version: 1.0.199

GEMINI.md

@@ -374,7 +374,7 @@ The Queryer transforms Postgres into a pre-compiled Semantic Query Engine, desig
     *   **Multi-Table Branching**: If the Physical Table is a parent to other tables (e.g. `organization` has variations `["organization", "bot", "person"]`), the compiler generates a dynamic `CASE WHEN type = '...' THEN ...` query, expanding into sub-queries for each variation. To ensure safe resolution, the compiler dynamically evaluates correlation boundaries: it attempts standard Relational Edge discovery first. If no explicit relational edge exists (indicating pure Table Inheritance rather than a standard foreign-key graph relationship), it safely invokes a **Table Parity Fallback**. This generates an explicit ID correlation constraint (`AND inner.id = outer.id`), perfectly binding the structural variations back to the parent row to eliminate Cartesian products.
     *   **Single-Table Bypass**: If the Physical Table is a leaf node with only one variation (e.g. `person` has variations `["person"]`), the compiler cleanly bypasses `CASE` generation and compiles a simple `SELECT` across the base table, as all schema extensions (e.g. `light.person`, `full.person`) are guaranteed to reside in the exact same physical row.
     *   **Polymorphic Relation Type Filtering**: When a relationship maps to a polymorphic target with variations, the Queryer compiles an `IN` clause containing all allowed table variations (e.g., `counterparty_type IN ('bot', 'organization', 'person')`) rather than matching the base type literal, ensuring all polymorphic types are loaded correctly.
-*   **Tenant Scoping & ReBAC Filtering**: When `jspg_query` compiles root-level or relationship-level entity queries, the generated SQL queries evaluate within the calling PostgreSQL transaction's session configuration (e.g. `auth.organization_ids`, `auth.roles`). The compiled queries seamlessly interact with PostgreSQL Row Level Security (RLS) policies on base tables (such as `agreego.entity`) and pre-materialized Zanzibar graph edges (`agreego.relationship`), ensuring multi-tenant isolation and $O(1)$ query evaluation without requiring manual WHERE scoping logic across every application punc.
+*   **Tenant Scoping & ReBAC Filtering**: When `jspg_query` compiles root-level or relationship-level entity queries, the generated SQL queries evaluate within the calling PostgreSQL transaction's session configuration (e.g. `punc.cue.organization_ids`, `punc.cue.roles`). The compiled queries seamlessly interact with PostgreSQL Row Level Security (RLS) policies on base tables (such as `agreego.entity`) and pre-materialized Zanzibar graph edges (`agreego.relationship`), ensuring multi-tenant isolation and $O(1)$ query evaluation without requiring manual WHERE scoping logic across every application punc.
 *   **Static Relation Constraints (Kind Constraints)**: When a relationship (such as a nested object or array) is defined with a schema that constrains a field value statically using a `const` or `enum` keyword (for example, `kind` constrained to `"cover"` in a `cover_attachment`), the Queryer automatically extracts these static assertions during AST compilation. It injects them directly as static filters into the SQL subquery's `WHERE` clause (e.g. `AND attachment.kind = 'cover'`), allowing developers to query pre-filtered subsets of related tables natively through the schema.
 *   **Proxy Schema Dereferencing / Resolution**: To support punc endpoints that return non-polymorphic table-backed shapes (using `type: "full.X"` proxy schemas at the root response level), the Queryer compiler automatically dereferences non-table schema pointers to their target schemas prior to checking the types. This allows the Queryer to correctly resolve the table relationship edges pre-compiled on the full schema, while avoiding polluting the database registry with relations on ad-hoc punc response schemas during setup.
 

