dzql 0.6.37 → 0.8.0

package/README.md

@@ -12,6 +12,22 @@ bun run db:rebuild
 bun run dev
 ```
 
+## delta's Postgres step
+
+dzql is becoming the Postgres step for apps built on [@blueshed/delta](https://github.com/blueshed/delta):
+a delta app grows from a JSON file to SQLite to Postgres, and on Postgres its documents are kept by
+dzql. Since 0.8.0 dzql carries delta's Postgres backend, with the same names, so moving is an
+import change:
+
+```ts
+import { applyFramework, applySql, createDocListener, docTypeFromDef, generateSql } from "dzql/postgres";
+import { openPglite } from "dzql/pglite";   // Postgres in this process
+import { jwtAuth } from "dzql/auth-jwt";
+```
+
+Its tests run delta's own cases (`@blueshed/delta/testing`) against it. Compiled SQL replaces the
+framework SQL in later releases; the plan is in Workshop's `docs/postgres-split-plan.md`.
+
 ## Documentation
 
 See the [full documentation](./docs/README.md) for:

package/docs/README.md

@@ -37,7 +37,7 @@ export const entities = {
       author_id: 'int REFERENCES users(id)'
     },
     permissions: {
-      view: [],                // Anyone can view
+      view: ['TRUE'],          // Anyone can view ([] would deny everyone)
       update: ['@author_id']   // Only author can edit
     }
   }

package/docs/for_ai.md

@@ -44,12 +44,19 @@ temporal: {
 
 PERMISSION DSL
 ==============
-[]                                    = Deny all
+[] or omitted                         = Deny all (nobody, signed in or not)
 ['TRUE']                              = Public access
+['AUTHENTICATED']                     = Any signed-in user
 ['@author_id']                        = @user_id == @author_id
 ['@author_id == @user_id']            = Explicit equality
 ['@org_id->acts_for[org_id=$].user_id']        = Single-hop traversal
 ['@org_id->acts_for[org_id=$]{active}.user_id'] = With condition filter
+['@org_id->user_orgs[org_id=$,role=owner].user_id'] = Several filters (AND)
+['rule A', 'rule B']                  = Either rule grants access (OR); every rule is enforced
+
+A path that can't be compiled (bad syntax, unknown table or column, a start
+field that isn't an integer key) is a build error. It never compiles to "deny"
+or to "any signed-in user".
 
 CONDITION FILTERS
 =================
@@ -65,6 +72,11 @@ Single:  @org_id->acts_for[org_id=$]{active}.user_id
 3-hop:   @site_id->sites.venue_id->venues.org_id->acts_for[org_id=$]{active}.user_id
 N-hop:   @pkg_id->packages.occasion_id->occasions.venue_id->venues.org_id->user_orgs[org_id=$].user_id
 
+A hop written table.field joins on table.id. A hop written table[field=$].out
+joins on that field instead, and may match many rows (each is followed):
+Filtered: @occasion_id->occasion_promoters[occasion_id=$].promoter_id->user_orgs[org_id=$].user_id
+          "a member of any org promoting this occasion"
+
 TABLE-FIRST PATTERN
 ===================
 rights[package_id=@package_id]{active}.org_id->user_orgs[org_id=$].user_id
@@ -87,7 +99,8 @@ ROOT KEY RULES:
 
 SUBSCRIBABLE TYPES:
 1. Single Entity: has root.key, returns one document with includes
-2. List Subscribable: no root.key, returns array of documents
+2. List Subscribable: no root.key, returns array of documents, only the
+   root rows the subscriber may view (the root entity's view rules apply)
 ```
 
