@noy-db/hub 0.6.0-pre.21 → 0.6.0-pre.23

package/dist/{chunk-4N5Q23KV.js → chunk-JXFQEOAQ.js}

@@ -7,10 +7,10 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-A4TOGAUW.js";
+} from "./chunk-VXH5Z22C.js";
 import {
   envelopeBodySize
-} from "./chunk-OHOKBMTM.js";
+} from "./chunk-FUE2KPKM.js";
 import {
   buildRecordEnvelope,
   isDeleteMarker,
@@ -20,14 +20,14 @@ import {
   decrypt,
   derivePresenceKey,
   encrypt
-} from "./chunk-AU3AUJIZ.js";
+} from "./chunk-RQQIB7CD.js";
 import {
   NOYDB_SYNC_VERSION
 } from "./chunk-IGNJOJEP.js";
 import {
   ValidationError,
   isConflictError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/with-sync/presence.ts
 var subtle = globalThis.crypto.subtle;
@@ -1213,4 +1213,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-4N5Q23KV.js.map
+//# sourceMappingURL=chunk-JXFQEOAQ.js.map

package/dist/{chunk-ICDHUUMQ.js → chunk-KF34JCIJ.js}

@@ -1,13 +1,13 @@
 import {
   readPath
-} from "./chunk-IGJCYUT5.js";
+} from "./chunk-NSITFOCJ.js";
 import {
   installViaBinder
-} from "./chunk-JNMTN5D5.js";
+} from "./chunk-LZHIYH32.js";
 import {
   NoydbError,
   ValidationError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/via/money/iso4217.ts
 var MINOR_UNITS = {
@@ -1044,4 +1044,4 @@ export {
   decodeMoneyFields,
   exactMath
 };
-//# sourceMappingURL=chunk-ICDHUUMQ.js.map
+//# sourceMappingURL=chunk-KF34JCIJ.js.map

package/dist/{chunk-6KTVJ5ZZ.js → chunk-KKVVBFKW.js}

@@ -1,13 +1,13 @@
 import {
   envelopePayloadHash
-} from "./chunk-ZLHHE5XZ.js";
+} from "./chunk-YLIGPHN4.js";
 import {
   NOYDB_FORMAT_VERSION
 } from "./chunk-IGNJOJEP.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/via/lookup/handle.ts
 function isDeleteMarker(envelope) {
@@ -392,4 +392,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-6KTVJ5ZZ.js.map
+//# sourceMappingURL=chunk-KKVVBFKW.js.map

package/dist/{chunk-DXKLLKME.js → chunk-L374ZR75.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-KHKKD62N.js";
 import {
   derivePersistedSchema
-} from "./chunk-ONVD6GBY.js";
+} from "./chunk-2QN6NPV6.js";
 import {
   loadPersistedSchema
-} from "./chunk-6WO62AJW.js";
+} from "./chunk-SZFNO7L4.js";
 
 // src/with-shape/introspection/walk.ts
 var INTERNAL_PREFIX = "_";
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=chunk-DXKLLKME.js.map
+//# sourceMappingURL=chunk-L374ZR75.js.map

package/dist/{chunk-EES37S2V.js → chunk-L5PTLL7A.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-OHOKBMTM.js";
+} from "./chunk-FUE2KPKM.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-CZDXBXKE.js"));
+var loadMVExecutor = lazy(() => import("./executor-4SMYWPSU.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-EES37S2V.js.map
+//# sourceMappingURL=chunk-L5PTLL7A.js.map

package/dist/{chunk-2LFOMUEA.js → chunk-LBDG6FHB.js}

@@ -6,7 +6,7 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/with-commit/tx/atomic-eligibility.ts
 function canCommitAtomically(db, ctx) {
@@ -270,7 +270,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-DVJAWN3B.js");
+    const { GuardExecutor } = await import("./executor-O4UP4M3C.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -447,4 +447,4 @@ export {
   TxCollection,
   runTransaction
 };
-//# sourceMappingURL=chunk-2LFOMUEA.js.map
+//# sourceMappingURL=chunk-LBDG6FHB.js.map

package/dist/{chunk-T7JGWTES.js → chunk-LIWA5ROZ.js}

@@ -1,32 +1,34 @@
 import {
+  isCollectLeg,
+  resolveLegOwner,
   wrapDbWithPredicates
-} from "./chunk-3O72ZD2E.js";
+} from "./chunk-LPVZDTQF.js";
 import {
   canonicalizeMoneyFieldsAsDecimal,
   decodeMoneyFields,
   exactMath
-} from "./chunk-ICDHUUMQ.js";
+} from "./chunk-KF34JCIJ.js";
 import {
   putDerivedOutput
-} from "./chunk-DVRZYAGT.js";
+} from "./chunk-6ZN6X2LW.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-VVSOPRUE.js";
+} from "./chunk-YNWBBHQK.js";
 import {
   groupAndReduce
-} from "./chunk-B6IYATME.js";
+} from "./chunk-DXJXVWWE.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   applyI18nLocale
-} from "./chunk-WVE6YKMX.js";
+} from "./chunk-U5ZDYJLQ.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-CWM4GQD2.js";
+} from "./chunk-HKANJAOP.js";
 
 // src/with-formula/materialized-views/executor.ts
 var DEFAULT_MAX_ROWS = 1e5;
@@ -125,13 +127,16 @@ async function materializeProjectionResult(spec, db) {
   const coll = db.collection(projection.source);
   let q = coll.query();
   for (const leg of projection.joins) {
-    if ("collect" in leg) continue;
+    if (isCollectLeg(leg) || leg.from !== void 0) continue;
     q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy });
   }
   let rows = q.toArray();
   for (const leg of projection.joins) {
-    if (!("collect" in leg)) continue;
-    rows = applyCollectLeg(rows, leg, spec.name, projection.source, db);
+    if (isCollectLeg(leg)) {
+      rows = applyCollectLeg(rows, leg, spec.name, projection.source, projection.joins, db);
+    } else if (leg.from !== void 0) {
+      rows = applyLegRelativeForwardLeg(rows, leg, spec.name, projection.source, projection.joins, db);
+    }
   }
   const mapped = [];
   for (const r of rows) {
@@ -141,18 +146,47 @@ async function materializeProjectionResult(spec, db) {
   }
   return finalizeMappedRows(spec, mapped);
 }
-function applyCollectLeg(primaryRows, leg, mvName, source, db) {
+function legOwnerLookup(db) {
+  return (collection, field) => {
+    const q = db.collection(collection).query();
+    return q._joinContext?.()?.resolveRef(field) ?? null;
+  };
+}
+function applyLegRelativeForwardLeg(primaryRows, leg, mvName, source, joins, db) {
+  const lookup = legOwnerLookup(db);
+  const owner = resolveLegOwner(leg, joins, source, lookup);
+  const refDesc = owner === null ? null : lookup(owner, leg.field);
+  if (owner === null || refDesc === null) {
+    throw new MaterializedViewConfigError(
+      `"${mvName}": projection leg "${leg.as}" requires a ref() on field "${leg.field}" of collection "${owner ?? `(behind from: "${leg.from}")`}" \u2014 declare it on that collection, then retry`
+    );
+  }
+  const targetQ = db.collection(refDesc.target).query();
+  const byId = /* @__PURE__ */ new Map();
+  for (const row of targetQ.toArray()) {
+    const id = coerceCollectKey(row.id);
+    if (id !== null) byId.set(id, row);
+  }
+  return primaryRows.map((row) => {
+    const anchor = leg.from === void 0 ? row : row[leg.from];
+    const key = anchor == null ? null : coerceCollectKey(anchor[leg.field]);
+    return { ...row, [leg.as]: key === null ? null : byId.get(key) ?? null };
+  });
+}
+function applyCollectLeg(primaryRows, leg, mvName, source, joins, db) {
   const childColl = db.collection(leg.collect);
   const childQ = childColl.query();
   const refDesc = childQ._joinContext?.()?.resolveRef(leg.on);
+  const expected = resolveLegOwner(leg, joins, source, legOwnerLookup(db));
+  const expectedName = expected ?? source;
   if (refDesc == null) {
     throw new MaterializedViewConfigError(
-      `"${mvName}": projection collect leg "${leg.as}" requires a ref() on field "${leg.on}" of collection "${leg.collect}" targeting "${source}" \u2014 declare refs: { ${leg.on}: ref('${source}') } on collection "${leg.collect}", then retry`
+      `"${mvName}": projection collect leg "${leg.as}" requires a ref() on field "${leg.on}" of collection "${leg.collect}" targeting "${expectedName}" \u2014 declare refs: { ${leg.on}: ref('${expectedName}') } on collection "${leg.collect}", then retry`
     );
   }
-  if (refDesc.target !== source) {
+  if (refDesc.target !== expectedName) {
     throw new MaterializedViewConfigError(
-      `"${mvName}": projection collect leg "${leg.as}" expects field "${leg.on}" of collection "${leg.collect}" to reference the projection source "${source}", but its ref() targets "${refDesc.target}"`
+      `"${mvName}": projection collect leg "${leg.as}" expects field "${leg.on}" of collection "${leg.collect}" to reference ${leg.from === void 0 ? `the projection source "${expectedName}"` : `"${expectedName}" (the collection behind from: "${leg.from}")`}, but its ref() targets "${refDesc.target}"`
     );
   }
   const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS;
@@ -166,7 +200,8 @@ function applyCollectLeg(primaryRows, leg, mvName, source, db) {
   }
   const out = [];
   for (const row of primaryRows) {
-    const key = coerceCollectKey(row.id);
+    const anchor = leg.from === void 0 ? row : row[leg.from];
+    const key = anchor == null ? null : coerceCollectKey(anchor.id);
     const children = key === null ? [] : groups.get(key) ?? [];
     if (children.length > maxRows) {
       throw new JoinTooLargeError({
@@ -307,4 +342,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-T7JGWTES.js.map
+//# sourceMappingURL=chunk-LIWA5ROZ.js.map