fixtures/merger.json

@@ -1363,65 +1363,18 @@
               "  AND t4.\"pronouns\" = 'they/them'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
+              "UPDATE agreego.\"entity\" SET",
-              "  \"created_at\",",
+              "  modified_at = '{{timestamp}}',",
-              "  \"created_by\",",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
-              "  \"id\",",
+              "WHERE",
-              "  \"modified_at\",",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:generated_0}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
+              "UPDATE agreego.\"person\" SET",
-              "  \"id\",",
+              "  contact_id = 'abc-contact'",
-              "  \"type\"",
+              "WHERE",
-              ")",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "VALUES (",
-              "  '{{uuid:generated_0}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:generated_0}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:generated_0}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1435,45 +1388,40 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"first_name\": \"LookupFirst\",",
+              "      \"contact_id\": \"old-contact\"",
-              "      \"last_name\": \"LookupLast\",",
+              "  }',",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
+              "  '{",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  '{{uuid:generated_1}}',",
+              "  'update',",
-              "  'create',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:generated_0}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
               "    }",
               "}'))"
             ]
@@ -1527,65 +1475,18 @@
               "  AND t4.\"pronouns\" = 'they/them'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
+              "UPDATE agreego.\"entity\" SET",
-              "  \"created_at\",",
+              "  modified_at = '{{timestamp}}',",
-              "  \"created_by\",",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
-              "  \"id\",",
+              "WHERE",
-              "  \"modified_at\",",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
+              "UPDATE agreego.\"person\" SET",
-              "  \"id\",",
+              "  contact_id = 'abc-contact'",
-              "  \"type\"",
+              "WHERE",
-              ")",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1599,46 +1500,42 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"first_name\": \"LookupFirst\",",
+              "      \"contact_id\": \"old-contact\"",
-              "      \"last_name\": \"LookupLast\",",
+              "  }',",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
+              "  '{",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
-              "  '{{uuid:data.id}}',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -1700,67 +1597,18 @@
               "  (t3.\"name\" = 'LookupName'))"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
+              "UPDATE agreego.\"entity\" SET",
-              "  \"created_at\",",
+              "  modified_at = '{{timestamp}}',",
-              "  \"created_by\",",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
-              "  \"id\",",
+              "WHERE",
-              "  \"modified_at\",",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
+              "UPDATE agreego.\"person\" SET",
-              "  \"id\",",
+              "  contact_id = 'abc-contact'",
-              "  \"name\",",
+              "WHERE",
-              "  \"type\"",
+              "  id = '{{uuid:mocks.0.id}}'",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'LookupName',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"contact_id\",",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-contact',",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -1774,49 +1622,43 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
               "  '{",
-              "      \"name\": \"LookupName\",",
+              "      \"contact_id\": \"old-contact\"",
-              "      \"first_name\": \"LookupFirst\",",
+              "  }',",
-              "      \"last_name\": \"LookupLast\",",
+              "  '{",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
               "  }',",
-              "  '{{uuid:data.id}}',",
+              "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"name\": \"LookupName\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"name\": \"LookupName\",",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"contact_id\": \"abc-contact\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"old\": {",
+              "      \"contact_id\": \"old-contact\"",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -1867,114 +1709,24 @@
               "  AND t4.\"date_of_birth\" = '{{timestamp}}'",
               "  AND t4.\"pronouns\" = 'they/them'))"
             ],
-            [
-              "INSERT INTO agreego.\"entity\" (",
-              "  \"created_at\",",
-              "  \"created_by\",",
-              "  \"id\",",
-              "  \"modified_at\",",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:data.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"entity\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:data.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"date_of_birth\",",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"pronouns\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  'LookupFirst',",
-              "  '{{uuid:data.id}}',",
-              "  'LookupLast',",
-              "  'they/them',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"person\".*)"
-            ],
-            [
-              "INSERT INTO agreego.change (",
-              "  \"old\",",
-              "  \"new\",",
-              "  \"entity_id\",",
-              "  \"id\",",
-              "  \"kind\",",
-              "  \"modified_at\",",
-              "  \"modified_by\"",
-              ")",
-              "VALUES (",
-              "  NULL,",
-              "  '{",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
-              "      \"type\": \"person\"",
-              "  }',",
-              "  '{{uuid:data.id}}',",
-              "  '{{uuid:generated_0}}',",
-              "  'create',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000'",
-              ")"
-            ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"replace\",",
               "    \"complete\": {",
+              "      \"id\": \"{{uuid:mocks.0.id}}\",",
+              "      \"type\": \"person\",",
               "      \"first_name\": \"LookupFirst\",",
               "      \"last_name\": \"LookupLast\",",
               "      \"date_of_birth\": \"{{timestamp}}\",",
