work

type ActivityJournal ¶

type ActivityJournal struct {
	Entries activityrepo.Journal
	IDs     clock.IDGenerator
}

ActivityJournal writes the steps of an item's own history (domain-model.md §3.5).

func (j ActivityJournal) RecordStep(
	ctx context.Context, actor appshared.ActorContext, tenantID, itemID, collectionID shared.ID,
	verb activity.Verb, changeSet map[string]any, at time.Time,
) error

type AddComment ¶

type AddComment struct {
	Writer CommentWriter
}

AddComment puts a contribution on an entry's discussion.

func (h AddComment) Descriptor() usecase.Descriptor

func (h AddComment) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd AddCommentCommand,
) (domain.Comment, error)

func (h AddComment) FileDisplaced(
	ctx context.Context, actor appshared.ActorContext, itemID shared.ID, body string,
	params map[string]string,
) (domain.Comment, error)

type AddCommentCommand ¶

type AddCommentCommand struct {
	// ID is the identifier the client minted, or empty for one the server mints - a device
	// commenting offline assigns its own (offline-sync.md §3.2), CreateWorkItemCommand's rule.
	ID     shared.ID
	ItemID shared.ID
	// SystemCode and SystemParams make the comment one the server files on the author's behalf
	// (offline-sync.md §5). Not declared as inputs: nobody asks for a system comment over a
	// channel, and FileDisplaced is the one caller.
	SystemCode   string
	SystemParams map[string]string
	// ParentCommentID is the comment being replied to, empty for a top-level comment.
	ParentCommentID shared.ID
	Body            string
}

AddCommentCommand is the input, typed.

type AddLabel ¶

type AddLabel struct {
	Writer ItemLabelWriter
}

AddLabel puts a label on an entry.

func (h AddLabel) Descriptor() usecase.Descriptor

func (h AddLabel) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd LabelCommand,
) (ItemLabelSet, error)

type AddMember ¶

type AddMember struct {
	Writer ItemMemberWriter
}

AddMember puts an account on an entry's member list.

func (h AddMember) Descriptor() usecase.Descriptor

func (h AddMember) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd MemberCommand,
) (ItemMemberSet, error)

type AiProviders ¶

type AiProviders interface {
	For(ctx context.Context, actor appshared.ActorContext) (aiprovider.Provider, error)
}

AiProviders answers which provider a workspace uses. An interface here rather than the adapter, because the application layer may not import one (ADR-0001).

type AiTranslate ¶

type AiTranslate struct {
	// Reader is the ordinary read of the entry: the permission question and the existence
	// question at once, asked before any provider is called.
	Reader    GetWorkItem
	Providers AiProviders
	Prompts   aiprovider.Prompts
	Audit     audit.Sink
	// UnitOfWork opens the transaction the audit entry is written in. The asking use cases
	// record theirs inside one; this one recorded it outside and met
	// `postgres.no_transaction_in_context` the first time a person asked.
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	// Timeout bounds the provider call. Zero takes the default above.
	Timeout time.Duration
	// Kept is whose content stays out of AI (data-protection.md §4.1). Nil keeps nobody out.
	Kept KeptOutReader
}

AiTranslate reads one entry in another language (ai-first.md §2's translation row).

A read, not a record: the row says "display only, not persisted" and i18n-l10n.md §7 says user content is never translated in place. So there is no AiSuggestion, no acceptance and nothing written - the answer is handed back and gone. It is the second AI call somebody waits for, after the search's meaning, and bounded the same way.

func (h AiTranslate) Descriptor() usecase.Descriptor

func (h AiTranslate) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd TranslateCommand,
) (Translation, error)

type Anchored ¶

type Anchored interface {
	ReachInto(
		ctx context.Context, actor appshared.ActorContext, request access.Request,
		containerID shared.ID,
	) (access.Reach, error)
}

Anchored is the slice of the authorisation service a list anchored to a container needs: not "may I read this", but "how much of it may I read".

Its own interface rather than a method on Authorizer, for the reason that split Visibility and Moderation off: only the two lists over a collection's entries ask it, and every other use case would have to satisfy it in its test for nothing.

type ArchiveContainer ¶

type ArchiveContainer struct {
	Writer ContainerWriter
}

ArchiveContainer makes a hub or a collection read-only, and everything under it with it.