package/dist/chunk-LIWA5ROZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/executor.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { MaterializedViewTooLargeError, MaterializedViewConfigError, LocaleNotSpecifiedError, JoinTooLargeError } from '../../kernel/errors.js'\nimport { DEFAULT_JOIN_MAX_ROWS } from '../../kernel/query/join.js'\nimport type { MaterializedFromMeta, MVQueryContext, MaterializedViewSpec, ProjectionJoinLeg } from './types.js'\nimport type { RegisteredMV } from './registry.js'\nimport { wrapDbWithPredicates } from './registry.js'\nimport { groupAndReduce } from '../../with-lookup/reduce/groupby.js'\nimport { canonicalGroupKey } from '../../with-lookup/reduce/canonical-key.js'\nimport { applyI18nLocale, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { canonicalizeMoneyFieldsAsDecimal, decodeMoneyFields } from '../../via/money/normalize.js'\nimport { exactMath } from '../../via/money/exact.js'\nimport { putDerivedOutput, type PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport { isCollectLeg, resolveLegOwner, type RefLookup } from './projection-legs.js' // #1140\n\n/**\n * Accessor shape passed in from the owning Vault. Mirrors v1's\n * `DerivationStaleAccessor` — provides the per-collection resolver\n * and the active TxContext so refresh writes/tombstones register on\n * `_executed` for rollback symmetry.\n */\nexport interface MVExecutorAccessor {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  /**\n   * Vault-shaped accessor passed to the MV's `query()` callback at\n   * each refresh. Same instance the registry used at registration\n   * time; threading through the executor lets the refresh path\n   * re-evaluate the closure against the live vault state.\n   */\n  getQueryContext(): MVQueryContext\n  /**\n   * #638 Task 5 — ctx for `putDerivedOutput`'s frozen-period skip+audit. #641: the lazy\n   * resolve-on-read caller (`stale.ts#resolveStaleMVOnRead`) now supplies one too — built at\n   * the `Collection.get()`/`list()` entry point with a `'resolve-on-read'` sentinel id (no\n   * real \"reacting write\" for a read-triggered materialize, mirroring `refreshView()`'s\n   * `'refreshView'` sentinel). Still declared optional here since `MVExecutorAccessor` is a\n   * general shape and a future caller could reasonably omit it.\n   */\n  dispatchCtx?: PutDerivedOutputCtx\n}\n\nexport interface RefreshResult {\n  /** Rows newly written / overwritten. */\n  written: number\n  /** Rows tombstoned via `_internalDelete` (only when `onEmpty: 'delete'`). */\n  deleted: number\n  /** Failed row writes (non-strict mode). */\n  failed: number\n  /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp\n   *  couldn't be decoded under the collection's default DEK (undecodable, mirroring\n   *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when\n   *  `onEmpty: 'delete'`. */\n  residueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but\n   *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real\n   *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */\n  residueDeclined: string[]\n}\n\n/** Default cost ceiling — overridable per-MV via `spec.maxRows`. */\nconst DEFAULT_MAX_ROWS = 100_000\n\n/**\n * Materialize a query terminal that may be a `Query<T>` (call\n * `.toArray()`), an `Reduction<R>` (call `.run()` returning a\n * single object — wrap as a one-row array), or a `GroupedReduction<R>`\n * (call `.run()` returning an array of grouped rows). Branches on\n * available terminal at runtime — no type-discrimination at registration.\n */\nasync function materializeQueryResult(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  q: any,\n  mvName: string,\n  i18nLocale?: string,\n  i18nFields?: Record<string, I18nTextDescriptor>,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  if (typeof q?.toArray === 'function') {\n    // Query<T> — non-aggregate path. `.toArray()` returns Promise<T[]>.\n    return await q.toArray()\n  }\n  if (typeof q?.run === 'function') {\n    // Reduction<R> or GroupedReduction<R>. `.run()` is synchronous\n    // and returns either a single object (Reduction) or an array of\n    // rows (GroupedReduction). Promise.resolve() normalizes both\n    // sync and async (future) variants.\n    // Query-form MV grouping: when the MV declares i18nLocale, pass it +\n    // i18nFields so a GroupedReduction resolves i18n group keys before\n    // bucketing (the Reduction path ignores the extra arg).\n    const runOpts = i18nLocale !== undefined ? { locale: i18nLocale, i18nFields } : undefined\n    const result: unknown = await Promise.resolve(q.run(runOpts))\n    if (Array.isArray(result)) {\n      return result as ReadonlyArray<Record<string, unknown>>\n    }\n    // Single-aggregate result — wrap as one-row array. The consumer's\n    // `rowKey()` should return a stable identity (often a literal\n    // constant like `'total'`) since there's only one row.\n    return [result as Record<string, unknown>]\n  }\n  throw new Error(\n    `MV \"${mvName}\": query() must return a Query<T>, Reduction, or GroupedReduction. ` +\n      `Got something without a .toArray() or .run() terminal.`,\n  )\n}\n\n/**\n * Materialize a UNION-form MV: read every arm's source\n * collection, apply each arm's `map` to project rows into the unified\n * MV row shape, concatenate the mapped streams, then optionally run\n * `groupBy` + `aggregate` over the result.\n *\n * Modes (driven by `spec.groupBy` / `spec.aggregate`):\n *\n *   - No `groupBy` → return the concatenated mapped rows unchanged.\n *   - `groupBy` without `aggregate` → dedupe by composite group key,\n *     keep the first row seen per key (later arms don't overwrite\n *     earlier arms — Map insertion order rules).\n *   - `groupBy` + `aggregate` → delegate to the shared `groupAndReduce`\n *     pipeline used by `Query.groupBy().aggregate()`.\n *\n * Per-arm `map` is the schema-unification boundary; the strategy's\n * `TRow` type parameter enforces that every arm projects into the\n * same shape at compile time.\n *\n * @internal\n */\nasync function materializeUnionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const unified: TRow[] = []\n  for (const arm of spec.unionSources!) {\n    const coll = db.collection<Record<string, unknown>>(arm.collection)\n    // Optional per-arm FK joins: chain `.join(field, { as, ... })` for\n    // each declared leg before terminating. The aliased right-side\n    // record lands at `sourceRow[leg.as]`, where the arm's `map` reads\n    // it. Cast to `any` because the chained join widens the row type but\n    // the executor treats every row as `Record<string, unknown>` — same\n    // pattern the query-form join path uses.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let q: any = coll.query()\n    if (arm.join?.length) {\n      for (const leg of arm.join) {\n        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n      }\n    }\n    const sourceRows = q.toArray() as ReadonlyArray<Record<string, unknown>>\n    for (const r of sourceRows) {\n      const mapped = arm.map(r)\n      // null / undefined means \"omit this source row\" — skip without\n      // pushing so groupBy/aggregate never see a null entry.\n      if (mapped == null) continue\n      unified.push(mapped)\n    }\n  }\n\n  return finalizeMappedRows(spec, unified)\n}\n\n/**\n * Shared post-map tail for the UNION and projection (#810) forms:\n * optional `groupBy` (+ `aggregate`) over the mapped-row stream.\n * Extracted verbatim from `materializeUnionResult` so both forms feed\n * the identical grouping pipeline — i18n group-key resolution, the\n * object-group-key guard, dedup-without-aggregate, and the shared\n * `groupAndReduce` delegate.\n *\n * @internal\n */\nfunction finalizeMappedRows<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  unified: TRow[],\n): ReadonlyArray<Record<string, unknown>> {\n  if (!spec.groupBy) return unified\n\n  const groupFields: readonly string[] =\n    typeof spec.groupBy === 'string' ? [spec.groupBy] : spec.groupBy\n\n  // i18n-aware group keys. An `i18nText` group field carries a raw\n  // `{ locale: string }` map, an unstable object key. When `i18nLocale` is\n  // declared (with `i18nFields` describing those fields), resolve the declared\n  // group-key i18n fields to it at the `mv` layer FIRST — the same unified-rows\n  // boundary where money is threaded — so buckets are stable strings and the\n  // `mv`-layer `onMissing` policy fires here.