version: 1.0.199

GEMINI.md

@@ -343,7 +343,7 @@ The Merger provides an automated, high-performance graph synchronization engine.
 *   **Factual Creation Dependency Validation**: When `stage_entity` confirms `kind == "create"` via database lookup, `jspg_merge` evaluates `schema.obj.dependencies.get("created")`. If required creation fields are missing from `entity_fields`, `entity_objects`, or `entity_arrays`, `jspg_merge` halts and returns a structured `REQUIRED_FIELD_MISSING` `Drop`.
 *   **Structured Fail-Fast Error Propagation**: Internal merger operations return typed `Result<T, crate::drop::Error>` instances, allowing clean fail-fast `?` traversal and returning `Drop::with_errors(vec![err])` directly at the top-level API boundary on failure.
 *   **Prefix Foreign Key Matching**: Handles scenario where multiple relations point to the same table by using database Foreign Key constraint prefixes (`fk_`). For example, if a schema has `shipping_address` and `billing_address`, the merger resolves against `fk_shipping_address_entity` vs `fk_billing_address_entity` automatically to correctly route object properties.
-*   **Dynamic Deduplication & Lookups**: If a nested object is provided without an `id`, the Merger utilizes custom `lookup_fields` declared directly in the schema registry JSON comments. It validates at setup compile-time that a corresponding unique index exists in PostgreSQL for these fields. When merging, it dynamically builds query predicates for any satisfied `lookup_fields` sets in the entity's type hierarchy (checking child-to-parent hierarchies order-independently and combining satisfied keys with `UNION` queries) to discover the correct UUID to perform an UPDATE, preventing data duplication.
+*   **Dynamic Deduplication & Lookups (`lookup_fields` & `field_defaults`)**: If an entity payload is provided without an `id`, the Merger utilizes custom `lookup_fields` declared directly in the schema metadata (`COMMENT ON TABLE`). When searching for an existing database record (`fetch_entity`), it iterates candidate `lookup_fields` sets across the entity's type hierarchy. For any column in a lookup set that is omitted from the input payload, `fetch_entity` checks for a default value in `field_defaults` (populated from Postgres table column `DEFAULT` expressions during setup). If a default is found (e.g. `start_date: "0001-01-01T00:00:00+00:00"`), `fetch_entity` uses that default value to satisfy the lookup query predicate (`WHERE ... AND start_date = ...`). Crucially, `entity_fields` itself is **never mutated** with defaults during `merge_entity`, ensuring input payloads remain pure, preventing false `modified_at` updates or spurious change notifications, and allowing PostgreSQL to handle column default generation natively server-side on `INSERT`.
 *   **Hierarchical Table Inheritance**: The Punc system uses distributed table inheritance (e.g. `person` inherits `user` inherits `organization` inherits `entity`). The Merger splits the incoming JSON payload and performs atomic row updates across *all* relevant tables in the lineage map.
 *   **The Archive Paradigm**: Data is never deleted in the Punc system. The Merger securely enforces referential integrity by toggling the `archived` Boolean flag on the base `entity` table rather than issuing SQL `DELETE` commands.
 *   **Change Tracking & Reactivity**: The Merger diffs the incoming JSON against the existing database row (utilizing static, `DashMap`-cached `lookup` SELECT string templates). Every detected change is recorded into the `agreego.change` audit table, tracking the user mapping. It then natively uses `pg_notify` to broadcast a completely flat row-level diff out to the Go WebSocket server for O(1) routing.
@@ -374,6 +374,7 @@ The Queryer transforms Postgres into a pre-compiled Semantic Query Engine, desig
     *   **Multi-Table Branching**: If the Physical Table is a parent to other tables (e.g. `organization` has variations `["organization", "bot", "person"]`), the compiler generates a dynamic `CASE WHEN type = '...' THEN ...` query, expanding into sub-queries for each variation. To ensure safe resolution, the compiler dynamically evaluates correlation boundaries: it attempts standard Relational Edge discovery first. If no explicit relational edge exists (indicating pure Table Inheritance rather than a standard foreign-key graph relationship), it safely invokes a **Table Parity Fallback**. This generates an explicit ID correlation constraint (`AND inner.id = outer.id`), perfectly binding the structural variations back to the parent row to eliminate Cartesian products.
     *   **Single-Table Bypass**: If the Physical Table is a leaf node with only one variation (e.g. `person` has variations `["person"]`), the compiler cleanly bypasses `CASE` generation and compiles a simple `SELECT` across the base table, as all schema extensions (e.g. `light.person`, `full.person`) are guaranteed to reside in the exact same physical row.
     *   **Polymorphic Relation Type Filtering**: When a relationship maps to a polymorphic target with variations, the Queryer compiles an `IN` clause containing all allowed table variations (e.g., `counterparty_type IN ('bot', 'organization', 'person')`) rather than matching the base type literal, ensuring all polymorphic types are loaded correctly.
+*   **Tenant Scoping & ReBAC Filtering**: When `jspg_query` compiles root-level or relationship-level entity queries, the generated SQL queries evaluate within the calling PostgreSQL transaction's session configuration (e.g. `punc.cue.organization_ids`, `punc.cue.roles`). The compiled queries seamlessly interact with PostgreSQL Row Level Security (RLS) policies on base tables (such as `agreego.entity`) and pre-materialized Zanzibar graph edges (`agreego.relationship`), ensuring multi-tenant isolation and $O(1)$ query evaluation without requiring manual WHERE scoping logic across every application punc.
 *   **Static Relation Constraints (Kind Constraints)**: When a relationship (such as a nested object or array) is defined with a schema that constrains a field value statically using a `const` or `enum` keyword (for example, `kind` constrained to `"cover"` in a `cover_attachment`), the Queryer automatically extracts these static assertions during AST compilation. It injects them directly as static filters into the SQL subquery's `WHERE` clause (e.g. `AND attachment.kind = 'cover'`), allowing developers to query pre-filtered subsets of related tables natively through the schema.
 *   **Proxy Schema Dereferencing / Resolution**: To support punc endpoints that return non-polymorphic table-backed shapes (using `type: "full.X"` proxy schemas at the root response level), the Queryer compiler automatically dereferences non-table schema pointers to their target schemas prior to checking the types. This allows the Queryer to correctly resolve the table relationship edges pre-compiled on the full schema, while avoiding polluting the database registry with relations on ad-hoc punc response schemas during setup.
 