Nothing below is written. A collection inherits an archived hub's state through the read rather than through a stamp of its own (I-C3), so archiving a hub costs one row however many collections sit in it - and unarchiving it restores exactly what it covered, leaving a collection archived in its own right archived.

func (h ArchiveContainer) Descriptor() usecase.Descriptor

func (h ArchiveContainer) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd ArchiveContainerCommand,
) (domain.Container, error)

type ArchiveContainerCommand ¶

type ArchiveContainerCommand struct {
	ContainerID     shared.ID
	ExpectedVersion int
}

ArchiveContainerCommand is the input, typed. It is the same shape for both verbs: an identifier, and the version the caller read.

type ArchiveWorkItem ¶

type ArchiveWorkItem struct {
	Lifecycle LifecycleWriter
}

ArchiveWorkItem takes an entry out of use without deleting it: kept, and read-only.

Nothing below it is archived with it. An entry's children are entries in their own right, unlike the collections of a hub, so there is no inherited stamp here and no I-C3 to enforce - a work package under an archived task stays writable, and that is the model rather than an oversight.

func (h ArchiveWorkItem) Descriptor() usecase.Descriptor

func (h ArchiveWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd LifecycleCommand,
) (domain.WorkItem, error)

type AssignWorkItem ¶

type AssignWorkItem struct {
	Assignment AssignmentWriter
}

AssignWorkItem puts one person on an entry.

Handing an entry from one person to another is this use case rather than an unassignment followed by an assignment: the field is a scalar, so it is one decision, one version and one step of the history - and doing it in two calls would leave a moment in which the work belongs to nobody.

func (h AssignWorkItem) Descriptor() usecase.Descriptor

func (h AssignWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd AssignmentCommand,
) (domain.WorkItem, error)

type AssignmentCommand ¶

type AssignmentCommand struct {
	ItemID    shared.ID
	AccountID shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read none
	// and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

AssignmentCommand is the input of both directions, typed. The account is empty for an unassignment, which is the one field the two do not share.

type AssignmentWriter ¶

type AssignmentWriter struct {
	Items      repository.Items
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Visibility Visibility
	// Accounts answers whether a rule is about to put a restricted person on the entry: no rule
	// does (data-protection.md §4). Nil restricts nobody.
	Accounts   RestrictedAccounts
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

AssignmentWriter is what both directions of assignment need.

One dependency set held by both use cases rather than two copies of thirteen fields, for the reason CompletionWriter is one: the two operations are the same walk in opposite directions - the same guards, the same four records - and the only thing that differs is whether a person arrives or leaves.

type AttachMedia ¶

type AttachMedia struct {
	Writer ItemAttachmentWriter
}

AttachMedia puts a file on an entry.

The bytes are shared, never copied: attaching the same object to three entries is three references to one file, which is what the reference count counts and what the reconciliation job decides deletion by (data-protection.md §5).

func (h AttachMedia) Descriptor() usecase.Descriptor

func (h AttachMedia) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd AttachmentCommand,
) (ItemAttachmentSet, error)

type AttachmentCommand ¶

type AttachmentCommand struct {
	ItemID  shared.ID
	MediaID shared.ID
}

AttachmentCommand is the input of both directions, typed.

No expected version. An attachment lives beside the entry rather than on its row, so there is no version of the entry that it would be racing - which is also why neither operation spends one. Two devices attaching two different files at once is the case the OR-set exists to serve, and an optimistic lock on the entry would make one of them fail for no reason (offline-sync.md §4.2).

type Authorizer ¶

type Authorizer interface {
	Authorize(ctx context.Context, actor appshared.ActorContext, request access.Request) error
}

Authorizer is the slice of the authorisation service this use case needs. An interface rather than the service, so the use case can be tested without a membership table.

type AutoAssignOutcome ¶

type AutoAssignOutcome struct {
	Assigned bool
	Strategy domain.AutoAssignStrategy
	// Code is the stable reason when nobody was assigned, empty otherwise.
	Code string
}

AutoAssignOutcome is what the run did, beside the entry it did it to. A result rather than an error, because "the policy found nobody" is an answer, not a failure: the create that carries the same machinery must not fail the creation over it, and the two callers should not read two different shapes.

type AutoAssignWorkItem ¶

type AutoAssignWorkItem struct {
	Assignment AssignmentWriter
	Policies   repository.AutoAssignPolicies
	Groups     identityrepo.Groups
	// Accounts answers which candidates are under a restriction of processing. Art. 18 is a
	// technical state, and an automatic decision about somebody is exactly the processing it
	// stops (data-protection.md §4) - so the pool is narrowed here rather than the draw
	// being allowed to land on them.
	Accounts identityrepo.Accounts
	Random   clock.RandomSource
}

AutoAssignWorkItem hands an entry out by the collection's assignment policy instead of a named person (domain-model.md §3.6).