\n  if (spec.i18nLocale !== undefined && spec.i18nFields !== undefined) {\n    const groupI18n: Record<string, I18nTextDescriptor> = {}\n    for (const f of groupFields) {\n      const d = spec.i18nFields[f]\n      if (d !== undefined) groupI18n[f] = d\n    }\n    if (Object.keys(groupI18n).length > 0) {\n      for (let i = 0; i < unified.length; i++) {\n        unified[i] = applyI18nLocale(unified[i] as Record<string, unknown>, groupI18n, spec.i18nLocale, undefined, 'mv') as TRow\n      }\n    }\n  }\n  // Guard (always): a remaining object-valued group key — an undeclared i18n\n  // field or a locale-less MV — would bucket on a map. Refuse, don't bucket wrong.\n  for (const f of groupFields) {\n    for (const row of unified) {\n      const v = (row as Record<string, unknown>)[f]\n      if (v !== null && typeof v === 'object') {\n        throw new LocaleNotSpecifiedError(\n          f,\n          `Materialized view \"${spec.name}\" groups by \"${f}\", whose value is a raw i18n locale map — ` +\n            `an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at ` +\n            `the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`,\n        )\n      }\n    }\n  }\n\n  // groupBy without aggregate — dedupe by composite key, keep first\n  // seen row per key. Useful for cross-arm uniqueness (e.g. unify two\n  // sibling collections, keeping one row per natural key).\n  if (!spec.aggregate) {\n    const seen = new Map<string, TRow>()\n    for (const row of unified) {\n      const k = canonicalGroupKey(groupFields, row as Record<string, unknown>)\n      if (!seen.has(k)) seen.set(k, row)\n    }\n    return [...seen.values()]\n  }\n\n  // groupBy + aggregate — delegate to the shared pipeline used by\n  // `Query.groupBy().aggregate()`. Result rows carry each grouped\n  // field in declaration order followed by the spec's reducer outputs.\n  return groupAndReduce<Record<string, unknown>>(unified, groupFields, spec.aggregate, spec.moneyFields)\n}\n\n/**\n * Apply the spec's `derive` to each finished row (#1007).\n *\n * Three rules, all of them about keeping the hook narrow enough that the\n * engine never has to reason about the function:\n *\n *  - a `null` / `undefined` return leaves the row untouched;\n *  - a returned key that collides with a `groupBy` field is refused — group\n *    keys are the row's identity and feed `rowKey`, so letting `derive`\n *    rewrite one would silently re-home the row into a different bucket than\n *    the one it was aggregated for;\n *  - a derived field declared in `moneyFields` is quantised through its\n *    descriptor, so the stored value is exact at the declared scale instead of\n *    whatever the user's arithmetic produced.\n *\n * @internal\n */\nfunction applyDerive<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  rows: ReadonlyArray<Record<string, unknown>>,\n): ReadonlyArray<Record<string, unknown>> {\n  const groupFields = new Set<string>(\n    spec.groupBy === undefined ? [] : typeof spec.groupBy === 'string' ? [spec.groupBy] : spec.groupBy,\n  )\n  return rows.map((row) => {\n    // `derive` sees the row the way a READER would: money decoded to its\n    // canonical decimal form, not the scaled integer the reducer left behind.\n    // Handing over `1005` where the schema says `10.05` would make every\n    // derived money expression quietly wrong by a factor of the scale.\n    // `'raw'` keeps it at the exact decimal rather than a locale-formatted\n    // string, which is what `exact.*` consumes.\n    const view = spec.moneyFields ? decodeMoneyFields(row, spec.moneyFields, 'raw') : row\n    const patch = spec.derive!(view as TRow, exactMath)\n    if (patch === null || patch === undefined) return row\n    for (const key of Object.keys(patch)) {\n      if (groupFields.has(key)) {\n        throw new MaterializedViewConfigError(\n          `Materialized view \"${spec.name}\": derive() returned the group key \"${key}\". ` +\n            'A group key is the row\\'s identity and feeds rowKey — rewriting it would re-home the ' +\n            'row into a bucket it was not aggregated for. Emit a differently-named field instead.',\n        )\n      }\n    }\n    // Canonicalize the PATCH only, into the DECIMAL form the money-aware\n    // reducers emit — not the scaled-integer storage form a collection uses.\n    // An MV row's money fields are decimal strings, so a derived field\n    // quantised into storage form reads back as the scaled integer beside\n    // correctly-decoded siblings: `\"1000000\"` next to `\"10000.00\"` (#1018).\n    // Precision is still enforced; only the output shape differs.\n    const canonical = spec.moneyFields\n      ? canonicalizeMoneyFieldsAsDecimal(patch, spec.moneyFields)\n      : patch\n    return { ...row, ...canonical }\n  })\n}\n\n/**\n * Materialize a projection-form MV (#810): hydrate the primary source\n * rows, resolve forward FK legs through the same `.join()` machinery\n * the UNION arms use, attach reverse \"collect\" legs via one\n * hash-grouped snapshot pass per leg, then run the projection `map`\n * (null / undefined omits the primary row) and the shared post-map\n * grouping tail.\n *\n * @internal\n */\nasync function materializeProjectionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const projection = spec.projection!\n  const coll = db.collection<Record<string, unknown>>(projection.source)\n  // ROOT forward legs chain through the query builder exactly like UNION arm\n  // joins — ref() resolution, dangling-mode semantics, presentation dressing,\n  // and ceilings all ride the existing `.join()` path. Cast to `any` for the\n  // same reason `materializeUnionResult` does.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let q: any = coll.query()\n  for (const leg of projection.joins) {\n    if (isCollectLeg(leg) || leg.from !== undefined) continue\n    q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n  }\n  let rows = q.toArray() as Array<Record<string, unknown>>\n  // Remaining legs in DECLARATION order — which is what makes `from` work: a leg\n  // may only name an alias declared earlier, so by the time it runs, the rows it\n  // attaches to are already on the row. Root collect legs are in this loop too;\n  // they were never part of the query chain.\n  for (const leg of projection.joins) {\n    if (isCollectLeg(leg)) {\n      rows = applyCollectLeg(rows, leg, spec.name, projection.source, projection.joins, db)\n    } else if (leg.from !== undefined) {\n      rows = applyLegRelativeForwardLeg(rows, leg, spec.name, projection.source, projection.joins, db)\n    }\n  }\n  const mapped: TRow[] = []\n  for (const r of rows) {\n    const m = projection.map(r)\n    // null / undefined means \"omit this primary row\" — same contract\n    // as the UNION arm `map`.\n    if (m == null) continue\n    mapped.push(m)\n  }\n  return finalizeMappedRows(spec, mapped)\n}\n\n/**\n * A `RefLookup` backed by the live join contexts — the executor's answer to the\n * same question the registry answers from the ref registry. Reads through, so a\n * ref declared after `openVault()` (the only place refs CAN be declared) is\n * visible here.\n *\n * @internal\n */\nfunction legOwnerLookup(db: MVQueryContext): RefLookup {\n  return (collection, field) => {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const q = db.collection<Record<string, unknown>>(collection).query() as any\n    return (q._joinContext?.()?.resolveRef(field) as { target: string } | null | undefined) ?? null\n  }\n}\n\n/**\n * Attach one FORWARD leg that hangs off another leg's alias (#1140).\n *\n * Root forward legs ride `Query.join()` and are resolved before this runs; a\n * leg-relative one cannot, because the FK it follows lives on an already-attached\n * record rather than on a column of the primary query. It is therefore resolved\n * the same way a collect leg is — one snapshot of the target collection, indexed\n * by id — which keeps it O(N+M) rather than one `get()` per row.\n *\n * Attaches `null` when the `from` alias is null (a dangling ref upstream), when\n * the FK is nullish, or when the target row is missing. That is deliberately\n * outer-by-nature and matches the collect leg's empty array: a projection MV\n * must not drop a primary row because something two hops away is absent.