fixtures/merger.json

@@ -1357,71 +1357,24 @@
               "LEFT JOIN agreego.\"user\" t3 ON t3.id = t1.id",
               "LEFT JOIN agreego.\"person\" t4 ON t4.id = t1.id",
               "WHERE",
-              "  (\"first_name\" = 'LookupFirst'",
-              "  AND \"last_name\" = 'LookupLast'",
-              "  AND \"date_of_birth\" = '{{timestamp}}'",
-              "  AND \"pronouns\" = 'they/them'))"
+              "  (t4.\"first_name\" = 'LookupFirst'",
+              "  AND t4.\"last_name\" = 'LookupLast'",
+              "  AND t4.\"date_of_birth\" = '{{timestamp}}'",
+              "  AND t4.\"pronouns\" = 'they/them'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:generated_0}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"entity\" SET",
+              "  modified_at = '{{timestamp}}',",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:generated_0}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:generated_0}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:generated_0}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"person\" SET",
+              "  contact_id = 'abc-contact'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1435,45 +1388,40 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
+              "      \"contact_id\": \"old-contact\"",
+              "  }',",
+              "  '{",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  '{{uuid:generated_1}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:generated_0}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
               "    }",
               "}'))"
             ]
@@ -1521,71 +1469,24 @@
               "LEFT JOIN agreego.\"user\" t3 ON t3.id = t1.id",
               "LEFT JOIN agreego.\"person\" t4 ON t4.id = t1.id",
               "WHERE",
-              "  (\"first_name\" = 'LookupFirst'",
-              "  AND \"last_name\" = 'LookupLast'",
-              "  AND \"date_of_birth\" = '{{timestamp}}'",
-              "  AND \"pronouns\" = 'they/them'))"
+              "  (t4.\"first_name\" = 'LookupFirst'",
+              "  AND t4.\"last_name\" = 'LookupLast'",
+              "  AND t4.\"date_of_birth\" = '{{timestamp}}'",
+              "  AND t4.\"pronouns\" = 'they/them'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"entity\" SET",
+              "  modified_at = '{{timestamp}}',",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"person\" SET",
+              "  contact_id = 'abc-contact'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1599,46 +1500,42 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
+              "      \"contact_id\": \"old-contact\"",
+              "  }',",
+              "  '{",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
-              "  '{{uuid:data.id}}',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -1687,80 +1584,31 @@
               "LEFT JOIN agreego.\"user\" t3 ON t3.id = t1.id",
               "LEFT JOIN agreego.\"person\" t4 ON t4.id = t1.id",
               "WHERE",
-              "  (\"first_name\" = 'LookupFirst'",
-              "  AND \"last_name\" = 'LookupLast'",
-              "  AND \"date_of_birth\" = '{{timestamp}}'",
-              "  AND \"pronouns\" = 'they/them')",
+              "  (t4.\"first_name\" = 'LookupFirst'",
+              "  AND t4.\"last_name\" = 'LookupLast'",
+              "  AND t4.\"date_of_birth\" = '{{timestamp}}'",
+              "  AND t4.\"pronouns\" = 'they/them')",
               "UNION SELECT COALESCE(to_jsonb(t1.*), '{}') || COALESCE(to_jsonb(t2.*), '{}') || COALESCE(to_jsonb(t3.*), '{}') || COALESCE(to_jsonb(t4.*), '{}')",
               "FROM agreego.\"entity\" t1",
               "LEFT JOIN agreego.\"organization\" t2 ON t2.id = t1.id",
               "LEFT JOIN agreego.\"user\" t3 ON t3.id = t1.id",
               "LEFT JOIN agreego.\"person\" t4 ON t4.id = t1.id",
               "WHERE",
-              "  (\"name\" = 'LookupName'))"
+              "  (t3.\"name\" = 'LookupName'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"entity\" SET",
+              "  modified_at = '{{timestamp}}',",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"name\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'LookupName',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"person\" SET",
