@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/{ensure-collection-tables-kkkHk8oo.js → deferred-index-build-DP1_SNFo.js}

@@ -2,16 +2,13 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
 import { h as searchIndexStatements, n as SEARCH_TEXT_FN, r as SEARCH_UNACCENT_FN, u as searchColumnStamps } from "./search-column-BM-GV6vH.js";
-import { d as extractPgError, u as extractCauseMessage } from "./cli-errors-DsA-K9uP.js";
-import { s as vectorExtensionHint, u as vectorIndexStatement } from "./vector-index-CMJKb3C9.js";
-import { c as sortIndexSpecs, n as collectionIndexStatement } from "./collection-index-DdnsxiJ_.js";
-import { a as triggerStatements, i as SET_UPDATED_AT_FN, n as planSchema, r as quoteSqlLiteral } from "./plan-schema-DU9exq6C.js";
-import { n as renderEnableRls, r as renderPgType, s as renderPrimaryKeyConstraint, t as renderColumnDefinition } from "./render-ddl-Ds2t_d9V.js";
-import { c as planJunctionTables } from "./generate-postgres-ddl-logic-BJsLaVNX.js";
-import { r as quoteRelation } from "./introspect-db-queries-C_Q5VgQw.js";
-import { isConcurrentDdlRace, isDuplicateObjectRace, logger } from "@rebasepro/server";
-import { REBASE_SCHEMA, declaredDatabaseExtensions } from "@rebasepro/types";
-import { relationalCollections } from "@rebasepro/common";
+import { n as extractPgError } from "./pg-error-utils-vJezlXdI.js";
+import { u as vectorIndexStatement } from "./vector-index-CMJKb3C9.js";
+import { h as sortIndexSpecs, s as collectionIndexStatement } from "./source-DBDbBTL4.js";
+import { a as triggerStatements, i as SET_UPDATED_AT_FN, r as quoteSqlLiteral } from "./plan-schema-B1YF_tYq.js";
+import { n as renderEnableRls, r as renderPgType, s as renderPrimaryKeyConstraint, t as renderColumnDefinition } from "./render-ddl-CtC3y9Ol.js";
+import { a as isLockTimeout, c as resolveBootLockOptions, l as sleep, o as isMultiStatementRefusal, r as atomicBatch } from "./boot-ddl-DVpsFN6r.js";
+import { logger } from "@rebasepro/server";
 //#region src/schema/column-type-drift.ts
 /**
 * Types that mean the same thing to everything above the driver.
@@ -159,6 +156,68 @@ function assertSafeIdentifier(value, what) {
 	return value;
 }
 /**
+* The functions the plan creates with `CREATE OR REPLACE`, which the catalogue
+* reader looks up so a boot that finds them unchanged plans nothing.
+*
+* A helper missing from this list is not wrong, only re-created on every boot,
+* which is what all of them were before.
+*/
+var HELPER_FUNCTIONS = [
+	SEARCH_TEXT_FN,
+	SEARCH_UNACCENT_FN,
+	SET_UPDATED_AT_FN
+];
+var helperFunctionKey = (schema, name, args) => `${schema}.${name}(${args.replace(/\s+/g, " ").trim().toLowerCase()})`;
+var describeHelperFunction = (facts) => JSON.stringify([
+	facts.returns.toLowerCase(),
+	facts.language.toLowerCase(),
+	facts.volatility,
+	facts.strict,
+	facts.parallel,
+	facts.securityDefiner,
+	facts.leakproof,
+	Number(facts.cost),
+	facts.hasConfig,
+	facts.body
+]);
+var HELPER_FUNCTION_RE = /* @__PURE__ */ new RegExp("^\\s*CREATE OR REPLACE FUNCTION\\s+([A-Za-z_]\\w*)\\.([A-Za-z_]\\w*)\\(([^)]*)\\)\\s+RETURNS\\s+([\\w\\[\\]]+)\\s+LANGUAGE\\s+(\\w+)((?:\\s+(?:IMMUTABLE|STABLE|VOLATILE|STRICT|PARALLEL\\s+(?:SAFE|RESTRICTED|UNSAFE)))*)\\s+AS\\s+\\$\\$([\\s\\S]*)\\$\\$;?\\s*$", "i");
+/**
+* What a helper's `CREATE OR REPLACE FUNCTION` statement would leave in the
+* catalogue, or `undefined` for a statement this does not recognise — which is
+* then planned unconditionally, as every statement was before.
+*
+* Only ever given statements this package renders (`searchHelperFunctions`,
+* `setUpdatedAtFunction`), so a strict pattern is the right tool: anything it
+* does not match exactly falls back to the safe behaviour.
+*/
+function parseHelperFunction(statement) {
+	const match = HELPER_FUNCTION_RE.exec(statement);
+	if (!match) return void 0;
+	const [, schema, name, args, returns, language, attributes, body] = match;
+	const words = attributes.toUpperCase();
+	const parallel = /PARALLEL\s+SAFE/.test(words) ? "s" : /PARALLEL\s+RESTRICTED/.test(words) ? "r" : "u";
+	const volatility = /\bIMMUTABLE\b/.test(words) ? "i" : /\bSTABLE\b/.test(words) ? "s" : "v";
+	return {
+		key: helperFunctionKey(schema, name, args),
+		definition: describeHelperFunction({
+			returns,
+			language,
+			volatility,
+			strict: /\bSTRICT\b/.test(words),
+			parallel,
+			securityDefiner: false,
+			leakproof: false,
+			cost: 100,
+			hasConfig: false,
+			body
+		})
+	};
+}
+/** The name a rendered `CREATE [UNIQUE] INDEX [CONCURRENTLY] IF NOT EXISTS "<name>"` creates. */
+var indexNameOf = (statement) => /^\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?IF\s+NOT\s+EXISTS\s+"([^"]+)"/i.exec(statement)?.[1];
+/** The extension a rendered `CREATE EXTENSION IF NOT EXISTS <name> …` installs. */
+var extensionNameOf = (statement) => /^\s*CREATE\s+EXTENSION\s+IF\s+NOT\s+EXISTS\s+"?([\w-]+)"?/i.exec(statement)?.[1];
+/**
 * Whether a column is part of the table's primary key.