\n *\n * @internal\n */\nfunction applyLegRelativeForwardLeg(\n  primaryRows: ReadonlyArray<Record<string, unknown>>,\n  leg: Extract<ProjectionJoinLeg, { field: string }>,\n  mvName: string,\n  source: string,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  db: MVQueryContext,\n): Array<Record<string, unknown>> {\n  const lookup = legOwnerLookup(db)\n  const owner = resolveLegOwner(leg, joins, source, lookup)\n  const refDesc = owner === null ? null : lookup(owner, leg.field)\n  if (owner === null || refDesc === null) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection leg \"${leg.as}\" requires a ref() on field \"${leg.field}\" of `\n      + `collection \"${owner ?? `(behind from: \"${leg.from}\")`}\" — declare it on that collection, `\n      + `then retry`,\n    )\n  }\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const targetQ = db.collection<Record<string, unknown>>(refDesc.target).query() as any\n  const byId = new Map<string, Record<string, unknown>>()\n  for (const row of targetQ.toArray() as Array<Record<string, unknown>>) {\n    const id = coerceCollectKey(row.id)\n    if (id !== null) byId.set(id, row)\n  }\n  return primaryRows.map((row) => {\n    const anchor = leg.from === undefined\n      ? row\n      : (row[leg.from] as Record<string, unknown> | null | undefined)\n    const key = anchor == null ? null : coerceCollectKey(anchor[leg.field])\n    return { ...row, [leg.as]: key === null ? null : byId.get(key) ?? null }\n  })\n}\n\n/**\n * Attach one reverse \"collect\" leg (#810): every row of `leg.collect`\n * whose `leg.on` field references the ATTACH POINT's id lands in a\n * possibly-empty ARRAY under `leg.as` on that primary row. One\n * snapshot pass over the collect collection, hash-grouped by the `on`\n * FK — O(N+M), mirroring the forward hash-join fallback.\n *\n * The attach point is the primary record, or — with `from` (#1140) — the record\n * already attached under that alias. Matching then keys off `row[from].id`\n * instead of `row.id`, and `leg.on` must ref THAT leg's collection. A row whose\n * `from` alias is null (a dangling forward ref) gets `[]`, which is the same\n * outer-by-nature semantics a root collect leg already has for a primary record\n * with no children.\n *\n * Semantic check (first materialization, not factory time — parity\n * with join-time ref errors): `leg.on` must carry a `ref()` declared\n * on the collect collection targeting the attach point's collection.\n *\n * @internal\n */\nfunction applyCollectLeg(\n  primaryRows: ReadonlyArray<Record<string, unknown>>,\n  leg: { readonly collect: string; readonly on: string; readonly as: string; readonly from?: string; readonly maxRows?: number },\n  mvName: string,\n  source: string,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  db: MVQueryContext,\n): Array<Record<string, unknown>> {\n  const childColl = db.collection<Record<string, unknown>>(leg.collect)\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const childQ = childColl.query() as any\n  const refDesc = childQ._joinContext?.()?.resolveRef(leg.on) as { target: string } | null | undefined\n  // The collection this leg matches AGAINST: the projection source for a root\n  // leg, the `from` leg's own target otherwise (#1140).\n  const expected = resolveLegOwner(leg, joins, source, legOwnerLookup(db))\n  const expectedName = expected ?? source\n  if (refDesc == null) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" requires a ref() on field \"${leg.on}\" of `\n      + `collection \"${leg.collect}\" targeting \"${expectedName}\" — declare `\n      + `refs: { ${leg.on}: ref('${expectedName}') } on collection \"${leg.collect}\", then retry`,\n    )\n  }\n  if (refDesc.target !== expectedName) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" expects field \"${leg.on}\" of collection `\n      + `\"${leg.collect}\" to reference ${leg.from === undefined\n        ? `the projection source \"${expectedName}\"`\n        : `\"${expectedName}\" (the collection behind from: \"${leg.from}\")`}`\n      + `, but its ref() targets \"${refDesc.target}\"`,\n    )\n  }\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n  const groups = new Map<string, Array<Record<string, unknown>>>()\n  for (const child of childQ.toArray() as Array<Record<string, unknown>>) {\n    const key = coerceCollectKey(child[leg.on])\n    // Nullish / non-scalar FK values mean \"no reference\" — same\n    // narrowing as the forward join path's key coercion.\n    if (key === null) continue\n    const bucket = groups.get(key)\n    if (bucket) bucket.push(child)\n    else groups.set(key, [child])\n  }\n  const out: Array<Record<string, unknown>> = []\n  for (const row of primaryRows) {\n    // `from` matches against the attached record's id, not the primary row's.\n    const anchor = leg.from === undefined\n      ? row\n      : (row[leg.from] as Record<string, unknown> | null | undefined)\n    const key = anchor == null ? null : coerceCollectKey(anchor.id)\n    const children = key === null ? [] : groups.get(key) ?? []\n    if (children.length > maxRows) {\n      throw new JoinTooLargeError({\n        leftRows: primaryRows.length,\n        rightRows: children.length,\n        maxRows,\n        side: 'right',\n        message:\n          `projection MV \"${mvName}\": collect leg \"${leg.as}\" gathered ${children.length} ` +\n          `\"${leg.collect}\" rows for one \"${source}\" record, exceeding the ${maxRows}-row ` +\n          `per-primary-row ceiling. Raise the ceiling via { maxRows } on the leg if the ` +\n          `fan-out genuinely fits in memory, or restructure the child collection.`,\n      })\n    }\n    out.push({ ...row, [leg.as]: children })\n  }\n  return out\n}\n\n/**\n * Coerce an unknown FK value into a collect-grouping key. Same\n * narrowing as the join path's `coerceRefKey` (not exported from\n * there): strings and numbers are legitimate ref values; anything\n * else is \"no reference\" and returns `null`.\n *\n * @internal\n */\nfunction coerceCollectKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Run an MV's `query()` and write the result rows to the output\n * collection. Same-DEK encryption: routes through the standard\n * `Collection.put` pipeline, so the output collection's DEK is what\n * gets used (matches the v2 spec's \"same DEK as the left-most source\"\n * invariant — `Collection.put` looks up the DEK by collection name,\n * and the output collection IS the MV's owned collection).\n *\n * Stamps `_materializedFrom` onto every emitted row.\n *\n * **Tombstoning:** when `spec.onEmpty: 'delete'` (default), rows\n * that existed in a prior refresh but no longer appear in the new\n * materialized result are deleted via `Collection._internalDelete` —\n * the housekeeping bypass primitive prevents user\n * `onDelete` guards on the output collection from firing on these\n * system-internal deletes. `onEmpty: 'keep'` opts out (rows from\n * prior refreshes linger even when the new result lacks them).\n *\n * **Cost ceiling:** if the materialized row count exceeds\n * `spec.maxRows` (default 100k), throws `MaterializedViewTooLargeError`\n * before any writes hit the store — so strict-mode rollback is\n * clean.\n *\n * **Strict mode:** `spec.strict === true` re-throws on any\n * row-write failure; the active TxContext registration means the\n * source-write rolls back atomically via `revertExecuted`.\n *\n * @internal\n */\nexport const MaterializedViewExecutor = {\n  async refresh(\n    reg: RegisteredMV,\n    accessor: MVExecutorAccessor,\n  ): Promise<RefreshResult> {\n    const spec = reg.spec\n    const outputColl = accessor.getCollection(reg.outputCollection)\n    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS\n    const onEmpty = spec.onEmpty ?? 'delete'\n    const strict = spec.strict ?? false\n\n    // 1. Materialize the query (branches on terminal shape). If the\n    //    MV declared predicates, wrap the query context the same way\n    //    the registry did at registration time so `.wherePredicate()`\n    //    calls resolve to the registered functions.\n    const baseCtx = accessor.getQueryContext()\n    const ctxForQuery: MVQueryContext = spec.predicates\n      ? wrapDbWithPredicates(baseCtx, spec.predicates)\n      : baseCtx\n    // UNION-form strategies: read every arm, map to the unified\n    // row shape, concatenate, then optionally groupBy + aggregate.