 ## Entity Definition
@@ -155,6 +168,9 @@ Permissions compile to SQL `EXISTS` clauses. Rules are OR'd together.
 ```typescript
 // Owner only
 update: ['@author_id']  // Shorthand for @author_id == @user_id
+// An update must pass the rule on the stored row AND on the row after the
+// change, so an owner can't hand the row to someone else through save, and an
+// org member can't move a row into an org they don't belong to.
 
 // Organization member via junction table
 view: ['@org_id->acts_for[org_id=$]{active}.user_id']
@@ -165,7 +181,7 @@ view: ['@id']  // For users table: @id == @user_id
 
 // Public read, authenticated write
 view: ['TRUE'],
-create: []  // Empty = logged-in users only
+create: ['AUTHENTICATED']  // Any signed-in user. [] would deny everyone
 
 // Multiple paths (OR'd)
 view: ['@author_id', '@org_id->acts_for[org_id=$].user_id']
@@ -294,7 +310,12 @@ export const subscribables = {
     // ALL tables that can trigger updates
     scopeTables: ['venues', 'organisations', 'sites', 'allocations'],
 
-    // Who can subscribe
+    // Who can subscribe: rules are checked against the root row, and a
+    // reference to the key param (venue_id) means the root's id.
+    // [] denies everyone; use ['TRUE'] or ['AUTHENTICATED'] to open it.
+    // canSubscribe is the whole gate: the root's view rules are NOT also
+    // applied. To give the document the same audience as get_venues, copy
+    // venues.permissions.view in here.
     canSubscribe: ['@venue_id->venues.org_id->acts_for[org_id=$]{active}.user_id']
   }
 };
@@ -306,7 +327,7 @@ Returns an array of entities. Omit `root.key` to create a list:
 
 ```typescript
 export const subscribables = {
-  // Returns all venues the user can access
+  // Returns the venues the subscriber may view, to any signed-in user
   my_venues: {
     params: {},  // No params needed
 
@@ -321,9 +342,16 @@ export const subscribables = {
 
     scopeTables: ['venues', 'organisations'],
 
-    // Empty = authenticated users only
-    // Row-level filtering happens in the query based on user context
-    canSubscribe: []
+    // A list has no root row for a path to start from, so only TRUE, FALSE
+    // or AUTHENTICATED are allowed here; [] denies everyone.
+    // Each subscriber gets only the root rows that match root.filter AND
+    // that venues.permissions.view lets them see (view: [] shows no rows).
+    // Includes are not filtered by their own entities' view rules.
+    // Realtime pushes follow the same rule: a change to a root row is pushed
+    // only to subscribers whose view rules allow it, and a change to an
+    // included row only to subscribers whose documents show it. A deleted
+    // included row is pushed as its key alone.
+    canSubscribe: ['AUTHENTICATED']
   }
 };
 ```
@@ -653,7 +681,9 @@ bunx dzql compile domain.ts            # Explicit compile command
 
 ### Validate Paths
 
-Validate all permission and notification paths without running the full compiler:
+Validate all permission, notification and canSubscribe paths against the domain
+(syntax, tables, columns) without running the full compiler. The compiler runs
+the same checks and refuses to build if any fail:
 
 ```bash
 bunx dzql validate-paths domain.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dzql",
-  "version": "0.6.37",
+  "version": "0.8.0",
   "description": "Database-first real-time framework with TypeScript support",
   "repository": {
     "type": "git",
@@ -14,7 +14,10 @@
     ".": "./src/runtime/index.ts",
     "./client": "./src/client/index.ts",
     "./compiler": "./src/cli/index.ts",
-    "./namespace": "./src/runtime/namespace.ts"
+    "./namespace": "./src/runtime/namespace.ts",
+    "./postgres": "./src/postgres/index.ts",
+    "./pglite": "./src/postgres/pglite.ts",
+    "./auth-jwt": "./src/postgres/auth-jwt.ts"
   },
   "files": [
     "src",
@@ -24,7 +27,7 @@
     "README.md"
   ],
   "scripts": {
-    "test": "bun run test:setup && bun test; bun run test:teardown",
+    "test": "bun run test:setup && bun test; status=$?; bun run test:teardown; exit $status",
     "test:setup": "docker compose down -v && docker compose up -d --wait",
     "test:teardown": "docker compose down -v"
   },
@@ -45,12 +48,16 @@
   "author": "Peter Bunyan",
   "license": "MIT",
   "dependencies": {
-    "postgres": "^3.4.3",
+    "@blueshed/delta": "^0.16.0",
+    "@electric-sql/pglite": "^0.5.4",
     "dotenv": "^16.4.5",
-    "jose": "^5.2.3"
+    "jose": "^6.2.4",
+    "pg": "^8.22.0",
+    "postgres": "^3.4.3"
   },
   "devDependencies": {
     "@types/bun": "latest",
+    "@types/pg": "^8.20.0",
     "pinia": "^3.0.4",
     "typescript": "^5.0.0",
     "vue": "^3.5.26"