 *
 * Those are created with the table, in step 2, and never added afterwards: a
@@ -170,6 +229,12 @@ function assertSafeIdentifier(value, what) {
 * key would be created twice.
 */
 var isKeyColumn = (table, column) => !column.columnOwnedByProperty && table.primaryKey.includes(column.column);
+/**
+* A declared key whose default is the built-in uuid generator: the default
+* `isId: "uuid"` plans. It is the one declared-key default boot sets on an
+* existing table, because it is the one that cannot fail there.
+*/
+var isUuidKeyDefault = (column) => column.source.kind === "property" && column.default?.kind === "sql" && column.default.expression === "gen_random_uuid()";
 /** Which pass a column belongs to. The order below is the order they run in. */
 var isScalarProperty = (table, column) => (column.source.kind === "property" || column.source.kind === "implicit-id") && !isKeyColumn(table, column);
 /**
@@ -222,16 +287,24 @@ function diffPlanAgainstCatalogue(plan, existing, options = {}) {
 			sql: `CREATE TYPE "${enumPlan.schema}"."${enumPlan.name}" AS ENUM (${enumPlan.labels.map(quoteSqlLiteral).join(", ")});`
 		});
 	}
-	for (const statement of plan.extensions) actions.push({
-		kind: "create-extension",
-		target: statement.replace(/^CREATE EXTENSION IF NOT EXISTS |;$/g, ""),
-		sql: statement
-	});
-	for (const statement of plan.functions) actions.push({
-		kind: "create-function",
-		target: functionTarget(statement),
-		sql: statement
-	});
+	for (const statement of plan.extensions) {
+		const extension = extensionNameOf(statement);
+		if (extension && existing.extensions?.has(extension)) continue;
+		actions.push({
+			kind: "create-extension",
+			target: statement.replace(/^CREATE EXTENSION IF NOT EXISTS |;$/g, ""),
+			sql: statement
+		});
+	}
+	for (const statement of plan.functions) {
+		const helper = parseHelperFunction(statement);
+		if (helper && existing.functions?.get(helper.key) === helper.definition) continue;
+		actions.push({
+			kind: "create-function",
+			target: functionTarget(statement),
+			sql: statement
+		});
+	}
 	const created = /* @__PURE__ */ new Set();
 	for (const table of collectionTables) {
 		if (existing.tables.has(table.qualified) || created.has(table.qualified)) continue;
@@ -418,7 +491,8 @@ function diffPlanAgainstCatalogue(plan, existing, options = {}) {
 			planColumn(table, column);
 		}
 		for (const column of table.columns) {
-			if (column.source.kind !== "implicit-id" || !column.primaryKey) continue;
+			if (!column.primaryKey) continue;
+			if (column.source.kind !== "implicit-id" && !isUuidKeyDefault(column)) continue;
 			if (existing.tables.get(table.qualified)?.has(column.column) !== true) continue;
 			planMissingDefault(table, column);
 		}
@@ -494,32 +568,92 @@ function diffPlanAgainstCatalogue(plan, existing, options = {}) {
 		});
 	}
 	const concurrent = (schema, table) => !created.has(`${schema}.${table}`);
+	const indexExists = (schema, name) => name !== void 0 && existing.indexes?.has(`${schema}.${name}`) === true;
+	const deferredIndexes = [];
+	const toBuilder = (schema, table, derived) => concurrent(schema, table) && (derived || options.deferLiveIndexes === true);
+	const deferIndex = (build) => {
+		const invalid = existing.invalidIndexes?.has(`${build.schema}.${build.indexName}`) === true;
+		if (indexExists(build.schema, build.indexName) && !invalid) return;
+		deferredIndexes.push({
+			...build,
+			invalid
+		});
+	};
+	/** A search or vector statement in its concurrent form, or undefined if it has no plain `CREATE INDEX IF NOT EXISTS`. */
+	const concurrentForm = (statement) => {
+		const rewritten = statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS");
+		return rewritten === statement ? void 0 : rewritten;
+	};
 	for (const table of collectionTables) {
 		if (!table.search) continue;
-		for (const statement of searchIndexStatements(table.search)) actions.push({
-			kind: "create-index",
-			target: table.qualified,
-			sql: concurrent(table.schema, table.table) ? statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : statement
-		});
+		const { schema, table: tableName } = table.search;
+		for (const statement of searchIndexStatements(table.search)) {
+			const name = indexNameOf(statement);
+			const sql = concurrentForm(statement);
+			if (name !== void 0 && sql !== void 0 && toBuilder(schema, tableName, false)) {
+				deferIndex({
+					schema,
+					table: tableName,
+					indexName: name,
+					sql
+				});
+				continue;
+			}
+			if (indexExists(table.schema, name)) continue;
+			actions.push({
+				kind: "create-index",
+				target: table.qualified,
+				sql: concurrent(table.schema, table.table) ? statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : statement
+			});
+		}
 	}
 	const vectorIndexSkipped = [];
 	for (const table of collectionTables) {
 		if (!table.vector) continue;
-		for (const spec of table.vector.specs) actions.push({
+		for (const spec of table.vector.specs) {
