is
+* attempted. Throws only when no connection can be had at all.
+*/
+async function buildDeferredIndexes(openSession, indexes, options = {}) {
+	const outcome = {
+		built: [],
+		skipped: [],
+		failed: []
+	};
+	if (indexes.length === 0) return outcome;
+	for (const index of indexes) {
+		assertSafeIdentifier(index.schema, "schema name");
+		assertSafeIdentifier(index.table, "table name");
+		assertSafeIdentifier(index.indexName, "index name");
+	}
+	const session = await openSession();
+	try {
+		if (session.dedicated) await session.query("SET statement_timeout = 0");
+		for (const index of indexes) {
+			if (options.cancelled?.()) break;
+			try {
+				await buildClaimed(session, index, options, outcome);
+			} catch (err) {
+				outcome.failed.push({
+					index: `${index.schema}.${index.indexName}`,
+					error: describe(err)
+				});
+			}
+		}
+	} finally {
+		try {
+			if (session.dedicated) await session.query("RESET statement_timeout");
+		} finally {
+			await session.release();
+		}
+	}
+	for (const failure of outcome.failed) logger.warn(`[schema] Index ${failure.index} was not built: ${failure.error}. Queries it would serve scan the table until it is; the next boot tries again.`);
+	return outcome;
+}
+/** Every deferred build in this process, chained so they run one at a time. */
+var queue = Promise.resolve();
+function scheduleDeferredIndexBuild(openSession, indexes, options = {}) {
+	let cancelled = false;
+	let timer;
+	let resolveDone;
+	const done = new Promise((resolve) => {
+		resolveDone = resolve;
+	});
+	const run = () => {
+		if (timer) clearTimeout(timer);
+		timer = void 0;
+		if (cancelled) {
+			resolveDone(void 0);
+			return;
+		}
+		const job = queue.then(async () => {
+			if (cancelled) return void 0;
+			logger.info(`[schema] Building ${indexes.length} index(es) in the background, one at a time (CREATE INDEX CONCURRENTLY — reads and writes are not blocked).`);
+			return buildDeferredIndexes(openSession, indexes, {
+				...options,
+				cancelled: () => cancelled
+			});
+		}).catch((err) => {
+			logger.warn(`[schema] Indexes were not built this boot: ${describe(err)}`);
+		});
+		queue = job;
+		job.then(resolveDone);
+	};
+	const arm = (ms) => {
+		if (timer) clearTimeout(timer);
+		timer = setTimeout(run, ms);
+		timer.unref?.();
+	};
+	arm(options.fallbackMs ?? 6e4);
+	return {
+		start: () => {
+			if (cancelled || timer === void 0) return;
+			arm(options.delayMs ?? 0);
+		},
+		cancel: () => {
+			cancelled = true;
+			if (timer) {
+				clearTimeout(timer);
+				timer = void 0;
+				resolveDone(void 0);
+			}
+		},
+		done
+	};
+}
+//#endregion
+export { assertSafeIdentifier as a, helperFunctionKey as c, HELPER_FUNCTIONS as i, columnTypeDriftMessage as l, buildDeferredIndexes as n, describeHelperFunction as o, deferred_index_build_exports as r, diffPlanAgainstCatalogue as s, TABLE_BUSY_REASON as t, typesAgree as u };
+
+//# sourceMappingURL=deferred-index-build-BqmEHGaD.js.map