package/src/cli/codegen/notification.ts

@@ -6,7 +6,7 @@
  */
 
 import type { EntityIR } from "../../shared/ir.js";
-import { parsePath, compilePathToSelect } from "../compiler/paths.js";
+import { parsePath, compilePathToSelect, PathCompileError } from "../compiler/paths.js";
 
 /**
  * Generate notification resolution function for an entity
@@ -44,9 +44,9 @@ $$;`;
     for (const path of paths) {
       const parsed = parsePath(path);
 
+      // A path that can't be compiled is a build error, never silently skipped.
       if (!parsed.isValid) {
-        console.warn(`[Notification] Invalid path in ${name}.${pathName}: ${parsed.error}`);
-        continue;
+        throw new PathCompileError(`${name}.notifications.${pathName}: ${parsed.error}`, path);
       }
 
       const userQuery = compilePathToSelect(parsed, 'p_data');

package/src/cli/codegen/sql/core.ts

@@ -56,7 +56,25 @@ $$;
  * Generate auth SQL functions.
  * These depend on the 'users' table existing, so must be applied after schema.
  */
-export function generateAuthSQL() {
+export function generateAuthSQL(registerableColumns: string[] = []) {
+  // Build a fail-closed guard for register_user's p_options. Only columns the
+  // domain explicitly marks registerable may be set at sign-up; otherwise a
+  // client could self-provision privileged columns (role, is_admin, org_id, ...)
+  // that happen to exist on the users table. Core fields are always rejected.
+  const optionsGuard = registerableColumns.length > 0
+    ? `  IF p_options IS NOT NULL AND p_options <> '{}'::jsonb THEN
+    IF EXISTS (
+      SELECT 1 FROM jsonb_object_keys(p_options) AS k
+      WHERE k NOT IN (${registerableColumns.map(c => `'${c}'`).join(', ')})
+    ) THEN
+      RAISE EXCEPTION 'validation_error: field not allowed at registration' USING ERRCODE = '22023';
+    END IF;
+    v_insert_data := (p_options - 'id' - 'email' - 'password_hash' - 'password') || v_insert_data;
+  END IF;`
+    : `  IF p_options IS NOT NULL AND p_options <> '{}'::jsonb THEN
+    RAISE EXCEPTION 'validation_error: registration does not accept additional fields' USING ERRCODE = '22023';
+  END IF;`;
+
   return `
 -- === AUTH SYSTEM ===
 -- These functions depend on a 'users' table being created by the domain schema.
@@ -102,11 +120,9 @@ BEGIN
   v_salt := gen_salt('bf', 10);
   v_hash := crypt(p_password, v_salt);
 
-  -- Build insert data: options fields + email + password_hash (options cannot override core fields)
+  -- Build insert data: email + password_hash, plus any allow-listed option fields.
   v_insert_data := jsonb_build_object('email', p_email, 'password_hash', v_hash);
-  IF p_options IS NOT NULL THEN
-    v_insert_data := (p_options - 'id' - 'email' - 'password_hash' - 'password') || v_insert_data;
-  END IF;
+${optionsGuard}
 
   -- Dynamic INSERT from JSONB (same pattern as compiled save functions)
   EXECUTE (

package/src/cli/codegen/sql/delete.ts

@@ -1,4 +1,4 @@
-import { compilePermission } from "../../compiler/permissions.js";
+import { compileRuleList } from "../../compiler/permissions.js";
 import { compileGraphRules } from "../../compiler/graph_rules.js";
 import type { EntityIR, ColumnInfo } from "./types.js";
 