+			const sql = concurrentForm(vectorIndexStatement(spec));
+			if (sql !== void 0 && toBuilder(spec.schema, spec.table, false)) {
+				deferIndex({
+					schema: spec.schema,
+					table: spec.table,
+					indexName: spec.indexName,
+					sql
+				});
+				continue;
+			}
+			if (indexExists(spec.schema, spec.indexName)) continue;
+			actions.push({
+				kind: "create-index",
+				target: `${spec.schema}.${spec.table}`,
+				sql: concurrent(spec.schema, spec.table) ? vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : vectorIndexStatement(spec)
+			});
+		}
+		vectorIndexSkipped.push(...table.vector.skipped);
+	}
+	for (const spec of sortIndexSpecs([...collectionTables, ...junctionTables].flatMap((t) => t.indexes))) {
+		if (toBuilder(spec.schema, spec.table, spec.derived === "foreign-key")) {
+			deferIndex({
+				schema: spec.schema,
+				table: spec.table,
+				indexName: spec.indexName,
+				sql: collectionIndexStatement(spec, {
+					concurrently: true,
+					ifNotExists: true
+				}),
+				...spec.unique ? { unique: true } : {}
+			});
+			continue;
+		}
+		if (indexExists(spec.schema, spec.indexName)) continue;
+		actions.push({
 			kind: "create-index",
 			target: `${spec.schema}.${spec.table}`,
-			sql: concurrent(spec.schema, spec.table) ? vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : vectorIndexStatement(spec)
+			sql: collectionIndexStatement(spec, {
+				concurrently: concurrent(spec.schema, spec.table),
+				ifNotExists: true
+			})
 		});
-		vectorIndexSkipped.push(...table.vector.skipped);
 	}
-	for (const spec of sortIndexSpecs(collectionTables.flatMap((t) => t.indexes))) actions.push({
-		kind: "create-index",
-		target: `${spec.schema}.${spec.table}`,
-		sql: collectionIndexStatement(spec, {
-			concurrently: concurrent(spec.schema, spec.table),
-			ifNotExists: true
-		})
-	});
 	for (const table of collectionTables) for (const trigger of table.triggers) {
 		if (existing.triggers?.has(`${table.qualified}.${trigger.name}`)) continue;
 		for (const statement of triggerStatements(trigger)) actions.push({
@@ -558,7 +692,8 @@ function diffPlanAgainstCatalogue(plan, existing, options = {}) {
 		vectorIndexSkipped,
 		withheldConstraints,
 		columnTypeDrift,
-		orphanedRequiredColumns
+		orphanedRequiredColumns,
+		deferredIndexes
 	};
 }
 /** What a `CREATE FUNCTION` statement is called, for the action log. */
@@ -567,347 +702,350 @@ var functionTarget = (statement) => {
 	return statement.includes("unaccent") ? SEARCH_UNACCENT_FN : SEARCH_TEXT_FN;
 };
 //#endregion
-//#region src/schema/ensure-collection-tables.ts
+//#region src/schema/deferred-index-build.ts
+var deferred_index_build_exports = /* @__PURE__ */ __exportAll({
+	TABLE_BUSY_REASON: () => TABLE_BUSY_REASON,
+	buildDeferredIndexes: () => buildDeferredIndexes,
+	isPgPool: () => isPgPool,
+	poolIndexBuildSession: () => poolIndexBuildSession,
+	scheduleDeferredIndexBuild: () => scheduleDeferredIndexBuild
+});
+/** A client-side read timeout no index build reaches. A pool's is 60 s. */
+var INDEX_BUILD_READ_TIMEOUT_MS = 1440 * 60 * 1e3;
+/** A `pg.Pool` — what `connect()` checks a client out of — and not a `pg.Client`, whose `connect()` opens a socket. */
+var isPgPool = (value) => typeof value === "object" && value !== null && "connect" in value && typeof value.connect === "function" && "totalCount" in value;
 /**
-* Applying a schema plan to a database that is already running.
-*
-* ## What this module is
-*
-* A managed runtime boots someone else's compiled project against a database it
-* has never seen. Auth tables are ensured at boot already, but collection tables
-* were not created by anything: the platform ran the app and every `/api/data/*`
-* request answered 500 on a missing relation. `rebase db push` cannot help — it
-* is an Atlas-driven CLI command, and the runtime image ships no CLI.
-*
-* Two halves, and only one of them is here. *What the collections ask for* is
-* `schema/plan/plan-schema.ts`, shared with `db push` and the generated Drizzle
-* file; *what the database already has, and which of those statements are safe
-* to run against it* is `schema/plan/diff-plan.ts`. This module reads the
-* catalogue, runs the statements, and reports what happened.
+* Sessions checked out of a `pg.Pool`, one connection each.
 *
-* ## Why additive-only, forever
-*
-* This runs unattended, against a database with customers' data in it, with no
-* human reading a diff. So it may only ever do things that cannot lose data.
-* See `diff-plan.ts` for the whole of that argument.
+* Its own connection rather than the pool's next free one, because a build
+* has to outlive both of a pool's timeouts: the server-side
+* `statement_timeout` (30 s on this framework's pools), which the builder
+* lifts for the session — something it may only do on a connection nobody
+* else is handed until it is reset — and the client-side read timeout, which
+* is lifted here per query.