+              "  contact_id = 'abc-contact'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1774,49 +1622,43 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"name\": \"LookupName\",",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
+              "      \"contact_id\": \"old-contact\"",
+              "  }',",
+              "  '{",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
-              "  '{{uuid:data.id}}',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"name\": \"LookupName\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"name\": \"LookupName\",",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -1862,119 +1704,29 @@
               "LEFT JOIN agreego.\"user\" t3 ON t3.id = t1.id",
               "LEFT JOIN agreego.\"person\" t4 ON t4.id = t1.id",
               "WHERE",
-              "  (\"first_name\" = 'LookupFirst'",
-              "  AND \"last_name\" = 'LookupLast'",
-              "  AND \"date_of_birth\" = '{{timestamp}}'",
-              "  AND \"pronouns\" = 'they/them'))"
-            ],
-            [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"entity\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"person\".*)"
-            ],
-            [
-              "INSERT INTO agreego.change (",
-              "  \"old\",",
-              "  \"new\",",
-              "  \"entity_id\",",
-              "  \"id\",",
-              "  \"kind\",",
-              "  \"modified_at\",",
-              "  \"modified_by\"",
-              ")",
-              "VALUES (",
-              "  NULL,",
-              "  '{",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
-              "      \"type\": \"person\"",
-              "  }',",
-              "  '{{uuid:data.id}}',",
-              "  '{{uuid:generated_0}}',",
-              "  'create',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000'",
-              ")"
+              "  (t4.\"first_name\" = 'LookupFirst'",
+              "  AND t4.\"last_name\" = 'LookupLast'",
+              "  AND t4.\"date_of_birth\" = '{{timestamp}}'",
+              "  AND t4.\"pronouns\" = 'they/them'))"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"replace\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
+              "      \"contact_id\": \"old-contact\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -2011,59 +1763,19 @@
               "  t1.id = '{{uuid:mocks.0.id}}')"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:mocks.0.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"entity\" SET",
+              "  modified_at = '{{timestamp}}',",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'NewFirst',",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'NewLast',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"person\" SET",
+              "  first_name = 'NewFirst',",
+              "  last_name = 'NewLast'",
+              "WHERE",
+              "  id = '{{uuid:mocks.0.id}}'",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -2077,7 +1789,10 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
+              "  '{",
+              "      \"first_name\": \"OldFirst\",",
+              "      \"last_name\": \"OldLast\"",
+              "  }',",
               "  '{",
               "      \"first_name\": \"NewFirst\",",
               "      \"last_name\": \"NewLast\",",
@@ -2085,21 +1800,19 @@
               "  }',",
               "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
-              "      \"first_name\": \"NewFirst\",",
-              "      \"last_name\": \"NewLast\",",
               "      \"id\": \"{{uuid:mocks.0.id}}\",",
               "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
+              "      \"first_name\": \"NewFirst\",",
+              "      \"last_name\": \"NewLast\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
@@ -2107,6 +1820,10 @@
               "      \"first_name\": \"NewFirst\",",
               "      \"last_name\": \"NewLast\",",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"first_name\": \"OldFirst\",",