@@ -33,9 +33,8 @@ export function generateDeleteFunction(name: string, entityIR: EntityIR): string
     : `jsonb_build_object(${pkFields.map(f => `'${f}', v_old_data->'${f}'`).join(', ')})`;
 
   // Permissions
-  const deletePerm = entityIR.permissions?.delete?.[0]
-    ? compilePermission(name, entityIR.permissions.delete[0], null, 'v_old_data')
-    : 'TRUE';
+  // Every rule in a list grants access (OR); an empty list denies everyone.
+  const deletePerm = compileRuleList(name, entityIR.permissions?.delete, 'v_old_data');
 
   const onDeleteRules = entityIR.graphRules?.onDelete
     ? compileGraphRules(name, 'delete', entityIR.graphRules.onDelete)
@@ -117,9 +116,8 @@ function generateTemporalDeleteFunction(name: string, entityIR: EntityIR): strin
 
   const pkJsonbExpr = `jsonb_build_object('${pk}', v_old_data->'${pk}')`;
 
-  const deletePerm = entityIR.permissions?.delete?.[0]
-    ? compilePermission(name, entityIR.permissions.delete[0], null, 'v_old_data')
-    : 'TRUE';
+  // Every rule in a list grants access (OR); an empty list denies everyone.
+  const deletePerm = compileRuleList(name, entityIR.permissions?.delete, 'v_old_data');
 
   const onDeleteRules = entityIR.graphRules?.onDelete
     ? compileGraphRules(name, 'delete', entityIR.graphRules.onDelete)

package/src/cli/codegen/sql/get.ts

@@ -1,9 +1,9 @@
-import { compilePermission } from "../../compiler/permissions.js";
+import { compileRuleList } from "../../compiler/permissions.js";
 import type { EntityIR, ManyToManyIR, IncludeIR, ColumnInfo } from "./types.js";
-import { buildVisibleJsonb } from "./utils.js";
+import { buildVisibleJsonb, buildVisibleJsonbForEntity } from "./utils.js";
 
 // === GET FUNCTION ===
-export function generateGetFunction(name: string, entityIR: EntityIR): string {
+export function generateGetFunction(name: string, entityIR: EntityIR, entities: Record<string, EntityIR> = {}): string {
   const pkFields = entityIR.primaryKey.length > 0 ? entityIR.primaryKey : ['id'];
   const pk = pkFields[0];
   const hidden = entityIR.hidden || [];
@@ -65,9 +65,8 @@ export function generateGetFunction(name: string, entityIR: EntityIR): string {
     }).join(' AND ');
   }
 
-  const viewPerm = entityIR.permissions?.view?.length > 0
-    ? entityIR.permissions.view.map((rule: string) => compilePermission(name, rule, null, name)).join(' OR ')
-    : 'TRUE';
+  // An empty view list denies everyone.
+  const viewPerm = compileRuleList(name, entityIR.permissions?.view, name);
 
   const selectExpr = buildVisibleJsonb(name, entityIR.columns, hidden);
 
@@ -83,7 +82,7 @@ export function generateGetFunction(name: string, entityIR: EntityIR): string {
   -- FK: Add ${key} to result (from ${fkField})
   IF (v_result->>'${fkField}') IS NOT NULL THEN
     v_result := v_result || jsonb_build_object('${key}',
-      (SELECT to_jsonb(t.*) FROM ${targetEntity} t WHERE t.id = (v_result->>'${fkField}')::int));
+      (SELECT ${buildVisibleJsonbForEntity('t', entities[targetEntity])} FROM ${targetEntity} t WHERE t.id = (v_result->>'${fkField}')::int));
   END IF;`;
     }
     return '';
@@ -102,7 +101,7 @@ export function generateGetFunction(name: string, entityIR: EntityIR): string {
       sql += `
   -- M2M: Add expanded ${key} to result
   v_result := v_result || jsonb_build_object('${key}',
-    (SELECT COALESCE(jsonb_agg(to_jsonb(t.*) ORDER BY t.id), '[]'::jsonb)
+    (SELECT COALESCE(jsonb_agg(${buildVisibleJsonbForEntity('t', entities[config.targetEntity])} ORDER BY t.id), '[]'::jsonb)
      FROM ${config.junctionTable} jt
      JOIN ${config.targetEntity} t ON t.id = jt.${config.foreignKey}
      WHERE jt.${config.localKey} = (v_result->>'${pk}')::int));`;
@@ -145,9 +144,8 @@ export function generateHistoryFunction(name: string, entityIR: EntityIR): strin
   const refField = temporal.refField;
   const validFrom = temporal.validFrom;
 