 */
-var ensure_collection_tables_exports = /* @__PURE__ */ __exportAll({
-	describeDriverError: () => describeDriverError,
-	ensureCollectionTables: () => ensureCollectionTables,
-	planCollectionSchemaEnsure: () => planCollectionSchemaEnsure,
-	readExistingSchema: () => readExistingSchema,
-	readSchemaFactsFor: () => readSchemaFactsFor
-});
-/** The schema a collection lives in, validated before it reaches any DDL. */
-function schemaOf(collection) {
-	return assertSafeIdentifier(collection.schema || "public", "schema name");
-}
+var poolIndexBuildSession = (pool) => async () => {
+	const client = await pool.connect();
+	return {
+		dedicated: true,
+		async query(text) {
+			const config = {
+				text,
+				query_timeout: INDEX_BUILD_READ_TIMEOUT_MS
+			};
+			return { rows: (await client.query(config)).rows };
+		},
+		release: () => client.release()
+	};
+};
+/** `42P01 undefined_table` — `pg_stat_progress_create_index` before Postgres 12. */
+var isUndefinedTable = (err) => extractPgError(err)?.code === "42P01";
+/** `25001 active_sql_transaction` — `CONCURRENTLY` on a connection inside a transaction block. */
+var isTransactionBlockRefusal = (err) => extractPgError(err)?.code === "25001";
 /**
-* Decide what to add. Pure — the caller supplies what exists and runs the
-* result.
-*
-* A plan and a diff: the collections are read once, by `planSchema`, into the
-* same {@link SchemaPlan} `db push` renders `schema.sql` from, and the diff
-* subtracts what the database already has. Before that split this function had
-* its own reading of every `Property`, and the audit found twelve places where
-* it disagreed with the two generators — a required `author_id` that was
-* NOT NULL after a push and nullable after a boot among them, on the one path
-* with no developer in the loop.
+* The rows themselves violate a UNIQUE index being built: `23505` naming the
+* index (a lost catalogue race names a `pg_` index instead). Building it again
+* would only fail again, so it is not retried.
 */
-function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
-	return diffPlanAgainstCatalogue(planSchema(allCollections, { databaseExtensions: options.databaseExtensions }), existing, { constraints: options.constraints });
+var isDuplicateRows = (err, index) => {
+	const pg = extractPgError(err);
+	return pg?.code === "23505" && (pg.constraint === index.indexName || /could not create unique index/i.test(pg.message));
+};
+var CONCURRENTLY_RE = /\sCONCURRENTLY\s/i;
+/** Why an index is skipped while a build of another index holds its table. */
+var TABLE_BUSY_REASON = "another index on the table is being built";
+/**
+* Run a `CONCURRENTLY` statement — or its plain form, when the connection
+* turns out to be inside a transaction block. Only a shared handle can be: an
+* application that builds its own adapter may hand over a connection already
+* in one. The plain form is always accepted and takes a write lock for the
+* build, which is the cost of getting the index at all — the same fallback the
+* ensure's own index actions have.
+*/
+async function runConcurrently(session, sql, qualified) {
+	try {
+		await session.query(sql);
+	} catch (err) {
+		if (!isTransactionBlockRefusal(err) || !CONCURRENTLY_RE.test(sql)) throw err;
+		logger.warn(`[schema] ${qualified}: this connection is inside a transaction, so the index is built with a write lock rather than concurrently. Writes to the table block until it finishes.`);
+		await session.query(sql.replace(CONCURRENTLY_RE, " "));
+	}
 }
-/** Read what the database has, for the schemas the collections live in. */
-async function readExistingSchema(client, schemas) {
-	const tables = /* @__PURE__ */ new Map();
-	const enums = /* @__PURE__ */ new Set();
-	if (schemas.length === 0) return {
-		tables,
-		enums
+async function readIndexState(session, index) {
+	const schema = quoteSqlLiteral(index.schema);
+	const name = quoteSqlLiteral(index.indexName);
+	const { rows } = await session.query(`SELECT i.indisvalid AS valid
+         FROM pg_index i
+         JOIN pg_class c ON c.oid = i.indexrelid
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         WHERE n.nspname = ${schema} AND c.relname = ${name}`);
+	const valid = rows.length === 0 ? null : rows[0].valid === true;
+	if (valid !== false) return {
+		valid,
+		building: false
 	};
-	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
-	const notNullColumns = /* @__PURE__ */ new Set();
-	const columnTypes = /* @__PURE__ */ new Map();
-	const columnDefaults = /* @__PURE__ */ new Set();
-	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name, is_nullable, udt_name, column_default,
-                numeric_precision, numeric_scale
-         FROM information_schema.columns
-         WHERE table_schema IN (${inList})`);
-	for (const row of columns) {
-		const key = `${row.table_schema}.${row.table_name}`;
-		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
-		tables.get(key).add(row.column_name);
-		if (row.is_nullable === "NO") notNullColumns.add(`${key}.${row.column_name}`);
-		if (row.udt_name) {
-			const modifier = row.udt_name === "numeric" && row.numeric_precision !== null ? `(${row.numeric_precision},${row.numeric_scale ?? 0})` : "";
-			columnTypes.set(`${key}.${row.column_name}`, `${row.udt_name}${modifier}`);
-		}
-		if (row.column_default !== null) columnDefaults.add(`${key}.${row.column_name}`);
-	}
-	const triggers = /* @__PURE__ */ new Set();
-	const { rows: triggerRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, t.tgname AS name
-         FROM pg_trigger t
-         JOIN pg_class c ON t.tgrelid = c.oid
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         WHERE NOT t.tgisinternal AND n.nspname IN (${inList})`);
-	for (const row of triggerRows) triggers.add(`${row.schema}.${row.table}.${row.name}`);
-	const populatedTables = /* @__PURE__ */ new Set();
-	const { rows: realTables } = await client.query(`SELECT n.nspname AS schema, c.relname AS name
-         FROM pg_class c
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         WHERE c.relkind IN ('r', 'p') AND n.nspname IN (${inList})`);
-	if (realTables.length > 0) {