               "      \"pronouns\": \"they/them\",",
-              "      \"id\": \"{{uuid:data.id}}\",",
+              "      \"contact_id\": \"old-contact\",",
-              "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
-              "      \"created_at\": \"{{timestamp}}\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
-              "      \"first_name\": \"LookupFirst\",",
-              "      \"last_name\": \"LookupLast\",",
-              "      \"date_of_birth\": \"{{timestamp}}\",",
-              "      \"pronouns\": \"they/them\",",
               "      \"type\": \"person\"",
-              "    }",
+              "    },",
+              "    \"replaces\": \"{{uuid:data.id}}\"",
               "}'))"
             ]
           ]
@@ -2011,59 +1763,19 @@
               "  t1.id = '{{uuid:mocks.0.id}}')"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
+              "UPDATE agreego.\"entity\" SET",
-              "  \"created_at\",",
+              "  modified_at = '{{timestamp}}',",
-              "  \"created_by\",",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
-              "  \"id\",",
+              "WHERE",
-              "  \"modified_at\",",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  '{{uuid:mocks.0.id}}',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
             [
-              "INSERT INTO agreego.\"organization\" (",
+              "UPDATE agreego.\"person\" SET",
-              "  \"id\",",
+              "  first_name = 'NewFirst',",
-              "  \"type\"",
+              "  last_name = 'NewLast'",
-              ")",
+              "WHERE",
-              "VALUES (",
+              "  id = '{{uuid:mocks.0.id}}'",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"first_name\",",
-              "  \"id\",",
-              "  \"last_name\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'NewFirst',",
-              "  '{{uuid:mocks.0.id}}',",
-              "  'NewLast',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"person\".*)"
             ],
             [
@@ -2077,7 +1789,10 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
+              "  '{",
+              "      \"first_name\": \"OldFirst\",",
+              "      \"last_name\": \"OldLast\"",
+              "  }',",
               "  '{",
               "      \"first_name\": \"NewFirst\",",
               "      \"last_name\": \"NewLast\",",
@@ -2085,21 +1800,19 @@
               "  }',",
               "  '{{uuid:mocks.0.id}}',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'update',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"update\",",
               "    \"complete\": {",
-              "      \"first_name\": \"NewFirst\",",
-              "      \"last_name\": \"NewLast\",",
               "      \"id\": \"{{uuid:mocks.0.id}}\",",
               "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
+              "      \"first_name\": \"NewFirst\",",
-              "      \"created_at\": \"{{timestamp}}\",",
+              "      \"last_name\": \"NewLast\",",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
@@ -2107,6 +1820,10 @@
               "      \"first_name\": \"NewFirst\",",
               "      \"last_name\": \"NewLast\",",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"first_name\": \"OldFirst\",",
+              "      \"last_name\": \"OldLast\"",
               "    }",
               "}'))"
             ]
@@ -3345,59 +3062,14 @@
               "  t1.id = 'abc-archived')"
             ],
             [
-              "INSERT INTO agreego.\"entity\" (",
+              "UPDATE agreego.\"entity\" SET",
-              "  \"archived\",",
+              "  archived = true,",
-              "  \"created_at\",",
+              "  modified_at = '{{timestamp}}',",
-              "  \"created_by\",",
+              "  modified_by = '00000000-0000-0000-0000-000000000000'",
-              "  \"id\",",
+              "WHERE",
-              "  \"modified_at\",",
+              "  id = 'abc-archived'",
-              "  \"modified_by\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  true,",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'abc-archived',",
-              "  '{{timestamp}}',",
-              "  '00000000-0000-0000-0000-000000000000',",
-              "  'person'",
-              ")",
               "RETURNING to_jsonb(\"entity\".*)"
             ],
-            [
-              "INSERT INTO agreego.\"organization\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"organization\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"user\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"user\".*)"
-            ],
-            [
-              "INSERT INTO agreego.\"person\" (",
-              "  \"id\",",
-              "  \"type\"",
-              ")",
-              "VALUES (",
-              "  'abc-archived',",
-              "  'person'",
-              ")",
-              "RETURNING to_jsonb(\"person\".*)"
-            ],
             [
               "INSERT INTO agreego.change (",
               "  \"old\",",
@@ -3409,33 +3081,38 @@
               "  \"modified_by\"",
               ")",
               "VALUES (",
-              "  NULL,",
+              "  '{",
+              "      \"archived\": false",
+              "  }',",
               "  '{",
               "      \"archived\": true,",
               "      \"type\": \"person\"",
               "  }',",
               "  'abc-archived',",
               "  '{{uuid:generated_0}}',",
-              "  'create',",
+              "  'delete',",
               "  '{{timestamp}}',",
               "  '00000000-0000-0000-0000-000000000000'",
               ")"
             ],
             [
               "(SELECT pg_notify('entity', '{",
-              "    \"kind\": \"create\",",
+              "    \"kind\": \"delete\",",
               "    \"complete\": {",
-              "      \"archived\": true,",
               "      \"id\": \"abc-archived\",",
               "      \"type\": \"person\",",
-              "      \"created_by\": \"00000000-0000-0000-0000-000000000000\",",
+              "      \"first_name\": \"ArchivedFirst\",",
-              "      \"created_at\": \"{{timestamp}}\",",
+              "      \"last_name\": \"ArchivedLast\",",
+              "      \"archived\": true,",
               "      \"modified_by\": \"00000000-0000-0000-0000-000000000000\",",
               "      \"modified_at\": \"{{timestamp}}\"",
               "    },",
               "    \"new\": {",
               "      \"archived\": true,",
               "      \"type\": \"person\"",
+              "    },",
+              "    \"old\": {",
+              "      \"archived\": false",
               "    }",
               "}'))"
             ]