The split of work between the layers is the strategy port's contract: this use case resolves the material - which candidates may actually receive the entry, how loaded they are, where the rotation stands - and the domain's strategy only chooses. Eligibility is the same question the manual assignment asks about its one account, asked about every candidate: somebody who cannot see the entry is skipped, not assigned, and never named in an answer (T-04).

func (h AutoAssignWorkItem) Descriptor() usecase.Descriptor

func (h AutoAssignWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd AssignmentCommand,
) (domain.WorkItem, AutoAssignOutcome, error)

type BucketDeletion ¶

type BucketDeletion struct {
	BucketID shared.ID
	// TargetBucketID is the column the entries moved to. Zero when this was the last column on the
	// board, in which case the entries now carry none - the state the collection was in before
	// anybody made a board.
	TargetBucketID shared.ID
	MovedItems     int
}

BucketDeletion is what became of the entries that were in the deleted column.

Reported rather than left to be discovered: a board that silently reassigned a person's cards would be indistinguishable from one that lost them.

type BucketWriter ¶

type BucketWriter struct {
	Buckets    repository.Buckets
	Containers repository.Containers
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

BucketWriter is what every use case that changes an existing column shares.

One dependency set rather than one per verb: they read the same bucket, ask the same permission question of the same collection, and owe the same four writes - the row, the event, the change log entry and the audit entry. What differs between them is which domain method decides the new state, which is what bucketChange carries.

type BulkOperation ¶

type BulkOperation struct {
	Op     string
	ItemID shared.ID
	// Payload is what the single-entry operation takes in its body, by the field names it takes
	// there. It is not inspected here: the catalogue checks it against the operation's own
	// declaration, so a field the operation does not know comes back named rather than ignored.
	Payload map[string]any
}

BulkOperation is one operation of a bulk: which single-entry operation, on which entry, with the body that operation takes on its own.

type BulkOutcome ¶

type BulkOutcome struct {
	Index  int
	Op     string
	Output usecase.Output
	Err    *shared.Error
}

BulkOutcome is what one operation did. Exactly one of Output and Err is set, except for an operation of an atomic bulk that was rolled back, which carries the rolled-back refusal.

type BulkResult ¶

type BulkResult struct {
	Outcomes []BulkOutcome
	Applied  int
	Failed   int
}

BulkResult is the whole answer: one outcome per operation, in the order they were sent.

type BulkUpdateWorkItems ¶

type BulkUpdateWorkItems struct {
	Catalogue  Catalogue
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
}

BulkUpdateWorkItems applies up to five hundred single-entry operations in one call.

Every operation runs through the catalogue, which means it runs exactly as it would on its own: its own permission check, its own event, its own entry in the item's history, its own per-field records for offline clients and its own metric. One event covering five hundred entries would break a merge in a way nothing downstream recovers from, and one history entry for a bulk would hide what the history exists to show (api-guidelines.md §5).

What this use case owns is therefore only the two things a bulk adds: the order, and the question of what happens when one of them fails.

func (h BulkUpdateWorkItems) Descriptor() usecase.Descriptor

func (h BulkUpdateWorkItems) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd BulkUpdateWorkItemsCommand,
) (BulkResult, error)

type BulkUpdateWorkItemsCommand ¶

type BulkUpdateWorkItemsCommand struct {
	// Atomic makes the bulk all or nothing. Without it, the operations that succeeded stay applied.
	Atomic     bool
	Operations []BulkOperation
}

BulkUpdateWorkItemsCommand is the input, typed.

type CalendarFeedWriter ¶

type CalendarFeedWriter struct {
	Feeds      feedrepo.CalendarFeeds
	Views      viewrepo.SavedViews
	Containers repository.Containers
	// Permits answers the view's visibility without writing a denial: a view the caller cannot
	// see is not found, and a DENIED entry per invisible bookmark makes the trail unreadable
	// (T-04, the reasoning GetSavedView already applies).
	Permits    Permitting
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	// Entropy is where the token's secret half comes from. A port, so that production draws from
	// crypto/rand and a test can fix the credential it asserts on (rule 4).
	Entropy clock.Entropy
}

CalendarFeedWriter is what the three feed use cases share.