-		const probes = realTables.map((row) => `SELECT ${quoteSqlLiteral(`${row.schema}.${row.name}`)} AS key, EXISTS(SELECT 1 FROM ${quoteRelation(row.schema, row.name)} LIMIT 1) AS populated`);
-		const { rows: populationRows } = await client.query(probes.join(" UNION ALL "));
-		for (const row of populationRows) if (row.populated) populatedTables.add(row.key);
-	}
-	const enumValues = /* @__PURE__ */ new Map();
-	const { rows: enumValueRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name, e.enumlabel AS value
-         FROM pg_enum e
-         JOIN pg_type t ON e.enumtypid = t.oid
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE n.nspname IN (${inList})
-         ORDER BY t.typname, e.enumsortorder`);
-	for (const row of enumValueRows) {
-		const key = `${row.schema}.${row.name}`;
-		if (!enumValues.has(key)) enumValues.set(key, []);
-		enumValues.get(key).push(row.value);
-	}
-	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
-         FROM pg_type t
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
-	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
-	const constraints = /* @__PURE__ */ new Set();
-	const { rows: constraintRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
-         FROM pg_constraint con
-         JOIN pg_class c ON con.conrelid = c.oid
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         WHERE n.nspname IN (${inList})`);
-	for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
-	const columnComments = /* @__PURE__ */ new Map();
-	const { rows: commentRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, a.attname AS column, d.description AS comment
-         FROM pg_description d
-         JOIN pg_class c ON d.objoid = c.oid
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = d.objsubid
-         WHERE d.objsubid > 0 AND n.nspname IN (${inList})`);
-	for (const row of commentRows) {
-		if (row.comment == null) continue;
-		columnComments.set(`${row.schema}.${row.table}.${row.column}`, row.comment);
-	}
 	return {
-		tables,
-		enums,
-		constraints,
-		columnComments,
-		enumValues,
-		notNullColumns,
-		populatedTables,
-		columnTypes,
-		columnDefaults,
-		triggers
+		valid,
+		building: await tableIsBeingIndexed(session, index)
 	};
 }
 /**
-* What to tell an operator whose `search` block no longer matches its column.
+* Wait, within the boot's lock budget, until the table's lock is free.
 *
-* Every line here is doing work: naming the collection is not enough, because
-* the symptom (a search that finds nothing) points at the data, not the schema;
-* and the remediation has to be exact, because it is a table rewrite the
-* operator is being asked to schedule rather than discover.
+* A probe rather than a `lock_timeout` on the build itself: the build waits on
+* lock *queues* in three phases, and only the first — getting the table — is
+* a wait worth bounding. The other two wait for transactions that were
+* already running, which block nobody while they run and must simply be let
+* finish. `true` when the table was free (or cannot be probed on this
+* handle), `false` when something held it for the whole budget.
 */
-function searchDriftMessage(drift) {
-	return "The `search` block changed after its generated column was created, and Postgres cannot alter a generated expression in place.\nRebase will not rebuild it for you: dropping and re-adding a STORED generated column rewrites the whole table under an ACCESS EXCLUSIVE lock and rebuilds its GIN index, which is an outage this unattended path may not schedule on your behalf.\nUntil it is rebuilt the column keeps indexing the previous fields, weights and language — searches for anything added since return nothing, which reads from outside as \"no such row\".\nRun these (or revert the block to what the column was built from), then boot again:\n" + drift.map((d) => `  "${d.table}"."${d.column}" was generated from a different \`search\` block (recorded ${d.found}, current ${d.expected}).\n` + d.rebuild.map((s) => `      ${s}`).join("\n")).join("\n") + "\n  The GIN index is dropped with the column and recreated concurrently on the next boot.";
+async function tableLockIsFree(session, index, options) {
+	const lock = resolveBootLockOptions(options);
+	const probe = atomicBatch([`LOCK TABLE "${index.schema}"."${index.table}" IN SHARE UPDATE EXCLUSIVE MODE`], lock.lockTimeoutMs);
+	const deadline = Date.now() + (options.retryBudgetMs ?? 1e4);
+	for (let round = 1;; round++) try {
+		await session.query(probe);
+		return true;
+	} catch (err) {
+		if (isMultiStatementRefusal(err)) return true;
+		if (!isLockTimeout(err)) throw err;
+		if (round >= lock.attempts || Date.now() >= deadline) return false;
+		await sleep(Math.min(lock.backoffMs(round), Math.max(0, deadline - Date.now())));
+	}
+}
+/** Whether another backend is running `CREATE INDEX` on the index's table right now. */
+async function tableIsBeingIndexed(session, index) {
+	const table = quoteSqlLiteral(`"${index.schema}"."${index.table}"`);
+	try {
+		const { rows } = await session.query(`SELECT EXISTS (
+                 SELECT 1 FROM pg_stat_progress_create_index
+                 WHERE relid = to_regclass(${table}) AND pid <> pg_backend_pid()
+             ) AS building`);
+		return rows[0]?.building === true;
+	} catch (err) {
+		if (isUndefinedTable(err)) return false;
+		throw err;
+	}
 }
 /**
-* Read what the database looks like, for the schemas a set of collections
-* lives in.
+* The advisory-lock key one index is claimed under, across every instance.
 *
-* The same read `ensureCollectionTables` does at boot, exposed on its own for
-* the callers that want to *plan* against a real database without changing it —
-* the live schema editor, which has to tell somebody what a change would do
-* before they agree to it.
+* Without a claim, instances booting together all issue the same
+* `CREATE INDEX CONCURRENTLY`: one wins, the others skip by name — reporting
+* success while the winner is still building — or wait on each other's
+* transactions until Postgres breaks the deadlock by cancelling one, which
+* leaves a husk. With it, one instance builds and the rest step aside.