src/database/executors/mock.rs

@@ -13,7 +13,8 @@ pub struct MockState {
   pub query_responses: Vec<Result<Value, String>>,
   pub execute_responses: Vec<Result<(), String>>,
   pub mocks: Vec<Value>,
-  pub punc_external: bool,
+  pub cue_created_by: Option<String>,
+  pub cue_external: bool,
 }
 
 #[cfg(test)]
@@ -24,12 +25,12 @@ impl MockState {
       query_responses: Default::default(),
       execute_responses: Default::default(),
       mocks: Default::default(),
-      punc_external: false,
+      cue_created_by: Some("00000000-0000-0000-0000-000000000000".to_string()),
+      cue_external: false,
     }
   }
 }
 
-
 #[cfg(test)]
 thread_local! {
   pub static MOCK_STATE: RefCell<MockState> = RefCell::new(MockState::new());
@@ -80,16 +81,22 @@ impl DatabaseExecutor for MockExecutor {
     })
   }
 
-  fn auth_user_id(&self) -> Result<String, String> {
+  fn cue_created_by(&self) -> Result<String, String> {
-    Ok("00000000-0000-0000-0000-000000000000".to_string())
+    MOCK_STATE.with(|state| {
+      state
+        .borrow()
+        .cue_created_by
+        .clone()
+        .ok_or_else(|| "Missing cue.created_by in session context".to_string())
+    })
   }
 
   fn timestamp(&self) -> Result<String, String> {
     Ok("2026-03-10T00:00:00Z".to_string())
   }
 
-  fn punc_external(&self) -> Result<bool, String> {
+  fn cue_external(&self) -> Result<bool, String> {
-    Ok(MOCK_STATE.with(|state| state.borrow().punc_external))
+    Ok(MOCK_STATE.with(|state| state.borrow().cue_external))
   }
 
   #[cfg(test)]
@@ -112,74 +119,96 @@ impl DatabaseExecutor for MockExecutor {
       s.query_responses.clear();
       s.execute_responses.clear();
       s.mocks.clear();
-      s.punc_external = false;
+      s.cue_created_by = Some("00000000-0000-0000-0000-00000000000".to_string());
+      s.cue_external = false;
     });
   }
 }
 
 #[cfg(test)]
 impl MockExecutor {
-  pub fn set_punc_external(&self, external: bool) {
+  pub fn set_cue_external(&self, external: bool) {
     MOCK_STATE.with(|state| {
-      state.borrow_mut().punc_external = external;
+      state.borrow_mut().cue_external = external;
+    });
+  }
+
+  pub fn set_cue_created_by(&self, created_by: Option<String>) {
+    MOCK_STATE.with(|state| {
+      state.borrow_mut().cue_created_by = created_by;
     });
   }
 }
 
-
 #[cfg(test)]
 fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
   let sql_upper = sql.to_uppercase();
-  if !sql_upper.starts_with("SELECT") {
+  if !sql_upper.starts_with("SELECT") && !sql_upper.starts_with("(SELECT") {
     return None;
   }
 