-  const viewPerm = entityIR.permissions?.view?.length > 0
-    ? entityIR.permissions.view.map((rule: string) => compilePermission(name, rule, null, name)).join(' OR ')
-    : 'TRUE';
+  // An empty view list denies everyone.
+  const viewPerm = compileRuleList(name, entityIR.permissions?.view, name);
 
   const selectExpr = buildVisibleJsonb(name, entityIR.columns, hidden);
 

package/src/cli/codegen/sql/index.ts

@@ -30,16 +30,19 @@ import { generateSearchFunction } from "./search.js";
 import { generateLookupFunction } from "./lookup.js";
 
 // === AGGREGATE GENERATOR ===
-export function generateEntitySQL(name: string, entityIR: EntityIR): string {
+export function generateEntitySQL(name: string, entityIR: EntityIR, entities: Record<string, EntityIR> = {}): string {
   // Import here to avoid circular dependency
   const { generateNotificationFunction } = require('../notification.js');
 
+  // entities lets FK/M2M expansion project related rows through the TARGET
+  // entity's visible columns instead of to_jsonb(t.*), so a related object
+  // never leaks the target's hidden fields (e.g. author.password_hash).
   const functions = [
     generateNotificationFunction(name, entityIR),
-    generateSaveFunction(name, entityIR),
+    generateSaveFunction(name, entityIR, entities),
     generateDeleteFunction(name, entityIR),
-    generateGetFunction(name, entityIR),
-    generateSearchFunction(name, entityIR),
+    generateGetFunction(name, entityIR, entities),
+    generateSearchFunction(name, entityIR, entities),
     generateLookupFunction(name, entityIR)
   ];
 

package/src/cli/codegen/sql/lookup.ts

@@ -1,4 +1,4 @@
-import { compilePermission } from "../../compiler/permissions.js";
+import { compileRuleList } from "../../compiler/permissions.js";
 import type { EntityIR } from "./types.js";
 
 /**
@@ -13,10 +13,9 @@ export function generateLookupFunction(name: string, entityIR: EntityIR): string
   const softDelete = entityIR.softDelete || false;
   const temporal = entityIR.temporal;
 
-  const viewPermRaw = entityIR.permissions?.view?.length > 0
-    ? entityIR.permissions.view.map((rule: string) => compilePermission(name, rule, null, name)).join(' OR ')
-    : 'TRUE';
-  const viewPerm = viewPermRaw.replace(/p_user_id/g, '$1');
+  // The query reads FROM ${name} t, so the rule is compiled against alias t.
+  // An empty view list denies everyone.
+  const viewPerm = compileRuleList(name, entityIR.permissions?.view, { kind: 'row', name: 't' });
 
   const softDeleteFilter = softDelete ? ' AND deleted_at IS NULL' : '';
   const temporalFilter = temporal ? ` AND ${temporal.validTo} IS NULL` : '';

package/src/cli/codegen/sql/save.ts

@@ -1,7 +1,7 @@
-import { compilePermission } from "../../compiler/permissions.js";
+import { compileRuleList } from "../../compiler/permissions.js";
 import { compileGraphRules } from "../../compiler/graph_rules.js";
 import type { EntityIR, ManyToManyIR, IncludeIR, ColumnInfo } from "./types.js";
-import { getCastForType } from "./utils.js";
+import { getCastForType, buildVisibleJsonbForEntity } from "./utils.js";
 