\n    // Projection-form strategies (#810): hydrate the primary source,\n    // attach forward + collect legs, map, then the same optional\n    // grouping tail. The single-source `query()` path is untouched.\n    let rows: ReadonlyArray<Record<string, unknown>>\n    if (spec.unionSources) {\n      rows = await materializeUnionResult(spec, ctxForQuery)\n    } else if (spec.projection) {\n      rows = await materializeProjectionResult(spec, ctxForQuery)\n    } else {\n      const q = spec.query!(ctxForQuery)\n      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields)\n    }\n\n    // #1007 — the post-aggregate projection. Applied here, after every form has\n    // produced its finished rows, so union / projection / query all get the\n    // same single definition of \"last step before materialisation\".\n    if (spec.derive) rows = applyDerive(spec, rows)\n\n    // #777 — exclude this MV's OWN previously-stamped output rows from the\n    // input scan. A same-collection Query-form MV copies the whole source row\n    // verbatim into its output, so a stale output row can itself satisfy the\n    // MV's own input filter (when the filter is on a field disjoint from the\n    // partition field) and get re-selected as if it were live source — the\n    // row self-perpetuates after its true source is gone. Prior output is\n    // never this MV's own source.\n    rows = rows.filter((row) => {\n      const stamp = row._materializedFrom as { mvName?: string } | undefined\n      return stamp?.mvName !== spec.name\n    })\n\n    // 2. Cost ceiling check BEFORE any writes — keeps the rollback\n    //    clean if the source-write is wrapped in a transaction.\n    if (rows.length > maxRows) {\n      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows)\n    }\n\n    const txCtx = accessor.getActiveTxContext()\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const adapter = (outputColl as any).adapter as {\n      get(v: string, c: string, i: string): Promise<EncryptedEnvelope | null>\n    }\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const vaultName = (outputColl as any).vault as string\n\n    // 3. Compute the post-refresh id set so we can diff against the\n    //    prior-emitted id set for tombstoning (when onEmpty === 'delete').\n    const newIds = new Set<string>()\n    const enrichedRows: Array<{ id: string; record: Record<string, unknown> }> = []\n    for (const row of rows) {\n      const id = spec.rowKey(row)\n      newIds.add(id)\n      const meta: MaterializedFromMeta = {\n        mvName: spec.name,\n        queryHash: reg.queryHash,\n        sourceVersions: {},\n        materializedAt: new Date().toISOString(),\n      }\n      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } })\n    }\n\n    // 4. Write the new rows.\n    let written = 0\n    let failed = 0\n    for (const { id, record } of enrichedRows) {\n      try {\n        if (txCtx !== null) {\n          const prior = await adapter.get(vaultName, reg.outputCollection, id)\n          txCtx._executed.push({\n            op: { type: 'put', vaultName, collectionName: reg.outputCollection, id },\n            priorEnvelope: prior,\n          })\n        }\n        if (accessor.dispatchCtx) {\n          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === 'written') written++\n        } else {\n          await outputColl.put(id, record)\n          written++\n        }\n      } catch (err) {\n        failed++\n        if (strict) throw err\n         \n        console.warn(`[mv] \"${spec.name}\" row write failed:`, err)\n      }\n    }\n\n    // 5. Tombstone rows that existed before but don't appear now.\n    //    `onEmpty: 'keep'` skips this pass entirely. Uses\n    //    `_internalDelete` so a user-registered `onDelete` on the\n    //    output collection does NOT fire on housekeeping (composition fix).\n    let deleted = 0\n    const residueUndecodable: string[] = []\n    const residueDeclined: string[] = []\n    if (onEmpty === 'delete') {\n      const priorIds = await listOutputIds(outputColl)\n      for (const priorId of priorIds) {\n        if (newIds.has(priorId)) continue\n        // #762 — a same-collection partition MV (`output: { collection: <source>, partition }`,\n        // the DERIV-PP30-001 shape) writes INTO its own source collection, so `listOutputIds`\n        // also returns untouched USER source rows here. Decode each candidate and only\n        // tombstone rows THIS MV stamped via `_materializedFrom.mvName` — the exact discipline\n        // `invalidateMVAtRest` uses (stale.ts:151-162). An unstamped row, or one stamped by a\n        // different MV, is never this MV's to delete.\n        const priorEnvelope = await adapter.get(vaultName, reg.outputCollection, priorId)\n        if (priorEnvelope === null) continue\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const priorDecoded = await (outputColl as any)._decodeEnvelope(priorEnvelope, priorId)\n        if (priorDecoded === null) {\n          // #782 part a — ownership unknown (undecodable, e.g. elevated above tier 0 on a\n          // tiered output collection): can't rule out this being THIS MV's own stamped row.\n          // Surface it rather than silently skip (mirrors invalidateMVAtRest's #776 posture —\n          // previously this leg had NO residue channel at all).\n          residueUndecodable.push(`${reg.outputCollection}:${priorId}`)\n          continue\n        }\n        const priorStampedBy =\n          typeof priorDecoded === 'object'\n            ? (priorDecoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n            : undefined\n        if (priorStampedBy?.mvName !== spec.name) continue\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const outAny = outputColl as any\n          if (typeof outAny._internalDelete === 'function') {\n            // #776 part b — gate on the boolean, matching invalidateMVAtRest's discipline\n            // (stale.ts): `_internalDelete` returns `false` for a #718 elevated-skip (no\n            // erasure happened), and that must not inflate the tombstone count.\n            if (await outAny._internalDelete(priorId, txCtx)) {\n              deleted++\n            } else {\n              // #782 part b — decoded AND stamp-owned, but erasure was declined (#718\n              // tier-elevation gate). Ownership IS confirmed here — a real silent survival,\n              // not a legit stamp-mismatch skip. Surface it too.\n              residueDeclined.push(`${reg.outputCollection}:${priorId}`)\n            }\n          } else {\n            // Defensive fallback — should never hit in real flow since\n            // every Collection has `_internalDelete`.\n            await outputColl.delete(priorId)\n            deleted++\n          }\n        } catch (err) {\n          failed++\n          if (strict) throw err\n\n          console.warn(`[mv] \"${spec.name}\" tombstone failed for id=\"${priorId}\":`, err)\n        }\n      }\n    }\n\n    return { written, deleted, failed, residueUndecodable, residueDeclined }\n  },\n}\n\n/**\n * List ids currently present in the MV's output collection via the\n * adapter directly (avoids triggering the lazy resolve-on-read path\n * we're INSIDE). Returns an empty array if the collection doesn't\n * exist or the adapter doesn't surface a list method.\n *\n * @internal\n */\nasync function listOutputIds(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  outputColl: Collection<any>,\n): Promise<string[]> {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const cAny = outputColl as any\n  const adapter = cAny.adapter as { list?: (v: string, c: string) => Promise<readonly string[]> }\n  const vault = cAny.vault as string\n  const name = cAny.name as string\n  if (typeof adapter?.list !