-  // 1. Extract table name
+  let union_regex = Regex::new(r"(?i)\s+UNION\s+").ok()?;
-  let table_regex = Regex::new(r#"(?i)\s+FROM\s+(?:[a-zA-Z_]\w*\.)?"?([a-zA-Z_]\w*)"?"#).ok()?;
+  let queries: Vec<&str> = union_regex.split(sql).collect();
-  let table = if let Some(caps) = table_regex.captures(sql) {
-    caps.get(1)?.as_str()
-  } else {
-    return None;
-  };
 
-  // 2. Extract WHERE conditions string
-  let mut where_clause = String::new();
-  if let Some(where_idx) = sql_upper.find(" WHERE ") {
-    let mut where_end = sql_upper.find(" ORDER BY ").unwrap_or(sql_upper.len());
-    if let Some(limit_idx) = sql_upper.find(" LIMIT ") {
-      if limit_idx < where_end {
-        where_end = limit_idx;
-      }
-    }
-    where_clause = sql[where_idx + 7..where_end].to_string();
-  }
-
-  // 3. Find matching mocks
   let mut matches = Vec::new();
   let or_regex = Regex::new(r"(?i)\s+OR\s+").ok()?;
   let and_regex = Regex::new(r"(?i)\s+AND\s+").ok()?;
 
   for mock in mocks {
-    if let Some(mock_obj) = mock.as_object() {
+    let mock_obj = match mock.as_object() {
-      if let Some(t) = mock_obj.get("type") {
+      Some(obj) => obj,
-        if t.as_str() != Some(table) {
+      None => continue,
-          continue;
+    };
-        }
-      }
 
-      if where_clause.is_empty() {
+    let mock_type = mock_obj.get("type").and_then(|v| v.as_str()).unwrap_or("");
-        matches.push(mock.clone());
+
+    let mut mock_matched = false;
+
+    for query in &queries {
+      let q_upper = query.to_uppercase();
+
+      // Check if mock type matches the table or any joined tables in this query
+      let table_regex =
+        Regex::new(r#"(?i)\s+(?:FROM|JOIN)\s+(?:[a-zA-Z_]\w*\.)?"?([a-zA-Z_]\w*)"?"#).ok()?;
+      let tables: Vec<String> = table_regex
+        .captures_iter(query)
+        .filter_map(|c| c.get(1).map(|m| m.as_str().to_string()))
+        .collect();
+
+      if !mock_type.is_empty() && !tables.is_empty() && !tables.iter().any(|t| t == mock_type) {
         continue;
       }
 
-      let or_parts = or_regex.split(&where_clause);
+      // Extract WHERE clause
-      let mut any_branch_matched = false;
+      let mut where_clause = String::new();
+      if let Some(where_idx) = q_upper.find(" WHERE ") {
+        let mut where_end = q_upper.find(" ORDER BY ").unwrap_or(q_upper.len());
+        if let Some(limit_idx) = q_upper.find(" LIMIT ") {
+          if limit_idx < where_end {
+            where_end = limit_idx;
+          }
+        }
+        where_clause = query[where_idx + 7..where_end]
+          .trim_end_matches(')')
+          .to_string();
+      }
 
+      if where_clause.is_empty() {
+        mock_matched = true;
+        break;
+      }
+
+      let or_parts = or_regex.split(&where_clause);
       for or_part in or_parts {
         let branch_str = or_part.replace('(', "").replace(')', "");
         let mut branch_matches = true;
 
         for part in and_regex.split(&branch_str) {
+          let part = part.trim();
+          if part.is_empty() {
+            continue;
+          }
+
           if let Some(eq_idx) = part.find('=') {
             let left = part[..eq_idx]
               .trim()
@@ -193,7 +222,7 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
               Some(Value::String(s)) => s.clone(),
               Some(Value::Number(n)) => n.to_string(),
               Some(Value::Bool(b)) => b.to_string(),
-              Some(Value::Null) => "null".to_string(),
+              Some(Value::Null) | None => "null".to_string(),
               _ => "".to_string(),
             };
             if mock_val_str != right {
@@ -201,19 +230,21 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
               break;
             }
           } else if part.to_uppercase().contains(" IS NULL") {
-            let left = part[..part.to_uppercase().find(" IS NULL").unwrap()]
+            let is_null_idx = part.to_uppercase().find(" IS NULL").unwrap();
+            let left = part[..is_null_idx]
               .trim()
               .split('.')
               .last()
               .unwrap_or("")
               .trim_matches('"');
 