 */
-async function readSchemaFactsFor(client, collections) {
-	const relational = relationalCollections(collections);
-	return readExistingSchema(client, Array.from(/* @__PURE__ */ new Set([...relational.map(schemaOf), ...planJunctionTables(relational).map((junction) => junction.schema)])));
-}
+var claimKey = (index) => `hashtext(${quoteSqlLiteral(`rebase_fk_index:${index.schema}.${index.indexName}`)})`;
 /**
-* Bring the database up to date. Returns what it did.
-*
-* Each statement runs on its own rather than in one transaction: they are all
-* independently safe and idempotent, and a single failure (an enum label that
-* cannot be added, say) should not roll back the tables that were created fine.
-* The error is surfaced with the statement that caused it.
+* Build one index under its claim — session-level, so only on a connection
+* of our own. On a shared handle the claim could be taken on one backend and
+* released on another, so there is none, and concurrent instances fall back
+* on the state checks below.
 */
-async function ensureCollectionTables(client, collections, log, options = {}) {
-	const schema = planSchema(collections, { databaseExtensions: options.databaseExtensions ?? declaredDatabaseExtensions() });
-	const schemas = Array.from(new Set(schema.tables.map((table) => table.schema)));
-	for (const name of schemas) {
-		assertSafeIdentifier(name, "schema name");
-		if (name !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${name}";`);
-	}
-	if (schema.tables.some((table) => table.triggers.length > 0)) await client.query(`CREATE SCHEMA IF NOT EXISTS "${REBASE_SCHEMA}";`);
-	const plan = diffPlanAgainstCatalogue(schema, await readExistingSchema(client, schemas), { constraints: options.constraints });
-	const failures = [];
-	for (const legacy of plan.legacyForeignKeys) {
-		const message = `Renaming "${legacy.table}"."${legacy.legacy}" to "${legacy.expected}". The old name is the one Rebase derived for this relation before it singularized properly; the column keeps its data, indexes and constraints. To keep the old name instead, set \`localKey: "${legacy.legacy}"\` on the relation and this will stop.`;
-		logger.info(`[schema] ${message}`);
-		log?.(message);
-	}
-	if (plan.searchDrift.length > 0) throw new Error(searchDriftMessage(plan.searchDrift));
-	for (const adopted of plan.searchAdopted) {
-		const message = `Adopting the existing generated column "${adopted.table}"."${adopted.column}" and recording what the current \`search\` block would generate. Any later change to that block will be detected and refused; a change made *before* this version was deployed cannot be, so if search has been missing content, rebuild the column once: ALTER TABLE "${adopted.table.split(".").join("\".\"")}" DROP COLUMN "${adopted.column}"; and boot again.`;
-		logger.info(`[schema] ${message}`);
-		log?.(message);
-	}
-	for (const skip of plan.vectorIndexSkipped) {
-		const message = `No ANN index on "${skip.table}"."${skip.column}": ${skip.reason}`;
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
-	}
-	for (const withheld of plan.withheldConstraints) {
-		const message = `No ${withheld.kind === "unique" ? "UNIQUE" : "NOT NULL"} on "${withheld.target}": ${withheld.reason} ${withheld.remedy}`;
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
-	}
-	for (const drift of plan.columnTypeDrift) {
-		const message = columnTypeDriftMessage(drift);
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
+async function buildClaimed(session, index, options, outcome) {
+	if (!session.dedicated) return buildOne(session, index, options, outcome);
+	const { rows } = await session.query(`SELECT pg_try_advisory_lock(${claimKey(index)}) AS claimed`);
+	if (rows[0]?.claimed !== true) {
+		outcome.skipped.push({
+			index: `${index.schema}.${index.indexName}`,
+			reason: "another instance is building it"
+		});
+		options.log?.(`${index.schema}.${index.indexName}: another instance is building it — leaving it to that one`);
+		return;
 	}
-	for (const orphan of plan.orphanedRequiredColumns) {
-		const [schema, table] = orphan.table.split(".");
-		const message = `"${orphan.table}"."${orphan.column}" is NOT NULL with no default, and the "${orphan.slug}" collection no longer declares it. Every insert will be rejected for a field you cannot set (PG_23502, naming "${orphan.column}"). This is what a renamed property looks like: the new column was added, and the old one cannot be dropped unattended. Fix it with ONE of:
-      ALTER TABLE "${schema}"."${table}" DROP COLUMN "${orphan.column}";               -- the rename is complete\n      ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${orphan.column}" DROP NOT NULL; -- keep the data, stop requiring it\n      ...or declare the property again, if the column is still wanted.`;
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
+	try {
+		await buildOne(session, index, options, outcome);
+	} finally {
+		await session.query(`SELECT pg_advisory_unlock(${claimKey(index)})`);
 	}
-	if (plan.actions.length === 0) {
-		log?.("Schema is up to date; nothing to create.");
-		return {
-			...plan,
-			failures
-		};
-	}
-	for (const action of plan.actions) try {
-		if (await applyAction(client, action)) log?.(`${action.kind}: ${action.target}`);
-		else log?.(`${action.kind}: ${action.target} (already created by a peer)`);
-	} catch (err) {
-		const message = describeDriverError(err);
-		if (action.kind === "add-constraint" || action.kind === "comment-column" || action.kind === "create-index" && !/CREATE\s+UNIQUE\s+INDEX/i.test(action.sql)) {
-			failures.push({
-				kind: action.kind,
-				target: action.target,
-				error: message
+}
+/** One index, from whatever state it is in to valid — or a reason it is not. */
+async function buildOne(session, index, options, outcome) {