 /**
  * Generate M2M variable declarations
@@ -52,7 +52,7 @@ function generateM2MSync(m2m: Record<string, ManyToManyIR>, pk: string): string
 /**
  * Generate M2M expansion code (add to output)
  */
-function generateM2MExpansion(m2m: Record<string, ManyToManyIR>, pk: string): string {
+function generateM2MExpansion(m2m: Record<string, ManyToManyIR>, pk: string, entities: Record<string, EntityIR> = {}): string {
   return Object.entries(m2m).map(([key, config]) => {
     let sql = `
   -- M2M: Add ${config.idField} to output
@@ -62,9 +62,9 @@ function generateM2MExpansion(m2m: Record<string, ManyToManyIR>, pk: string): st
 
     if (config.expand) {
       sql += `
-  -- M2M: Add expanded ${key} to output
+  -- M2M: Add expanded ${key} to output (projected to the target's visible columns)
   v_result := v_result || jsonb_build_object('${key}',
-    (SELECT COALESCE(jsonb_agg(to_jsonb(t.*) ORDER BY t.id), '[]'::jsonb)
+    (SELECT COALESCE(jsonb_agg(${buildVisibleJsonbForEntity('t', entities[config.targetEntity])} ORDER BY t.id), '[]'::jsonb)
      FROM ${config.junctionTable} jt
      JOIN ${config.targetEntity} t ON t.id = jt.${config.foreignKey}
      WHERE jt.${config.localKey} = (v_result->>'${pk}')::int));`;
@@ -76,7 +76,7 @@ function generateM2MExpansion(m2m: Record<string, ManyToManyIR>, pk: string): st
 /**
  * Generate FK expansion code (add related objects to output)
  */
-function generateFKExpansion(includes: Record<string, IncludeIR>, columns: ColumnInfo[]): string {
+function generateFKExpansion(includes: Record<string, IncludeIR>, columns: ColumnInfo[], entities: Record<string, EntityIR> = {}): string {
   return Object.entries(includes).map(([key, config]) => {
     const targetEntity = config.entity;
     const fkField = `${key}_id`;
@@ -84,10 +84,10 @@ function generateFKExpansion(includes: Record<string, IncludeIR>, columns: Colum
 
     if (hasFkColumn) {
       return `
-  -- FK: Add ${key} to output (from ${fkField})
+  -- FK: Add ${key} to output (from ${fkField}, projected to the target's visible columns)
   IF (v_result->>'${fkField}') IS NOT NULL THEN
     v_result := v_result || jsonb_build_object('${key}',
-      (SELECT to_jsonb(t.*) FROM ${targetEntity} t WHERE t.id = (v_result->>'${fkField}')::int));
+      (SELECT ${buildVisibleJsonbForEntity('t', entities[targetEntity])} FROM ${targetEntity} t WHERE t.id = (v_result->>'${fkField}')::int));
   END IF;`;
     }
     return '';
@@ -95,7 +95,7 @@ function generateFKExpansion(includes: Record<string, IncludeIR>, columns: Colum
 }
 
 // === SAVE FUNCTION (Upsert) ===
-export function generateSaveFunction(name: string, entityIR: EntityIR): string {
+export function generateSaveFunction(name: string, entityIR: EntityIR, entities: Record<string, EntityIR> = {}): string {
   const pkFields = entityIR.primaryKey.length > 0 ? entityIR.primaryKey : ['id'];
   const pk = pkFields[0];
   const fieldDefaults = entityIR.fieldDefaults || {};
@@ -105,7 +105,7 @@ export function generateSaveFunction(name: string, entityIR: EntityIR): string {
   // For temporal entities WITH refField, generate versioned save function
   // Temporal entities without refField just use standard save with validity filtering
   if (temporal?.refField) {
-    return generateTemporalSaveFunction(name, entityIR);
+    return generateTemporalSaveFunction(name, entityIR, entities);
   }
 