-            let mock_val_str = match mock_obj.get(left) {
+            let is_null_val = match mock_obj.get(left) {
-              Some(Value::Null) => "null".to_string(),
+              Some(Value::Null) | None => true,
-              _ => "".to_string(),
+              Some(Value::String(s)) if s.is_empty() => true,
+              _ => false,
             };
 
-            if mock_val_str != "null" {
+            if !is_null_val {
               branch_matches = false;
               break;
             }
@@ -221,15 +252,19 @@ fn parse_and_match_mocks(sql: &str, mocks: &[Value]) -> Option<Vec<Value>> {
         }
 
         if branch_matches {
-          any_branch_matched = true;
+          mock_matched = true;
           break;
         }
       }
 
-      if any_branch_matched {
+      if mock_matched {
-        matches.push(mock.clone());
+        break;
       }
     }
+
+    if mock_matched {
+      matches.push(mock.clone());
+    }
   }
 
   Some(matches)

src/database/executors/mod.rs

@@ -14,14 +14,14 @@ pub trait DatabaseExecutor: Send + Sync {
   /// Executes an operation (INSERT, UPDATE, DELETE, or pg_notify) that does not return rows.
   fn execute(&self, sql: &str, args: Option<Vec<Value>>) -> Result<(), String>;
 
-  /// Returns the current authenticated user's ID
+  /// Returns the current authenticated user's ID (from cue.created_by)
-  fn auth_user_id(&self) -> Result<String, String>;
+  fn cue_created_by(&self) -> Result<String, String>;
 
   /// Returns the current transaction timestamp
   fn timestamp(&self) -> Result<String, String>;
 
-  /// Returns true if the current execution context is marked as an external client API cue (punc.external = true)
+  /// Returns true if the current execution context is marked as an external client API cue (cue.external = true)
-  fn punc_external(&self) -> Result<bool, String>;
+  fn cue_external(&self) -> Result<bool, String>;
 
   #[cfg(test)]
   fn get_queries(&self) -> Vec<String>;

src/database/executors/pgrx.rs

@@ -113,12 +113,12 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 
-  fn auth_user_id(&self) -> Result<String, String> {
+  fn cue_created_by(&self) -> Result<String, String> {
     self.transact(|| {
       Spi::connect(|client| {
         let mut tup_table = client
           .select(
-            "SELECT COALESCE(current_setting('auth.user_id', true), 'ffffffff-ffff-ffff-ffff-ffffffffffff')",
+            "SELECT NULLIF(current_setting('punc.cue', true), '')::jsonb->>'created_by'",
             None,
             &[],
           )
@@ -126,10 +126,10 @@ impl DatabaseExecutor for SpiExecutor {
 
         let row = tup_table
           .next()
-          .ok_or("No user id setting returned from context".to_string())?;
+          .ok_or("No cue setting returned from context".to_string())?;
         let user_id: Option<String> = row.get(1).map_err(|e| e.to_string())?;
 
-        user_id.ok_or("Missing user_id".to_string())
+        user_id.ok_or("Missing cue.created_by in session context".to_string())
       })
     })
   }
@@ -151,12 +151,12 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 
-  fn punc_external(&self) -> Result<bool, String> {
+  fn cue_external(&self) -> Result<bool, String> {
     self.transact(|| {
       Spi::connect(|client| {
         let mut tup_table = client
           .select(
-            "SELECT COALESCE(current_setting('punc.external', true), 'false')::boolean",
+            "SELECT COALESCE((NULLIF(current_setting('punc.cue', true), '')::jsonb->>'external')::boolean, false)",
             None,
             &[],
           )
@@ -172,4 +172,3 @@ impl DatabaseExecutor for SpiExecutor {
     })
   }
 }
-

src/database/mod.rs

@@ -232,9 +232,9 @@ impl Database {
     self.executor.execute(sql, args)
   }
 
-  /// Returns the current authenticated user's ID
+  /// Returns the current authenticated user's ID (from cue.created_by)
-  pub fn auth_user_id(&self) -> Result<String, String> {
+  pub fn cue_created_by(&self) -> Result<String, String> {
-    self.executor.auth_user_id()
+    self.executor.cue_created_by()
   }
 