+              "      \"last_name\": \"OldLast\"",
               "    }",
               "}'))"
             ]
@@ -2796,10 +2513,10 @@
               "LEFT JOIN agreego.\"relationship\" t2 ON t2.id = t1.id",
               "LEFT JOIN agreego.\"contact\" t3 ON t3.id = t1.id",
               "WHERE",
-              "  (t1.\"type\" = 'contact'",
-              "  AND \"source_id\" = '{{uuid:generated_0}}'",
-              "  AND \"target_id\" = '{{uuid:generated_1}}'",
-              "  AND \"start_date\" = '{{timestamp}}'))"
+              "  (t2.\"type\" = 'contact'",
+              "  AND t2.\"source_id\" = '{{uuid:generated_0}}'",
+              "  AND t2.\"target_id\" = '{{uuid:generated_1}}'",
+              "  AND t2.\"start_date\" = '{{timestamp}}'))"
             ],
             [
               "INSERT INTO agreego.\"entity\" (",
@@ -2928,10 +2645,10 @@
               "LEFT JOIN agreego.\"relationship\" t2 ON t2.id = t1.id",
               "LEFT JOIN agreego.\"contact\" t3 ON t3.id = t1.id",
               "WHERE",
-              "  (t1.\"type\" = 'contact'",
-              "  AND \"source_id\" = '{{uuid:generated_0}}'",
-              "  AND \"target_id\" = '{{uuid:generated_5}}'",
-              "  AND \"start_date\" = '{{timestamp}}'))"
+              "  (t2.\"type\" = 'contact'",
+              "  AND t2.\"source_id\" = '{{uuid:generated_0}}'",
+              "  AND t2.\"target_id\" = '{{uuid:generated_5}}'",
+              "  AND t2.\"start_date\" = '{{timestamp}}'))"
             ],
             [
               "INSERT INTO agreego.\"entity\" (",
@@ -3060,10 +2777,10 @@
               "LEFT JOIN agreego.\"relationship\" t2 ON t2.id = t1.id",
               "LEFT JOIN agreego.\"contact\" t3 ON t3.id = t1.id",
               "WHERE",
-              "  (t1.\"type\" = 'contact'",
-              "  AND \"source_id\" = '{{uuid:generated_0}}'",
-              "  AND \"target_id\" = '{{uuid:generated_9}}'",
-              "  AND \"start_date\" = '{{timestamp}}'))"
+              "  (t2.\"type\" = 'contact'",
+              "  AND t2.\"source_id\" = '{{uuid:generated_0}}'",
+              "  AND t2.\"target_id\" = '{{uuid:generated_9}}'",
+              "  AND t2.\"start_date\" = '{{timestamp}}'))"
             ],
             [
               "INSERT INTO agreego.\"entity\" (",
@@ -3345,59 +3062,14 @@
               "  t1.id = 'abc-archived')"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"archived\",",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  true,",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'abc-archived',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
+              "UPDATE agreego.\"entity\" SET",
+              "  archived = true,",
+              "  modified_at = '{{timestamp}}',",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
+              "WHERE",
+              "  id = 'abc-archived'",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
-            [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"person\".*)"
-            ],
             [
               "INSERT INTO agreego.change (",
               "  \"old\",",
@@ -3409,33 +3081,38 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
+              "  '{",
+              "      \"archived\": false",
+              "  }',",
               "  '{",
               "      \"archived\": true,",
               "      \"type\": \"person\"",
               "  }',",
               "  'abc-archived',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'delete',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"delete\",",
               "    \"complete\": {",
-              "      \"archived\": true,",
               "      \"id\": \"abc-archived\",",
               "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
+              "      \"first_name\": \"ArchivedFirst\",",
+              "      \"last_name\": \"ArchivedLast\",",
+              "      \"archived\": true,",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
               "      \"archived\": true,",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"archived\": false",
               "    }",
               "}'))"
             ]