It lives beside the saved views rather than in a package of its own, because minting a feed is a read of a view: the rule that decides who may see which view is viewVisibleTo, in this package, and a second copy of a visibility rule is how two answers to one security question get into a codebase.

type Catalogue ¶

type Catalogue interface {
	Invoke(
		ctx context.Context, name string, actor appshared.ActorContext, in usecase.Input,
	) (usecase.Output, error)
}

Catalogue is the slice of the use case registry a bulk needs: run one use case by name.

Declared here as an interface rather than taking the registry, for the reason every other narrow port in this package is narrow - and for one more: the registry is built *from* this use case's descriptor, so a direct dependency would be a cycle the composition root cannot wire. What is passed in is bound after the catalogue exists.

type ChangeCommentCommand ¶

type ChangeCommentCommand struct {
	ItemID    shared.ID
	CommentID shared.ID
	Body      string
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read
	// none and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

ChangeCommentCommand is the input of both, typed. The body is the edit's; a deletion carries none, which is the one field the two do not share.

type ChangeReminderCommand ¶

type ChangeReminderCommand struct {
	ItemID     shared.ID
	ReminderID shared.ID
	Patch      domain.ReminderPatch
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read
	// none and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

ChangeReminderCommand is the input of both, typed. The patch is the update's; a deletion carries none, which is the one field the two do not share.

type ChangeTemplateCommand ¶

type ChangeTemplateCommand struct {
	TemplateID shared.ID
	Patch      domain.TemplatePatch
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read
	// none and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

ChangeTemplateCommand is the input of both, typed. The patch is the update's; a deletion carries none, which is the one field the two do not share.

type ClearCover ¶

type ClearCover struct {
	Cover CoverWriter
}

ClearCover takes the cover off an entry.

func (h ClearCover) Descriptor() usecase.Descriptor

func (h ClearCover) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CoverCommand,
) (domain.WorkItem, error)

type ClearDueDate ¶

type ClearDueDate struct {
	Due DueDateWriter
}

ClearDueDate takes the due date off an entry - the instant, the flag and the zone together, because none of them means anything alone.

func (h ClearDueDate) Descriptor() usecase.Descriptor

func (h ClearDueDate) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DueDateCommand,
) (domain.WorkItem, error)

type CommentWriter ¶

type CommentWriter struct {
	Comments   repository.Comments
	Items      repository.Items
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	// Moderation answers the one question the permission cannot: which role the actor holds.
	// Only the edit and the deletion consult it - "only the author or an administrator may
	// change a comment" is their rule, and it is named where it is enforced (Authorization.go).
	Moderation Moderation
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Text brings the body to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
	// Holds are the legal holds a deletion is judged against: under one, the deleted comment keeps
	// its text until the retention pass clears it (data-retention.md §4). Only the deletion reads
	// them.
	Holds lifecyclerepo.LegalHolds
}

CommentWriter is what every use case that writes the discussion shares: the same reads, the same permission question, and the same records - the event outwards, the change log entry for offline clients, and the audit entry. What differs between the verbs is which domain method decides the new state, and - for an edit and a deletion - the author-or-administrator rule.

type CompleteWorkItem ¶

type CompleteWorkItem struct {
	Completion CompletionWriter
}

CompleteWorkItem marks a task, work package or activity done.

Where the collection's policy rolls up, completing the last open child completes the item above it, and so on upwards until something is still open or the top is reached (invariant I-W5).

func (h CompleteWorkItem) Descriptor() usecase.Descriptor

func (h CompleteWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CompletionCommand,
) (domain.WorkItem, error)

type CompletionCommand ¶

type CompletionCommand struct {
	ItemID shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read none and
	// accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

CompletionCommand is the input of both directions, typed.

type CompletionWriter ¶

type CompletionWriter struct {
	Items      repository.Items
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	// Jobs is where an ON_COMPLETION series asks for its next occurrence. The completion is what
	// seeds it, which is SY-8's server half: creation is bound to the status transition rather
	// than to the event, so two devices completing the same entry produce one transition and one
	// follow-up (offline-sync.md §8).
	Jobs       queue.Queue
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

CompletionWriter is what both directions of completion need.