   /// Returns the current transaction timestamp
@@ -242,6 +242,11 @@ impl Database {
     self.executor.timestamp()
   }
 
+  /// Returns true if the current execution context is marked as an external client API cue (cue.external = true)
+  pub fn cue_external(&self) -> Result<bool, String> {
+    self.executor.cue_external()
+  }
+
   pub fn compile(&mut self, errors: &mut Vec<crate::drop::Error>) {
     // Phase 1: Registration
     self.collect_schemas(errors);

src/database/type.rs

@@ -5,6 +5,14 @@ use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use serde_json::Value;
 
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct Roles {
+  #[serde(default, skip_serializing_if = "Vec::is_empty")]
+  pub read: Vec<String>,
+  #[serde(default, skip_serializing_if = "Vec::is_empty")]
+  pub write: Vec<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 #[serde(default)]
 pub struct Type {
@@ -38,6 +46,8 @@ pub struct Type {
   #[serde(default)]
   pub field_defaults: IndexMap<String, Value>,
   pub field_types: Option<Value>,
+  #[serde(skip_serializing_if = "Option::is_none")]
+  pub roles: Option<Roles>,
   #[serde(default)]
   pub schemas: IndexMap<String, Arc<Schema>>,
 }

src/merger/mod.rs

@@ -351,8 +351,8 @@ impl Merger {
       current_org_id = parent_org_id.clone();
     }
 
-    let user_id = self.db.auth_user_id().map_err(|e| Error {
+    let user_id = self.db.cue_created_by().map_err(|e| Error {
-      code: "AUTH_USER_FAILED".to_string(),
+      code: "CUE_CREATED_BY_FAILED".to_string(),
       values: Some(IndexMap::from([("error".to_string(), e.clone())])),
       details: ErrorDetails {
         cause: Some(e),
@@ -762,23 +762,33 @@ impl Merger {
       if let Some(parent_type) = self.db.types.get(parent_type_name) {
         if !parent_type.lookup_fields.is_empty() {
           let mut lookup_complete = true;
+          let mut has_provided_fields = false;
           for column in &parent_type.lookup_fields {
+            let is_nullable = parent_type.null_fields.contains(column);
             let val = entity_fields.get(column).or_else(|| {
               parent_type.field_defaults.get(column)
             });
             match val {
               Some(Value::Null) | None => {
-                lookup_complete = false;
+                if !is_nullable {
-                break;
+                  lookup_complete = false;
+                  break;
+                }
               }
               Some(Value::String(s)) if s.is_empty() => {
-                lookup_complete = false;
+                if !is_nullable {
-                break;
+                  lookup_complete = false;
+                  break;
+                }
+              }
+              _ => {
+                if entity_fields.contains_key(column) {
+                  has_provided_fields = true;
+                }
               }
-              _ => {}
             }
           }
-          if lookup_complete {
+          if lookup_complete && has_provided_fields {
             lookup_satisfied_keys.push((&parent_type.lookup_fields, parent_type));
           }
         }
@@ -831,7 +841,11 @@ impl Merger {
           .get(column)
           .or_else(|| parent_type.field_defaults.get(column))
           .unwrap_or(&Value::Null);
-        lookup_predicates.push(format!("{}.\"{}\" = {}", t_alias, column, Self::quote_literal(val)));
+        if val.is_null() || val.as_str() == Some("") {
+          lookup_predicates.push(format!("{}.\"{}\" IS NULL", t_alias, column));
+        } else {
+          lookup_predicates.push(format!("{}.\"{}\" = {}", t_alias, column, Self::quote_literal(val)));
+        }
       }
       where_parts.push(format!("({})", lookup_predicates.join(" AND ")));
     }

src/validator/rules/object.rs

@@ -180,7 +180,7 @@ impl<'a> ValidationContext<'a> {
       }
 
       if !self.response {
-        let is_external = self.db.executor.punc_external().unwrap_or(false);
+        let is_external = self.db.cue_external().unwrap_or(false);
         if let Some(compiled_props) = self.schema.compiled_properties.get() {
           for (key, sub_schema) in compiled_props {
             if sub_schema.is_immutable(is_external) && obj.contains_key(key) {

version

@@ -1 +1 @@
-1.0.197
+1.0.199