src/database/executors/mock.rs

@@ -13,7 +13,8 @@ pub struct MockState {
   pub query_responses: Vec<Result<Value, String>>,
   pub execute_responses: Vec<Result<(), String>>,
   pub mocks: Vec<Value>,
-  pub punc_external: bool,
+  pub cue_created_by: Option<String>,
+  pub cue_external: bool,
 }
 
 #[cfg(test)]
@@ -24,12 +25,12 @@ impl MockState {
       query_responses: Default::default(),
       execute_responses: Default::default(),
       mocks: Default::default(),
-      punc_external: false,
+      cue_created_by: Some("00000000-0000-0000-0000-000000000000".to_string()),
+      cue_external: false,
     }
   }
 }
 
-
 #[cfg(test)]
 thread_local! {
   pub static MOCK_STATE: RefCell<MockState> = RefCell::new(MockState::new());
@@ -80,16 +81,22 @@ impl DatabaseExecutor for MockExecutor {
     })
   }
 
-  fn auth_user_id(&self) -> Result<String, String> {
-    Ok("00000000-0000-0000-0000-000000000000".to_string())
+  fn cue_created_by(&self) -> Result<String, String> {
+    MOCK_STATE.with(|state| {
+      state
+        .borrow()
+        .cue_created_by
+        .clone()
+        .ok_or_else(|| "Missing cue.created_by in session context".to_string())
+    })
   }
 
   fn timestamp(&self) -> Result<String, String> {
     Ok("2026-03-10T00:00:00Z".to_string())
   }
 
-  fn punc_external(&self) -> Result<bool, String> {
-    Ok(MOCK_STATE.with(|state| state.borrow().punc_external))
+  fn cue_external(&self) -> Result<bool, String> {
+    Ok(MOCK_STATE.with(|state| state.borrow().cue_external))
   }
 
   #[cfg(test)]
@@ -112,74 +119,96 @@ impl DatabaseExecutor for MockExecutor {
       s.query_responses.clear();
       s.execute_responses.clear();
       s.mocks.clear();
-      s.punc_external = false;
+      s.cue_created_by = Some("00000000-0000-0000-0000-00000000000".to_string());
+      s.cue_external = false;
     });
   }
 }
 
 #[cfg(test)]
 impl MockExecutor {
-  pub fn set_punc_external(&self, external: bool) {
+  pub fn set_cue_external(&self, external: bool) {
     MOCK_STATE.with(|state| {
-      state.borrow_mut().punc_external = external;
+      state.borrow_mut().cue_external = external;
+    });
+  }
+
+  pub fn set_cue_created_by(&self, created_by: Option<String>) {
+    MOCK_STATE.with(|state| {
+      state.borrow_mut().cue_created_by = created_by;
     });
   }
 }
 
-
 #[cfg(test)]
 fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
   let sql_upper = sql.to_uppercase();
-  if !sql_upper.starts_with("SELECT") {
+  if !sql_upper.starts_with("SELECT") && !sql_upper.starts_with("(SELECT") {
     return None;
   }
 
-  // 1. Extract table name
-  let table_regex = Regex::new(r#"(?i)\s+FROM\s+(?:[a-zA-Z_]\w*\.)?"?([a-zA-Z_]\w*)"?"#).ok()?;
-  let table = if let Some(caps) = table_regex.captures(sql) {
-    caps.get(1)?.as_str()
-  } else {
-    return None;
-  };
+  let union_regex = Regex::new(r"(?i)\s+UNION\s+").ok()?;
+  let queries: Vec<&str> = union_regex.split(sql).collect();
 
-  // 2. Extract WHERE conditions string
-  let mut where_clause = String::new();
-  if let Some(where_idx) = sql_upper.find(" WHERE ") {
-    let mut where_end = sql_upper.find(" ORDER BY ").unwrap_or(sql_upper.len());
-    if let Some(limit_idx) = sql_upper.find(" LIMIT ") {
-      if limit_idx < where_end {
-        where_end = limit_idx;
-      }
-    }
-    where_clause = sql[where_idx + 7..where_end].to_string();
-  }
-
-  // 3. Find matching mocks
   let mut matches = Vec::new();
   let or_regex = Regex::new(r"(?i)\s+OR\s+").ok()?;
   let and_regex = Regex::new(r"(?i)\s+AND\s+").ok()?;
 
   for mock in mocks {
-    if let Some(mock_obj) = mock.as_object() {
-      if let Some(t) = mock_obj.get("type") {
-        if t.as_str() != Some(table) {
-          continue;
-        }
-      }
+    let mock_obj = match mock.as_object() {
+      Some(obj) => obj,
+      None => continue,
+    };
 