One dependency set held by both use cases rather than two copies of eleven fields. The two operations are the same walk in opposite directions - the same guards, the same roll-up, the same three records per item touched - and the only thing that differs is which state is being asked for. Keeping the machinery in one place is what makes "reopening rolls up exactly as completing does" true by construction rather than by two people remembering.

type ContainerLifecycleCommand ¶

type ContainerLifecycleCommand struct {
	ContainerID shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read none
	// and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

ContainerLifecycleCommand is the input both verbs take.

type ContainerWriter ¶

type ContainerWriter struct {
	Containers repository.Containers
	// Policies is where the auto_assign key of the policies document is stored: its own row, so
	// the rotation's state can be locked (see work.AutoAssignPolicy). Only UpdateContainerPolicies
	// writes it, for the reason only TrashContainer uses Queue - the dependency set is shared, the
	// verbs are not.
	Policies   repository.AutoAssignPolicies
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Queue is where a deletion asks for the tenant's cleanup to be scheduled. Only TrashContainer
	// uses it; the reasoning is at LifecycleWriter.Queue.
	Queue queue.Queue
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

ContainerWriter is what every use case that changes an existing container shares.

One dependency set rather than one per verb: they read the same container, ask the same permission question, and owe the same four writes - the row, the event, the change log entry and the audit entry. What differs between them is which domain method decides the new state.

type CoverCommand ¶

type CoverCommand struct {
	ItemID     shared.ID
	Kind       domain.CoverKind
	ColorToken string
	MediaID    shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read
	// none and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

CoverCommand is the input of both directions, typed. The cover itself is empty for a clearing, which is the one part the two do not share.

type CoverWriter ¶

type CoverWriter struct {
	Items      repository.Items
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Media      MediaReferences
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

CoverWriter is what both directions of the cover share.

One dependency set held by both use cases rather than two copies, for the reason AssignmentWriter is one: putting a cover on and taking it off are the same walk in opposite directions, and the only thing that differs is whether an image arrives or leaves.

type CreateBucket ¶

type CreateBucket struct {
	Buckets    repository.Buckets
	Containers repository.Containers
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

CreateBucket adds a column to a collection's board.

Only a collection has a board. A hub holds collections and no items, so a column on one would have nothing to hold - which is the same reasoning that keeps items off a hub, and it is Container.EnsureAcceptsItems that answers it.

func (h CreateBucket) Descriptor() usecase.Descriptor

func (h CreateBucket) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateBucketCommand,
) (domain.Bucket, error)

type CreateBucketCommand ¶

type CreateBucketCommand struct {
	CollectionID shared.ID
	Name         string

	// WipLimit is a number of which zero means "no limit", exactly as the empty string means "not
	// set" for the text fields (domain.BucketAttributes).
	WipLimit     int
	IsDoneBucket bool
	ColorToken   string
	// BeforeBucketID is the column the new one goes to the left of. Empty means the right hand end,
	// which is where a board grows unless somebody says otherwise.
	BeforeBucketID shared.ID
}

CreateBucketCommand is the input, typed.

type CreateCalendarFeed ¶

type CreateCalendarFeed struct{ Writer CalendarFeedWriter }

CreateCalendarFeed mints a feed over one saved view and answers its token, once.

func (h CreateCalendarFeed) Descriptor() usecase.Descriptor

func (h CreateCalendarFeed) Execute(
	ctx context.Context, actor appshared.ActorContext, viewID shared.ID,
) (MintedFeed, error)

type CreateContainer ¶

type CreateContainer struct {
	Containers repository.Containers
	Authorizer Authorizer
	// OwnHubs answers who may make a private hub; Grants makes its creator its owner. Both are
	// needed only for a private hub, and a build without them refuses one rather than making a hub
	// nobody holds.
	OwnHubs OwnHubs
	Grants  identityrepository.MembershipGrants
	// PrivateHubs is the workspace's switch, read only for a private hub.
	PrivateHubs PrivateHubsRule
	Events      outbox.Events
	Changes     changelog.ChangeLog
	Audit       audit.Sink
	UnitOfWork  persistence.UnitOfWork
	Clock       clock.Clock
	IDs         clock.IDGenerator
	HLC         clock.HLCSource
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

CreateContainer creates a hub or a collection.