== 'function') return []\n  try {\n    const ids = await adapter.list(vault, name)\n    return [...ids]\n  } catch {\n    return []\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,IAAM,mBAAmB;AASzB,eAAe,uBAEb,GACA,QACA,YACA,YACiD;AACjD,MAAI,OAAO,GAAG,YAAY,YAAY;AAEpC,WAAO,MAAM,EAAE,QAAQ;AAAA,EACzB;AACA,MAAI,OAAO,GAAG,QAAQ,YAAY;AAQhC,UAAM,UAAU,eAAe,SAAY,EAAE,QAAQ,YAAY,WAAW,IAAI;AAChF,UAAM,SAAkB,MAAM,QAAQ,QAAQ,EAAE,IAAI,OAAO,CAAC;AAC5D,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO;AAAA,IACT;AAIA,WAAO,CAAC,MAAiC;AAAA,EAC3C;AACA,QAAM,IAAI;AAAA,IACR,OAAO,MAAM;AAAA,EAEf;AACF;AAuBA,eAAe,uBACb,MACA,IACiD;AACjD,QAAM,UAAkB,CAAC;AACzB,aAAW,OAAO,KAAK,cAAe;AACpC,UAAM,OAAO,GAAG,WAAoC,IAAI,UAAU;AAQlE,QAAI,IAAS,KAAK,MAAM;AACxB,QAAI,IAAI,MAAM,QAAQ;AACpB,iBAAW,OAAO,IAAI,MAAM;AAC1B,YAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,QAAQ;AAC7B,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,CAAC;AAGxB,UAAI,UAAU,KAAM;AACpB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,mBAAmB,MAAM,OAAO;AACzC;AAYA,SAAS,mBACP,MACA,SACwC;AACxC,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,cACJ,OAAO,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,IAAI,KAAK;AAQ3D,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,YAAgD,CAAC;AACvD,eAAW,KAAK,aAAa;AAC3B,YAAM,IAAI,KAAK,WAAW,CAAC;AAC3B,UAAI,MAAM,OAAW,WAAU,CAAC,IAAI;AAAA,IACtC;AACA,QAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,GAA8B,WAAW,KAAK,YAAY,QAAW,IAAI;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,KAAK,aAAa;AAC3B,eAAW,OAAO,SAAS;AACzB,YAAM,IAAK,IAAgC,CAAC;AAC5C,UAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,KAAK,IAAI,gBAAgB,CAAC;AAAA,QAGlD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,KAAK,WAAW;AACnB,UAAM,OAAO,oBAAI,IAAkB;AACnC,eAAW,OAAO,SAAS;AACzB,YAAM,IAAI,kBAAkB,aAAa,GAA8B;AACvE,UAAI,CAAC,KAAK,IAAI,CAAC,EAAG,MAAK,IAAI,GAAG,GAAG;AAAA,IACnC;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAKA,SAAO,eAAwC,SAAS,aAAa,KAAK,WAAW,KAAK,WAAW;AACvG;AAmBA,SAAS,YACP,MACA,MACwC;AACxC,QAAM,cAAc,IAAI;AAAA,IACtB,KAAK,YAAY,SAAY,CAAC,IAAI,OAAO,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,IAAI,KAAK;AAAA,EAC7F;AACA,SAAO,KAAK,IAAI,CAAC,QAAQ;AAOvB,UAAM,OAAO,KAAK,cAAc,kBAAkB,KAAK,KAAK,aAAa,KAAK,IAAI;AAClF,UAAM,QAAQ,KAAK,OAAQ,MAAc,SAAS;AAClD,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,YAAY,IAAI,GAAG,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,sBAAsB,KAAK,IAAI,uCAAuC,GAAG;AAAA,QAG3E;AAAA,MACF;AAAA,IACF;AAOA,UAAM,YAAY,KAAK,cACnB,iCAAiC,OAAO,KAAK,WAAW,IACxD;AACJ,WAAO,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAChC,CAAC;AACH;AAYA,eAAe,4BACb,MACA,IACiD;AACjD,QAAM,aAAa,KAAK;AACxB,QAAM,OAAO,GAAG,WAAoC,WAAW,MAAM;AAMrE,MAAI,IAAS,KAAK,MAAM;AACxB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,aAAa,GAAG,KAAK,IAAI,SAAS,OAAW;AACjD,QAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,EACpF;AACA,MAAI,OAAO,EAAE,QAAQ;AAKrB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,gBAAgB,MAAM,KAAK,KAAK,MAAM,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtF,WAAW,IAAI,SAAS,QAAW;AACjC,aAAO,2BAA2B,MAAM,KAAK,KAAK,MAAM,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,SAAiB,CAAC;AACxB,aAAW,KAAK,MAAM;AACpB,UAAM,IAAI,WAAW,IAAI,CAAC;AAG1B,QAAI,KAAK,KAAM;AACf,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO,mBAAmB,MAAM,MAAM;AACxC;AAUA,SAAS,eAAe,IAA+B;AACrD,SAAO,CAAC,YAAY,UAAU;AAE5B,UAAM,IAAI,GAAG,WAAoC,UAAU,EAAE,MAAM;AACnE,WAAQ,EAAE,eAAe,GAAG,WAAW,KAAK,KAA+C;AAAA,EAC7F;AACF;AAkBA,SAAS,2BACP,aACA,KACA,QACA,QACA,OACA,IACgC;AAChC,QAAM,SAAS,eAAe,EAAE;AAChC,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,MAAM;AACxD,QAAM,UAAU,UAAU,OAAO,OAAO,OAAO,OAAO,IAAI,KAAK;AAC/D,MAAI,UAAU,QAAQ,YAAY,MAAM;AACtC,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,gCAAgC,IAAI,KAAK,oBAC9D,SAAS,kBAAkB,IAAI,IAAI,IAAI;AAAA,IAE1D;AAAA,EACF;AAEA,QAAM,UAAU,GAAG,WAAoC,QAAQ,MAAM,EAAE,MAAM;AAC7E,QAAM,OAAO,oBAAI,IAAqC;AACtD,aAAW,OAAO,QAAQ,QAAQ,GAAqC;AACrE,UAAM,KAAK,iBAAiB,IAAI,EAAE;AAClC,QAAI,OAAO,KAAM,MAAK,IAAI,IAAI,GAAG;AAAA,EACnC;AACA,SAAO,YAAY,IAAI,CAAC,QAAQ;AAC9B,UAAM,SAAS,IAAI,SAAS,SACxB,MACC,IAAI,IAAI,IAAI;AACjB,UAAM,MAAM,UAAU,OAAO,OAAO,iBAAiB,OAAO,IAAI,KAAK,CAAC;AACtE,WAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,OAAO,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK;AAAA,EACzE,CAAC;AACH;AAsBA,SAAS,gBACP,aACA,KACA,QACA,QACA,OACA,IACgC;AAChC,QAAM,YAAY,GAAG,WAAoC,IAAI,OAAO;AAEpE,QAAM,SAAS,UAAU,MAAM;AAC/B,QAAM,UAAU,OAAO,eAAe,GAAG,WAAW,IAAI,EAAE;AAG1D,QAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ,eAAe,EAAE,CAAC;AACvE,QAAM,eAAe,YAAY;AACjC,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,gCAAgC,IAAI,EAAE,oBACnE,IAAI,OAAO,gBAAgB,YAAY,4BAC3C,IAAI,EAAE,UAAU,YAAY,uBAAuB,IAAI,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,QAAQ,WAAW,cAAc;AACnC,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,oBAAoB,IAAI,EAAE,oBAClE,IAAI,OAAO,kBAAkB,IAAI,SAAS,SAC5C,0BAA0B,YAAY,MACtC,IAAI,YAAY,mCAAmC,IAAI,IAAI,IAAI,4BACrC,QAAQ,MAAM;AAAA,IAC9C;AAAA,EACF;AACA,QAAM,UAAU,IAAI,WAAW;AAC/B,QAAM,SAAS,oBAAI,IAA4C;AAC/D,aAAW,SAAS,OAAO,QAAQ,GAAqC;AACtE,UAAM,MAAM,iBAAiB,MAAM,IAAI,EAAE,CAAC;AAG1C,QAAI,QAAQ,KAAM;AAClB,UAAM,SAAS,OAAO,IAAI,GAAG;AAC7B,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,QAAO,IAAI,KAAK,CAAC,KAAK,CAAC;AAAA,EAC9B;AACA,QAAM,MAAsC,CAAC;AAC7C,aAAW,OAAO,aAAa;AAE7B,UAAM,SAAS,IAAI,SAAS,SACxB,MACC,IAAI,IAAI,IAAI;AACjB,UAAM,MAAM,UAAU,OAAO,OAAO,iBAAiB,OAAO,EAAE;AAC9D,UAAM,WAAW,QAAQ,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC;AACzD,QAAI,SAAS,SAAS,SAAS;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,UAAU,YAAY;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,MAAM;AAAA,QACN,SACE,kBAAkB,MAAM,mBAAmB,IAAI,EAAE,cAAc,SAAS,MAAM,KAC1E,IAAI,OAAO,mBAAmB,MAAM,2BAA2B,OAAO;AAAA,MAG9E,CAAC;AAAA,IACH;AACA,QAAI,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC;AAAA,EACzC;AACA,SAAO;AACT;AAUA,SAAS,iBAAiB,OAA+B;AACvD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AA+BO,IAAM,2BAA2B;AAAA,EACtC,MAAM,QACJ,KACA,UACwB;AACxB,UAAM,OAAO,IAAI;AACjB,UAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,SAAS,KAAK,UAAU;AAM9B,UAAM,UAAU,SAAS,gBAAgB;AACzC,UAAM,cAA8B,KAAK,aACrC,qBAAqB,SAAS,KAAK,UAAU,IAC7C;AAMJ,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,aAAO,MAAM,uBAAuB,MAAM,WAAW;AAAA,IACvD,WAAW,KAAK,YAAY;AAC1B,aAAO,MAAM,4BAA4B,MAAM,WAAW;AAAA,IAC5D,OAAO;AACL,YAAM,IAAI,KAAK,MAAO,WAAW;AACjC,aAAO,MAAM,uBAAuB,GAAG,KAAK,MAAM,KAAK,YAAY,KAAK,UAAU;AAAA,IACpF;AAKA,QAAI,KAAK,OAAQ,QAAO,YAAY,MAAM,IAAI;AAS9C,WAAO,KAAK,OAAO,CAAC,QAAQ;AAC1B,YAAM,QAAQ,IAAI;AAClB,aAAO,OAAO,WAAW,KAAK;AAAA,IAChC,CAAC;AAID,QAAI,KAAK,SAAS,SAAS;AACzB,YAAM,IAAI,8BAA8B,KAAK,MAAM,KAAK,QAAQ,OAAO;AAAA,IACzE;AAEA,UAAM,QAAQ,SAAS,mBAAmB;AAE1C,UAAM,UAAW,WAAmB;AAIpC,UAAM,YAAa,WAAmB;AAItC,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,eAAuE,CAAC;AAC9E,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,OAAO,GAAG;AAC1B,aAAO,IAAI,EAAE;AACb,YAAM,OAA6B;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,WAAW,IAAI;AAAA,QACf,gBAAgB,CAAC;AAAA,QACjB,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzC;AACA,mBAAa,KAAK,EAAE,IAAI,QAAQ,EAAE,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACvE;AAGA,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,EAAE,IAAI,OAAO,KAAK,cAAc;AACzC,UAAI;AACF,YAAI,UAAU,MAAM;AAClB,gBAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,EAAE;AACnE,gBAAM,UAAU,KAAK;AAAA,YACnB,IAAI,EAAE,MAAM,OAAO,WAAW,gBAAgB,IAAI,kBAAkB,GAAG;AAAA,YACvE,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa;AACxB,cAAI,MAAM,iBAAiB,YAAY,IAAI,QAAQ,SAAS,WAAW,MAAM,UAAW;AAAA,QAC1F,OAAO;AACL,gBAAM,WAAW,IAAI,IAAI,MAAM;AAC/B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ;AACA,YAAI,OAAQ,OAAM;AAElB,gBAAQ,KAAK,SAAS,KAAK,IAAI,uBAAuB,GAAG;AAAA,MAC3D;AAAA,IACF;AAMA,QAAI,UAAU;AACd,UAAM,qBAA+B,CAAC;AACtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,YAAY,UAAU;AACxB,YAAM,WAAW,MAAM,cAAc,UAAU;AAC/C,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,IAAI,OAAO,EAAG;AAOzB,cAAM,gBAAgB,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,OAAO;AAChF,YAAI,kBAAkB,KAAM;AAE5B,cAAM,eAAe,MAAO,WAAmB,gBAAgB,eAAe,OAAO;AACrF,YAAI,iBAAiB,MAAM;AAKzB,6BAAmB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAC5D;AAAA,QACF;AACA,cAAM,iBACJ,OAAO,iBAAiB,WACnB,aAAyC,oBAC1C;AACN,YAAI,gBAAgB,WAAW,KAAK,KAAM;AAC1C,YAAI;AAEF,gBAAM,SAAS;AACf,cAAI,OAAO,OAAO,oBAAoB,YAAY;AAIhD,gBAAI,MAAM,OAAO,gBAAgB,SAAS,KAAK,GAAG;AAChD;AAAA,YACF,OAAO;AAIL,8BAAgB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAAA,YAC3D;AAAA,UACF,OAAO;AAGL,kBAAM,WAAW,OAAO,OAAO;AAC/B;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ;AACA,cAAI,OAAQ,OAAM;AAElB,kBAAQ,KAAK,SAAS,KAAK,IAAI,8BAA8B,OAAO,MAAM,GAAG;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,SAAS,QAAQ,oBAAoB,gBAAgB;AAAA,EACzE;AACF;AAUA,eAAe,cAEb,YACmB;AAEnB,QAAM,OAAO;AACb,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,KAAK;AACnB,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,SAAS,SAAS,WAAY,QAAO,CAAC;AACjD,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,WAAO,CAAC,GAAG,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}