+	const qualified = `${index.schema}.${index.indexName}`;
+	const target = `"${index.schema}"."${index.indexName}"`;
+	const say = (message) => options.log?.(message);
+	for (let attempt = 1; attempt <= 2; attempt++) {
+		const before = await readIndexState(session, index);
+		if (before.valid === true) {
+			if (attempt === 1) outcome.skipped.push({
+				index: qualified,
+				reason: "already built"
 			});
-			continue;
+			else outcome.built.push(qualified);
+			return;
+		}
+		if (before.building) {
+			outcome.skipped.push({
+				index: qualified,
+				reason: "another instance is building it"
+			});
+			say(`${qualified}: another instance is building it — leaving it to that one`);
+			return;
+		}
+		if (!await tableLockIsFree(session, index, options)) {
+			if (await tableIsBeingIndexed(session, index)) {
+				outcome.skipped.push({
+					index: qualified,
+					reason: TABLE_BUSY_REASON
+				});
+				say(`${qualified}: another index on "${index.schema}"."${index.table}" is being built — leaving it for now`);
+				return;
+			}
+			outcome.failed.push({
+				index: qualified,
+				error: `"${index.schema}"."${index.table}" stayed locked by another session for the whole lock budget (an index build, a VACUUM, an ALTER TABLE). Nothing was changed; the next boot tries again.`
+			});
+			return;
+		}
+		if (before.valid === false) {
+			say(`${qualified}: an earlier build left it INVALID — dropping it to build it again`);
+			await runConcurrently(session, `DROP INDEX CONCURRENTLY IF EXISTS ${target};`, qualified);
+		}
+		const started = Date.now();
+		say(`${qualified}: building on "${index.schema}"."${index.table}"…`);
+		try {
+			await runConcurrently(session, index.sql, qualified);
+		} catch (err) {
+			const after = await readIndexState(session, index).catch(() => void 0);
+			if (after?.valid === true || after?.building) {
+				outcome.skipped.push({
+					index: qualified,
+					reason: "another instance built it"
+				});
+				return;
+			}
+			if (after?.valid === false && attempt === 1 && !isDuplicateRows(err, index)) {
+				say(`${qualified}: the build failed (${describe(err)}); retrying once`);
+				continue;
+			}
+			outcome.failed.push({
+				index: qualified,
+				error: describe(err)
+			});
+			return;
+		}
+		const after = await readIndexState(session, index);
+		if (after.valid === true) {
+			outcome.built.push(qualified);
+			say(`${qualified}: built in ${((Date.now() - started) / 1e3).toFixed(1)} s`);
+			return;
+		}
+		if (after.building) {
+			outcome.skipped.push({
+				index: qualified,
+				reason: "another instance is building it"
+			});
+			return;
+		}
+		if (attempt === 2) {
+			outcome.failed.push({
+				index: qualified,
+				error: "left INVALID by two builds in a row"
+			});
+			return;
 		}
-		throw new Error(`Failed to ${action.kind} ${action.target}: ${message}${vectorExtensionHint(message)}\n  ${action.sql}`);
 	}
-	return {
-		...plan,
-		failures
-	};
 }
-/**
-* What actually went wrong, rather than what the ORM said about it.
-*
-* Drizzle wraps every driver error, and its `message` is literally
-* ``Failed query: ${sql}\nparams: ${params}`` — the statement we already know,
-* and not one word of Postgres's answer. Reporting `err.message` therefore
-* produced a failure that named the statement twice and the *reason* zero
-* times, so four unrelated boot failures — a missing extension, a wrong
-* privilege, a bad index method, a constraint the rows violate — all read
-* identically to whoever had to fix them.
-*
-* Two consequences, both observed in the field before this existed:
-*
-*  1. On a managed deployment the reason never reaches anybody. Boot dies, the
-*     pod never goes ready, and the deploy reports a readiness timeout — so the
-*     one line that says why is the one line that was thrown away here.
-*  2. {@link vectorExtensionHint} matches on the error text. Against the
-*     wrapper it matched nothing, so the hint written specifically to explain a
-*     missing pgvector never fired on the path that raises it.
-*
-* `detail` and `hint` come along because they are the fields Postgres uses to
-* say which object it meant and what to do about it — `CREATE EXTENSION` names
-* the missing library there, and a rejected constraint names the row. This
-* writes into the tenant's own boot log, about the tenant's own database.
-*/
-function describeDriverError(err) {
+var describe = (err) => {
 	const pg = extractPgError(err);
-	if (pg) {
-		const parts = [pg.code ? `${pg.message} [${pg.code}]` : pg.message];
-		if (pg.detail) parts.push(`  detail: ${pg.detail}`);
-		if (pg.hint) parts.push(`  hint: ${pg.hint}`);
-		return parts.join("\n");
-	}
-	const cause = extractCauseMessage(err);
-	if (cause) return cause;
+	if (pg) return pg.code ? `${pg.message} [${pg.code}]` : pg.message;
 	return err instanceof Error ? err.message : String(err);
-}
-/** ` CONCURRENTLY ` as it appears in a rendered `CREATE [UNIQUE] INDEX`. */
-var CONCURRENTLY_RE = /\sCONCURRENTLY\s/i;
+};
 /**
-* `25001 active_sql_transaction` — "cannot run inside a transaction block".
+* Build every deferred index, one at a time, on one connection.
 *
-* Only ever raised here by `CREATE INDEX CONCURRENTLY`, and only when the
-* connection we were handed is inside a transaction. Deliberately narrow: it
-* decides to retry a *different* statement, so it must not fire on anything it
-* has not been reasoned about.
+* Never throws for an index: each failure is recorded and the next one is
+* attempted. Throws only when no connection can be had at all.
 */
-function isTransactionBlockRefusal(err) {
-	return extractPgError(err)?.code === "25001";
-}
-/** Attempts per action, including the first. Matches the server's bootstraps. */
-var DDL_ATTEMPTS = 4;
-/**
-* Run one planned statement, surviving a simultaneous boot.