-      if where_clause.is_empty() {
-        matches.push(mock.clone());
+    let mock_type = mock_obj.get("type").and_then(|v| v.as_str()).unwrap_or("");
+
+    let mut mock_matched = false;
+
+    for query in &queries {
+      let q_upper = query.to_uppercase();
+
+      // Check if mock type matches the table or any joined tables in this query
+      let table_regex =
+        Regex::new(r#"(?i)\s+(?:FROM|JOIN)\s+(?:[a-zA-Z_]\w*\.)?"?([a-zA-Z_]\w*)"?"#).ok()?;
+      let tables: Vec<String> = table_regex
+        .captures_iter(query)
+        .filter_map(|c| c.get(1).map(|m| m.as_str().to_string()))
+        .collect();
+
+      if !mock_type.is_empty() && !tables.is_empty() && !tables.iter().any(|t| t == mock_type) {
         continue;
       }
 
-      let or_parts = or_regex.split(&where_clause);
-      let mut any_branch_matched = false;
+      // Extract WHERE clause
+      let mut where_clause = String::new();
+      if let Some(where_idx) = q_upper.find(" WHERE ") {
+        let mut where_end = q_upper.find(" ORDER BY ").unwrap_or(q_upper.len());
+        if let Some(limit_idx) = q_upper.find(" LIMIT ") {
+          if limit_idx < where_end {
+            where_end = limit_idx;
+          }
+        }
+        where_clause = query[where_idx + 7..where_end]
+          .trim_end_matches(')')
+          .to_string();
+      }
 
+      if where_clause.is_empty() {
+        mock_matched = true;
+        break;
+      }
+
+      let or_parts = or_regex.split(&where_clause);
       for or_part in or_parts {
         let branch_str = or_part.replace('(', "").replace(')', "");
         let mut branch_matches = true;
 
         for part in and_regex.split(&branch_str) {
+          let part = part.trim();
+          if part.is_empty() {
+            continue;
+          }
+
           if let Some(eq_idx) = part.find('=') {
             let left = part[..eq_idx]
               .trim()
@@ -193,7 +222,7 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
               Some(Value::String(s)) => s.clone(),
               Some(Value::Number(n)) => n.to_string(),
               Some(Value::Bool(b)) => b.to_string(),
-              Some(Value::Null) => "null".to_string(),
+              Some(Value::Null) | None => "null".to_string(),
               _ => "".to_string(),
             };
             if mock_val_str != right {
@@ -201,19 +230,21 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
               break;
             }
           } else if part.to_uppercase().contains(" IS NULL") {
-            let left = part[..part.to_uppercase().find(" IS NULL").unwrap()]
+            let is_null_idx = part.to_uppercase().find(" IS NULL").unwrap();
+            let left = part[..is_null_idx]
               .trim()
               .split('.')
               .last()
               .unwrap_or("")
               .trim_matches('"');
 
-            let mock_val_str = match mock_obj.get(left) {
-              Some(Value::Null) => "null".to_string(),
-              _ => "".to_string(),
+            let is_null_val = match mock_obj.get(left) {
+              Some(Value::Null) | None => true,
+              Some(Value::String(s)) if s.is_empty() => true,
+              _ => false,
             };
 
-            if mock_val_str != "null" {
+            if !is_null_val {
               branch_matches = false;
               break;
             }
@@ -221,15 +252,19 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
         }
 
         if branch_matches {
-          any_branch_matched = true;
+          mock_matched = true;
           break;
         }
       }
 
-      if any_branch_matched {
-        matches.push(mock.clone());
+      if mock_matched {
+        break;
       }
     }
+
+    if mock_matched {
+      matches.push(mock.clone());
+    }
   }
 
   Some(matches)

src/database/executors/mod.rs

@@ -14,14 +14,14 @@ pub trait DatabaseExecutor: Send + Sync {
   /// Executes an operation (INSERT, UPDATE, DELETE, or pg_notify) that does not return rows.
   fn execute(&self, sql: &str, args: Option<Vec<Value>>) -> Result<(), String>;
 