package/dist/{chunk-3O72ZD2E.js → chunk-LPVZDTQF.js}

@@ -1,9 +1,11 @@
 import {
   sha256Hex
-} from "./chunk-AU3AUJIZ.js";
+} from "./chunk-RQQIB7CD.js";
 import {
-  MaterializedViewSourceUnknownError
-} from "./chunk-CWM4GQD2.js";
+  MaterializedViewConfigError,
+  MaterializedViewSourceUnknownError,
+  RefNotDeclaredError
+} from "./chunk-HKANJAOP.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -44,7 +46,10 @@ function summarizeQueryPlan(query) {
           as: c.as,
           // Inline on: callback: use sentinel — drift detection disabled for this MV
           onPredicateName: c.onPredicateName ?? (c.on ? "[inline]" : null),
-          maxRows: c.maxRows ?? null
+          maxRows: c.maxRows ?? null,
+          // `outer` changes the row set, so it is part of the plan's identity
+          // for drift detection, not decoration (#1130).
+          outer: c.outer ?? false
         };
       }
       return c;
@@ -60,9 +65,10 @@ function summarizeUnionPlan(spec) {
 }
 function summarizeProjectionPlan(spec) {
   const projection = spec.projection;
-  const legs = projection.joins.map(
-    (leg) => "collect" in leg ? `collect:${leg.collect}.${leg.on}\u2192${leg.as}` : `field:${leg.field}\u2192${leg.as}`
-  ).sort();
+  const legs = projection.joins.map((leg) => {
+    const at = leg.from !== void 0 ? `@${leg.from}` : "";
+    return "collect" in leg ? `collect${at}:${leg.collect}.${leg.on}\u2192${leg.as}` : `field${at}:${leg.field}\u2192${leg.as}`;
+  }).sort();
   const body = JSON.stringify({ source: projection.source, legs });
   return `projection(${body})${summarizeGroupingTail(spec)}`;
 }
@@ -102,6 +108,44 @@ function canonicalizeQueryPlan(plan) {
   });
 }
 