   // Build INSERT columns/values - exclude serial columns
@@ -169,13 +169,24 @@ export function generateSaveFunction(name: string, entityIR: EntityIR): string {
   const pkNullCheck = pkFields.map(f => `(p_data->>'${f}') IS NOT NULL`).join(' AND ');
 
   // Permissions & Graph Rules
-  const createPerm = entityIR.permissions?.create?.[0]
-    ? compilePermission(name, entityIR.permissions.create[0], null, 'p_data')
-    : 'TRUE';
-
-  const updatePerm = entityIR.permissions?.update?.[0]
-    ? compilePermission(name, entityIR.permissions.update[0], null, 'p_data')
-    : 'TRUE';
+  // Every rule in a list grants access (OR); an empty list denies everyone.
+  const createPerm = compileRuleList(name, entityIR.permissions?.create, 'p_data');
+
+  // Compile the update predicate against the STORED row (v_old_data), not the
+  // request body. Evaluating it against p_data lets a caller pass their own
+  // owner/tenant id in the body to satisfy an ownership rule and then overwrite
+  // someone else's row. delete.ts and the temporal save path already do this.
+  const updatePerm = compileRuleList(name, entityIR.permissions?.update, 'v_old_data');
+
+  // ...and again against the row as it is after the update (v_result), so an
+  // editor can't move a row to a parent they don't control (e.g. change its
+  // occasion_id to an occasion they don't promote). The update rule, not the
+  // create rule, guards the new state: create rules are often broader
+  // (AUTHENTICATED) or empty (an entity only seeded, never created by users),
+  // and either would make the check wrong for an update. Checking after the
+  // UPDATE sees the real stored row (casts, defaults, triggers, and the table
+  // itself for rules that read it); the RAISE rolls the UPDATE back.
+  const updatePermNew = compileRuleList(name, entityIR.permissions?.update, 'v_result');
 
   const onCreateRules = entityIR.graphRules?.onCreate
     ? compileGraphRules(name, 'create', entityIR.graphRules.onCreate)
@@ -190,11 +201,11 @@ export function generateSaveFunction(name: string, entityIR: EntityIR): string {
   const m2mVarDeclarations = generateM2MDeclarations(m2m);
   const m2mExtraction = generateM2MExtraction(m2m);
   const m2mSync = generateM2MSync(m2m, pk);
-  const m2mExpansion = generateM2MExpansion(m2m, pk);
+  const m2mExpansion = generateM2MExpansion(m2m, pk, entities);
 
   // FK expansion
   const includes: Record<string, IncludeIR> = entityIR.includes || {};
-  const fkExpansion = generateFKExpansion(includes, entityIR.columns);
+  const fkExpansion = generateFKExpansion(includes, entityIR.columns, entities);
 
   return `
 CREATE OR REPLACE FUNCTION dzql_v2.save_${name}(p_user_id int, p_data jsonb)
@@ -225,11 +236,16 @@ ${m2mExtraction}
       RAISE EXCEPTION 'permission_denied';
     END IF;
 
-    -- Perform Partial Update
+    ${updateSetClause ? `-- Perform Partial Update
     UPDATE ${name} SET
     ${updateSetClause}
     WHERE ${pkWhereClause}
-    RETURNING to_jsonb(${name}.*) INTO v_result;
+    RETURNING to_jsonb(${name}.*) INTO v_result;` : `-- No non-key columns: nothing to update
+    v_result := v_old_data;`}
+
+    IF NOT (${updatePermNew}) THEN
+      RAISE EXCEPTION 'permission_denied';
+    END IF;
 
     ${onUpdateRules}
 
@@ -240,8 +256,8 @@ ${m2mExtraction}
     END IF;
 
     -- Perform Insert
-    INSERT INTO ${name} (${colList})
-    VALUES (${valList})
+    INSERT INTO ${name} ${colList ? `(${colList})
+    VALUES (${valList})` : 'DEFAULT VALUES'}
     RETURNING to_jsonb(${name}.*) INTO v_result;
 