-  /// Returns the current authenticated user's ID
-  fn auth_user_id(&self) -> Result<String, String>;
+  /// Returns the current authenticated user's ID (from cue.created_by)
+  fn cue_created_by(&self) -> Result<String, String>;
 
   /// Returns the current transaction timestamp
   fn timestamp(&self) -> Result<String, String>;
 
-  /// Returns true if the current execution context is marked as an external client API cue (punc.external = true)
-  fn punc_external(&self) -> Result<bool, String>;
+  /// Returns true if the current execution context is marked as an external client API cue (cue.external = true)
+  fn cue_external(&self) -> Result<bool, String>;
 
   #[cfg(test)]
   fn get_queries(&self) -> Vec<String>;

src/database/executors/pgrx.rs

@@ -113,12 +113,12 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 
-  fn auth_user_id(&self) -> Result<String, String> {
+  fn cue_created_by(&self) -> Result<String, String> {
     self.transact(|| {
       Spi::connect(|client| {
         let mut tup_table = client
           .select(
-            "SELECT COALESCE(current_setting('auth.user_id', true), 'ffffffff-ffff-ffff-ffff-ffffffffffff')",
+            "SELECT NULLIF(current_setting('punc.cue', true), '')::jsonb->>'created_by'",
             None,
             &[],
           )
@@ -126,10 +126,10 @@ impl DatabaseExecutor for SpiExecutor {
 
         let row = tup_table
           .next()
-          .ok_or("No user id setting returned from context".to_string())?;
+          .ok_or("No cue setting returned from context".to_string())?;
         let user_id: Option<String> = row.get(1).map_err(|e| e.to_string())?;
 
-        user_id.ok_or("Missing user_id".to_string())
+        user_id.ok_or("Missing cue.created_by in session context".to_string())
       })
     })
   }
@@ -151,12 +151,12 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 
-  fn punc_external(&self) -> Result<bool, String> {
+  fn cue_external(&self) -> Result<bool, String> {
     self.transact(|| {
       Spi::connect(|client| {
         let mut tup_table = client
           .select(
-            "SELECT COALESCE(current_setting('punc.external', true), 'false')::boolean",
+            "SELECT COALESCE((NULLIF(current_setting('punc.cue', true), '')::jsonb->>'external')::boolean, false)",
             None,
             &[],
           )
@@ -172,4 +172,3 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 }
-

src/database/mod.rs

@@ -232,9 +232,9 @@ impl Database {
     self.executor.execute(sql, args)
   }
 
-  /// Returns the current authenticated user's ID
-  pub fn auth_user_id(&self) -> Result<String, String> {
-    self.executor.auth_user_id()
+  /// Returns the current authenticated user's ID (from cue.created_by)
+  pub fn cue_created_by(&self) -> Result<String, String> {
+    self.executor.cue_created_by()
   }
 
   /// Returns the current transaction timestamp
@@ -242,6 +242,11 @@ impl Database {
     self.executor.timestamp()
   }
 
+  /// Returns true if the current execution context is marked as an external client API cue (cue.external = true)
+  pub fn cue_external(&self) -> Result<bool, String> {
+    self.executor.cue_external()
+  }
+
   pub fn compile(&mut self, errors: &mut Vec<crate::drop::Error>) {
     // Phase 1: Registration
     self.collect_schemas(errors);

src/database/type.rs

@@ -5,6 +5,14 @@ use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use serde_json::Value;
 
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct Roles {
+  #[serde(default, skip_serializing_if = "Vec::is_empty")]
+  pub read: Vec<String>,
+  #[serde(default, skip_serializing_if = "Vec::is_empty")]
+  pub write: Vec<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 #[serde(default)]
 pub struct Type {
@@ -38,6 +46,8 @@ pub struct Type {
   #[serde(default)]
   pub field_defaults: IndexMap<String, Value>,
   pub field_types: Option<Value>,
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub roles: Option<Roles>,
   #[serde(default)]
   pub schemas: IndexMap<String, Arc<Schema>>,
 }

src/merger/mod.rs

@@ -335,16 +335,7 @@ impl Merger {
       }
     }
 
-    // Hydrate missing fields from field_defaults for entity_type and its hierarchy
-    for parent_type_name in &type_def.hierarchy {
-      if let Some(parent_type) = self.db.types.get(parent_type_name) {
-        for (k, v) in &parent_type.field_defaults {
-          if !entity_fields.contains_key(k) {
-            entity_fields.insert(k.clone(), v.clone());
-          }
-        }
-      }
-    }
+
 
     let mut current_org_id = None;
     if let Some(compiled_props) = schema.obj.compiled_properties.get() {
@@ -360,8 +351,8 @@ impl Merger {
       current_org_id = parent_org_id.clone();
     }
 