-*
-* Every statement in a plan is written to be idempotent, and that is not the
-* same as being safe to run concurrently: `CREATE … IF NOT EXISTS` reads the
-* catalog and then writes to it as two steps, so peers starting together both
-* see "absent" and the loser gets a duplicate key on a *catalog* index. Measured
-* against Postgres 18: five instances, 8 of 10 calls lost. `CREATE TYPE` is
-* worse, because Postgres has no `IF NOT EXISTS` for it at all.
-*
-* What made that fatal here rather than merely noisy is the loop this sits in.
-* A losing statement threw, and the throw abandoned **every remaining action in
-* the plan** — so a replica that lost one race came up missing tables it never
-* attempted, and the boot log blamed the one statement that failed.
-*
-* @returns `true` if this process applied the statement, `false` if a peer had
-*   already created the object. The distinction is only for the log; both mean
-*   the object is now there.
-* @throws the original error for anything that is not a race — a syntax error, a
-*   permission failure, a unique constraint the customer's own rows violate.
-*/
-async function applyAction(client, action) {
-	let sqlText = action.sql;
-	for (let attempt = 1;; attempt++) try {
-		await client.query(sqlText);
-		return true;
-	} catch (err) {
-		if (isTransactionBlockRefusal(err) && CONCURRENTLY_RE.test(sqlText)) {
-			sqlText = sqlText.replace(CONCURRENTLY_RE, " ");
-			logger.warn(`[schema] ${action.kind} ${action.target}: this connection is inside a transaction, so the index is being built with a write lock rather than concurrently. Writes to this table block until it finishes.`);
-			continue;
-		}
-		if (isDuplicateObjectRace(err)) {
-			logger.debug(`[schema] ${action.kind} ${action.target}: already created by another instance`);
-			return false;
+async function buildDeferredIndexes(openSession, indexes, options = {}) {
+	const outcome = {
+		built: [],
+		skipped: [],
+		failed: []
+	};
+	if (indexes.length === 0) return outcome;
+	for (const index of indexes) {
+		assertSafeIdentifier(index.schema, "schema name");
+		assertSafeIdentifier(index.table, "table name");
+		assertSafeIdentifier(index.indexName, "index name");
+	}
+	const session = await openSession();
+	try {
+		if (session.dedicated) await session.query("SET statement_timeout = 0");
+		for (const index of indexes) {
+			if (options.cancelled?.()) break;
+			try {
+				await buildClaimed(session, index, options, outcome);
+			} catch (err) {
+				outcome.failed.push({
+					index: `${index.schema}.${index.indexName}`,
+					error: describe(err)
+				});
+			}
 		}
-		if (isConcurrentDdlRace(err) && attempt < DDL_ATTEMPTS) {
-			logger.debug(`[schema] ${action.kind} ${action.target}: lost a race with another instance (attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`);
-			await new Promise((resolve) => setTimeout(resolve, 40 * attempt * (1 + Math.random())));
-			continue;
+	} finally {
+		try {
+			if (session.dedicated) await session.query("RESET statement_timeout");
+		} finally {
+			await session.release();
 		}
-		throw err;
 	}
+	for (const failure of outcome.failed) logger.warn(`[schema] Index ${failure.index} was not built: ${failure.error}. Queries it would serve scan the table until it is; the next boot tries again.`);
+	return outcome;
+}
+/** Every deferred build in this process, chained so they run one at a time. */
+var queue = Promise.resolve();
+function scheduleDeferredIndexBuild(openSession, indexes, options = {}) {
+	let cancelled = false;
+	let timer;
+	let resolveDone;
+	const done = new Promise((resolve) => {
+		resolveDone = resolve;
+	});
+	const run = () => {
+		if (timer) clearTimeout(timer);
+		timer = void 0;
+		if (cancelled) {
+			resolveDone(void 0);
+			return;
+		}
+		const job = queue.then(async () => {
+			if (cancelled) return void 0;
+			logger.info(`[schema] Building ${indexes.length} index(es) in the background, one at a time (CREATE INDEX CONCURRENTLY — reads and writes are not blocked).`);
+			return buildDeferredIndexes(openSession, indexes, {
+				...options,
+				cancelled: () => cancelled
+			});
+		}).catch((err) => {
+			logger.warn(`[schema] Indexes were not built this boot: ${describe(err)}`);
+		});
+		queue = job;
+		job.then(resolveDone);
+	};
+	const arm = (ms) => {
+		if (timer) clearTimeout(timer);
+		timer = setTimeout(run, ms);
+		timer.unref?.();
+	};
+	arm(options.fallbackMs ?? 6e4);
+	return {
+		start: () => {
+			if (cancelled || timer === void 0) return;
+			arm(options.delayMs ?? 0);
+		},
+		cancel: () => {
+			cancelled = true;
+			if (timer) {
+				clearTimeout(timer);
+				timer = void 0;
+				resolveDone(void 0);
+			}
+		},
+		done
+	};
 }
 //#endregion
-export { readSchemaFactsFor as a, readExistingSchema as i, ensure_collection_tables_exports as n, typesAgree as o, planCollectionSchemaEnsure as r, describeDriverError as t };
+export { assertSafeIdentifier as a, helperFunctionKey as c, HELPER_FUNCTIONS as i, columnTypeDriftMessage as l, buildDeferredIndexes as n, describeHelperFunction as o, deferred_index_build_exports as r, diffPlanAgainstCatalogue as s, TABLE_BUSY_REASON as t, typesAgree as u };
 
-//# sourceMappingURL=ensure-collection-tables-kkkHk8oo.js.map
+//# sourceMappingURL=deferred-index-build-DP1_SNFo.js.map