     ${onCreateRules}
@@ -278,7 +294,7 @@ $$;
 }
 
 // === TEMPORAL SAVE FUNCTION (Versioned Insert) ===
-function generateTemporalSaveFunction(name: string, entityIR: EntityIR): string {
+function generateTemporalSaveFunction(name: string, entityIR: EntityIR, entities: Record<string, EntityIR> = {}): string {
   const pkFields = entityIR.primaryKey.length > 0 ? entityIR.primaryKey : ['id'];
   const pk = pkFields[0];
   const fieldDefaults = entityIR.fieldDefaults || {};
@@ -344,13 +360,12 @@ function generateTemporalSaveFunction(name: string, entityIR: EntityIR): string
   const pkJsonbExpr = `jsonb_build_object('${pk}', v_result->'${pk}')`;
 
   // Permissions
-  const createPerm = entityIR.permissions?.create?.[0]
-    ? compilePermission(name, entityIR.permissions.create[0], null, 'p_data')
-    : 'TRUE';
+  // Every rule in a list grants access (OR); an empty list denies everyone.
+  const createPerm = compileRuleList(name, entityIR.permissions?.create, 'p_data');
 
-  const updatePerm = entityIR.permissions?.update?.[0]
-    ? compilePermission(name, entityIR.permissions.update[0], null, 'v_current')
-    : 'TRUE';
+  const updatePerm = compileRuleList(name, entityIR.permissions?.update, 'v_current');
+  // The new version must pass the update rule too (see generateSaveFunction).
+  const updatePermNew = compileRuleList(name, entityIR.permissions?.update, 'v_result');
 
   const onCreateRules = entityIR.graphRules?.onCreate
     ? compileGraphRules(name, 'create', entityIR.graphRules.onCreate)
@@ -365,20 +380,22 @@ function generateTemporalSaveFunction(name: string, entityIR: EntityIR): string
   const m2mVarDeclarations = generateM2MDeclarations(m2m);
   const m2mExtraction = generateM2MExtraction(m2m);
   const m2mSync = generateM2MSync(m2m, pk);
-  const m2mExpansion = generateM2MExpansion(m2m, pk);
+  const m2mExpansion = generateM2MExpansion(m2m, pk, entities);
 
   // FK expansion
   const includes: Record<string, IncludeIR> = entityIR.includes || {};
-  const fkExpansion = generateFKExpansion(includes, entityIR.columns);
+  const fkExpansion = generateFKExpansion(includes, entityIR.columns, entities);
 
-  // Non-temporal columns for INSERT
-  const nonTemporalCols = entityIR.columns
+  // Columns and values for the new version's INSERT (copyForwardFields may be
+  // empty when the entity has no columns beyond its key and temporal fields)
+  const versionCols = [refField, validFrom, ...entityIR.columns
     .filter((c: ColumnInfo) => {
       const isSerial = c.type.toLowerCase().includes('serial');
       const isTemporal = c.name === validFrom || c.name === validTo;
       return !isSerial && !isTemporal && c.name !== refField;
     })
-    .map(c => c.name).join(', ');
+    .map(c => c.name)].join(', ');
+  const versionValues = ['v_ref', 'now()', ...(copyForwardFields ? [copyForwardFields] : [])].join(',\n      ');
 
   return `
 CREATE OR REPLACE FUNCTION dzql_v2.save_${name}(p_user_id int, p_data jsonb)
@@ -424,13 +441,15 @@ ${m2mExtraction}
     WHERE ${refField} = v_ref AND ${validTo} IS NULL;
 
     -- Insert new version with copy-forward of unchanged fields
-    INSERT INTO ${name} (${refField}, ${validFrom}, ${nonTemporalCols})
+    INSERT INTO ${name} (${versionCols})
     SELECT
-      v_ref,
-      now(),
-      ${copyForwardFields}
+      ${versionValues}
     RETURNING to_jsonb(${name}.*) INTO v_result;
 
+    IF NOT (${updatePermNew}) THEN
+      RAISE EXCEPTION 'permission_denied';
+    END IF;
+
     ${onUpdateRules}
 
   ELSE