+// src/with-formula/materialized-views/projection-legs.ts
+function isCollectLeg(leg) {
+  return "collect" in leg;
+}
+function validateProjectionLegs(mvName, projection) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const leg of projection.joins) {
+    if (leg.from !== void 0) {
+      const parent = seen.get(leg.from);
+      if (!parent) {
+        throw new MaterializedViewConfigError(
+          `"${mvName}": projection leg "${leg.as}" declares from: "${leg.from}", which is not an alias declared EARLIER in \`joins\`. A leg may only attach to the primary row or to a preceding leg \u2014 that ordering rule is what makes a cycle impossible. Known so far: ${[...seen.keys()].map((a) => `"${a}"`).join(", ") || "(none)"}`
+        );
+      }
+      if (isCollectLeg(parent)) {
+        throw new MaterializedViewConfigError(
+          `"${mvName}": projection leg "${leg.as}" declares from: "${leg.from}", but "${leg.from}" is a collect leg and holds an ARRAY of rows, not one record. A leg can only hang off a forward leg (record | null). Attach it to the primary row instead, or collect the far side directly if its ref() reaches "${projection.source}".`
+        );
+      }
+    }
+    seen.set(leg.as, leg);
+  }
+}
+function resolveLegOwner(leg, joins, source, resolveRef) {
+  if (leg.from === void 0) return source;
+  const parent = joins.find((l) => l.as === leg.from);
+  if (!parent) return null;
+  if (isCollectLeg(parent)) return parent.collect;
+  const parentOwner = resolveLegOwner(parent, joins, source, resolveRef);
+  if (parentOwner === null) return null;
+  return resolveRef(parentOwner, parent.field)?.target ?? null;
+}
+function resolveForwardLegTarget(leg, joins, source, resolveRef) {
+  const owner = resolveLegOwner(leg, joins, source, resolveRef);
+  if (owner === null) return null;
+  return resolveRef(owner, leg.field)?.target ?? null;
+}
+
 // src/with-formula/materialized-views/registry.ts
 var WHOLE_RECORD = "*";
 var MaterializedViewRegistry = class {
@@ -123,6 +167,33 @@ var MaterializedViewRegistry = class {
    * target has resolved (see `_resolvePendingForwardDeps`).
    */
   _pendingForwardDeps = [];
+  /**
+   * Query-form strategies whose `query()` callback could not be planned at
+   * registration time because a `.join()` names a field whose `ref()` is not
+   * declared YET (#1139).
+   *
+   * Registration runs inside `openVault()`; a collection's refs can only be
+   * declared afterwards, so for a query-form MV that joins a declared FK there
+   * is NO call ordering the consumer can choose — the plan is simply built too
+   * early. Rather than failing the vault open, the strategy is parked here and
+   * replanned from {@link resolvePendingPlans}, which every write dispatch and
+   * `vault.refreshView()` call runs first. This is the query-form counterpart
+   * of `_pendingForwardDeps`, one level up: that defers a leg's TARGET, this
+   * defers the whole plan.
+   *
+   * Only `RefNotDeclaredError` parks a strategy. Every other planning failure
+   * still throws out of `openVault()` exactly as before, so a typo'd source or
+   * a malformed spec keeps its loud, early error.
+   *
+   * A parked strategy is invisible until it resolves: it contributes no
+   * `_bySource` entries and no cycle-detection edges (same caveat as a
+   * late-resolved forward target — `edges()` runs once at vault open). It also
+   * cannot be dispatched, which is why {@link hasPendingPlans} forces the
+   * conservative branch in `Collection._txAtomicSafe`: the atomic write path
+   * skips MV dispatch, and skipping it here would mean the write that was
+   * supposed to trigger the first replan is the one that gets missed.
+   */
+  _pendingPlans = [];
   /**
    * Register an MV. Invokes `spec.query()` once at registration time to
    * read the plan + join context; the resulting `Query<T>` is discarded
@@ -149,13 +220,20 @@ var MaterializedViewRegistry = class {
       const projection = spec.projection;
       dependencies = /* @__PURE__ */ new Set([projection.source]);
       for (const leg of projection.joins) {
-        if ("collect" in leg) dependencies.add(leg.collect);
-        else pendingForwardFields.push(leg.field);
+        if (isCollectLeg(leg)) dependencies.add(leg.collect);
+        else pendingForwardFields.push(leg.as);
       }
       if (spec.sources) for (const s of spec.sources) dependencies.add(s);
       queryPlanSummary = summarizeProjectionPlan(spec);
     } else {
-      const q = spec.query(dbForQuery);
+      let q;
+      try {
+        q = spec.query(dbForQuery);
+      } catch (e) {
+        if (!(e instanceof RefNotDeclaredError)) throw e;
+        this._pendingPlans.push({ spec, db, ...options !== void 0 ? { options } : {} });
+        return;
+      }
       qAny = q;
       isQuery = typeof qAny._plan === "function";
       if (isQuery) {
@@ -203,15 +281,51 @@ var MaterializedViewRegistry = class {
     }
     if (pendingForwardFields.length > 0) {
       const refRegistry = db.refRegistry;
-      const source = spec.projection.source;
+      const projectionSpec = spec.projection;
+      const resolveRef = (c, f) => refRegistry?.getOutbound(c)[f] ?? null;
       this._pendingForwardDeps.push({
         reg,
-        fields: new Set(pendingForwardFields),
-        resolveTarget: (field) => refRegistry?.getOutbound(source)[field]?.target ?? null
+        aliases: new Set(pendingForwardFields),
+        resolveTarget: (alias) => {
+          const leg = projectionSpec.joins.find((l) => l.as === alias);
+          if (!leg || isCollectLeg(leg)) return null;
+          return resolveForwardLegTarget(leg, projectionSpec.joins, projectionSpec.source, resolveRef);
+        }
       });
       this._resolvePendingForwardDeps();
     }
   }
+  /**
+   * `true` while any query-form strategy is still unplanned (#1139). Read by
+   * `Collection._txAtomicSafe`, which must refuse the atomic write path while
+   * this holds — see the `_pendingPlans` doc comment for why.
+   */
+  hasPendingPlans() {
+    return this._pendingPlans.length > 0;
+  }
+  /**
+   * Replan every parked query-form strategy (#1139). Called at the head of both
+   * write dispatchers and of `vault.refreshView()`, so a strategy resolves on the
+   * first write or refresh after its source collection's refs are declared —
+   * which is the earliest moment it could produce a correct plan, and strictly
+   * before the first moment it could have any output to produce.
+   *
+   * Each entry is handed straight back to {@link register}, so a strategy that
+   * is STILL unplannable simply re-parks itself and the next dispatch tries
+   * again. Idempotent and cheap: the array empties as strategies resolve, and
+   * both callers skip the await entirely once it is empty.
+   *
+   * A late-resolved strategy does NOT retro-feed `edges()` — the unified cycle
+   * pass runs once at vault open, before refs exist. Same caveat, and the same
+   * reason, as a late-resolved forward-leg target.
+   */
+  async resolvePendingPlans() {
+    if (this._pendingPlans.length === 0) return;
+    const parked = this._pendingPlans.splice(0);
+    for (const entry of parked) {
+      await this.register(entry.spec, entry.db, entry.options);
+    }
+  }
   /** All MVs that depend on `source`, in registration order. */
   mvsForSource(source) {
     if (this._pendingForwardDeps.length > 0) this._resolvePendingForwardDeps();
@@ -234,17 +348,17 @@ var MaterializedViewRegistry = class {
   _resolvePendingForwardDeps() {
     for (let i = this._pendingForwardDeps.length - 1; i >= 0; i--) {
       const entry = this._pendingForwardDeps[i];
-      for (const field of [...entry.fields]) {
-        const target = entry.resolveTarget(field);
+      for (const alias of [...entry.aliases]) {
+        const target = entry.resolveTarget(alias);
         if (target === null) continue;
-        entry.fields.delete(field);
+        entry.aliases.delete(alias);
         if (entry.reg.dependencies.has(target)) continue;
         entry.reg.dependencies.add(target);
         const arr = this._bySource.get(target);
         if (arr) arr.push(entry.reg);
         else this._bySource.set(target, [entry.reg]);
       }
-      if (entry.fields.size === 0) this._pendingForwardDeps.splice(i, 1);
+      if (entry.aliases.size === 0) this._pendingForwardDeps.splice(i, 1);
     }
   }
   /** Single MV by name, or `undefined`. */
@@ -363,7 +477,10 @@ export {
   summarizeQueryPlan,
   computeQueryHash,
   canonicalizeQueryPlan,
+  isCollectLeg,
+  validateProjectionLegs,
+  resolveLegOwner,
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-3O72ZD2E.js.map
+//# sourceMappingURL=chunk-LPVZDTQF.js.map