-    let user_id = self.db.auth_user_id().map_err(|e| Error {
-      code: "AUTH_USER_FAILED".to_string(),
+    let user_id = self.db.cue_created_by().map_err(|e| Error {
+      code: "CUE_CREATED_BY_FAILED".to_string(),
       values: Some(IndexMap::from([("error".to_string(), e.clone())])),
       details: ErrorDetails {
         cause: Some(e),
@@ -771,21 +762,34 @@ impl Merger {
       if let Some(parent_type) = self.db.types.get(parent_type_name) {
         if !parent_type.lookup_fields.is_empty() {
           let mut lookup_complete = true;
+          let mut has_provided_fields = false;
           for column in &parent_type.lookup_fields {
-            match entity_fields.get(column) {
+            let is_nullable = parent_type.null_fields.contains(column);
+            let val = entity_fields.get(column).or_else(|| {
+              parent_type.field_defaults.get(column)
+            });
+            match val {
               Some(Value::Null) | None => {
-                lookup_complete = false;
-                break;
+                if !is_nullable {
+                  lookup_complete = false;
+                  break;
+                }
               }
               Some(Value::String(s)) if s.is_empty() => {
-                lookup_complete = false;
-                break;
+                if !is_nullable {
+                  lookup_complete = false;
+                  break;
+                }
+              }
+              _ => {
+                if entity_fields.contains_key(column) {
+                  has_provided_fields = true;
+                }
               }
-              _ => {}
             }
           }
-          if lookup_complete {
-            lookup_satisfied_keys.push(&parent_type.lookup_fields);
+          if lookup_complete && has_provided_fields {
+            lookup_satisfied_keys.push((&parent_type.lookup_fields, parent_type));
           }
         }
       }
@@ -823,14 +827,24 @@ impl Merger {
       where_parts.push(format!("t1.id = {}", Self::quote_literal(id)));
     }
 
-    for lookup_fields in lookup_satisfied_keys {
+    for (lookup_fields, parent_type) in lookup_satisfied_keys {
+      let t_alias = entity_type
+        .hierarchy
+        .iter()
+        .position(|name| name == &parent_type.name)
+        .map(|idx| format!("t{}", idx + 1))
+        .unwrap_or_else(|| "t1".to_string());
+
       let mut lookup_predicates = Vec::new();
       for column in lookup_fields {
-        let val = entity_fields.get(column).unwrap_or(&Value::Null);
-        if column == "type" {
-          lookup_predicates.push(format!("t1.\"{}\" = {}", column, Self::quote_literal(val)));
+        let val = entity_fields
+          .get(column)
+          .or_else(|| parent_type.field_defaults.get(column))
+          .unwrap_or(&Value::Null);
+        if val.is_null() || val.as_str() == Some("") {
+          lookup_predicates.push(format!("{}.\"{}\" IS NULL", t_alias, column));
         } else {
-          lookup_predicates.push(format!("\"{}\" = {}", column, Self::quote_literal(val)));
+          lookup_predicates.push(format!("{}.\"{}\" = {}", t_alias, column, Self::quote_literal(val)));
         }
       }
       where_parts.push(format!("({})", lookup_predicates.join(" AND ")));

src/validator/rules/object.rs

@@ -180,7 +180,7 @@ impl<'a> ValidationContext<'a> {
       }
 
       if !self.response {
-        let is_external = self.db.executor.punc_external().unwrap_or(false);
+        let is_external = self.db.cue_external().unwrap_or(false);
         if let Some(compiled_props) = self.schema.compiled_properties.get() {
           for (key, sub_schema) in compiled_props {
             if sub_schema.is_immutable(is_external) && obj.contains_key(key) {

version

@@ -1 +1 @@
-1.0.195
+1.0.199