It is the reference use case: everything a write in this system owes is visible in one Execute - the permission check before the transaction, the invariants in the domain, and inside one transaction the row, the event, the change log entry for offline clients and the audit entry. A later use case that leaves one of them out is visibly different from this one, which is the point of having a reference at all.

func (h CreateContainer) Descriptor() usecase.Descriptor

func (h CreateContainer) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateContainerCommand,
) (domain.Container, error)

type CreateContainerCommand ¶

type CreateContainerCommand struct {
	Type     domain.ContainerType
	ParentID shared.ID
	Name     string

	Description string
	Icon        string
	ColorToken  string

	// Private makes a new hub private, its creator its owner (ADR-0073 §2).
	Private bool
}

CreateContainerCommand is the input, typed. The registry hands the use case an untyped map from whichever channel the call arrived through; this is what that map becomes once, here.

type CreateLabel ¶

type CreateLabel struct {
	Labels     repository.Labels
	Containers repository.Containers
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

CreateLabel adds a label to a collection's vocabulary.

A collection rather than a hub, and rather than the tenant: a label is a vocabulary the people working in one collection agree on, and a workspace-wide list would make every collection pay for every other's (domain-model.md §3.5).

func (h CreateLabel) Descriptor() usecase.Descriptor

func (h CreateLabel) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateLabelCommand,
) (domain.Label, error)

type CreateLabelCommand ¶

type CreateLabelCommand struct {
	CollectionID shared.ID
	Name         string
	ColorToken   string
	Description  string
}

CreateLabelCommand is the input, typed.

type CreateReminder ¶

type CreateReminder struct {
	Writer ReminderWriter
}

CreateReminder puts a reminder on an entry.

func (h CreateReminder) Descriptor() usecase.Descriptor

func (h CreateReminder) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateReminderCommand,
) (domain.Reminder, error)

type CreateReminderCommand ¶

type CreateReminderCommand struct {
	ItemID     shared.ID
	OffsetSpec string
	// Channels as the caller named them, and empty for the default. Strings rather than the
	// domain's type, because an unknown channel is a validation answer rather than a parse error
	// (ADR-0011): the domain names the value it refused.
	Channels   []string
	Recipients []shared.ID
}

CreateReminderCommand is the input, typed.

type CreateSavedView ¶

type CreateSavedView struct {
	Views      viewrepo.SavedViews
	Containers repository.Containers
	Authorizer Authorizer
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	// Text brings the name to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

CreateSavedView saves a view: a query in the DSL, validated here against the same catalogue an ad-hoc one passes, and the layout the client draws it in, stored and never consulted (api-guidelines.md §3).

func (h CreateSavedView) Descriptor() usecase.Descriptor

func (h CreateSavedView) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateSavedViewCommand,
) (view.SavedView, error)

type CreateSavedViewCommand ¶

type CreateSavedViewCommand struct {
	ScopeType view.ViewScope
	ScopeID   shared.ID
	Name      string
	Layout    string
	Query     map[string]any
	Grouping  map[string]any
	// VisibleFields distinguishes nil - not sent, stored empty - from an empty list a client
	// chose, though the two store alike.
	VisibleFields []string
	Sharing       view.Sharing
}

CreateSavedViewCommand is the input, typed.

type CreateTemplate ¶

type CreateTemplate struct {
	Writer TemplateWriter
}

CreateTemplate defines a template.

func (h CreateTemplate) Descriptor() usecase.Descriptor

func (h CreateTemplate) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateTemplateCommand,
) (domain.Template, error)

type CreateTemplateCommand ¶

type CreateTemplateCommand struct {
	Spec domain.TemplateSpec
}

CreateTemplateCommand is the input, typed.

type CreateWorkItem ¶

type CreateWorkItem struct {
	Items      repository.Items
	Quota      ItemQuota
	Buckets    repository.Buckets
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Ownership  Ownership
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// AutoAssign is the machinery behind :auto-assign, reused whole: the create path is
	// its second caller - the policy that applies itself to what a collection creates, and the
	// explicit `auto_assign` ask - and its Assignment writer is also how an explicit assignee is
	// written, with the same guards and the same four records as :assign.
	AutoAssign AutoAssignWorkItem
	// DueDates is the writer the declared due fields dispatch into, reused whole for the same
	// reason.
	DueDates DueDateWriter
	// Labels and Members are the writers the two set fields dispatch into, reused whole: a label
	// put on at creation is the same OR-set element, the same events and the same audit entry as
	// one put on a moment later.
	Labels  ItemLabelWriter
	Members ItemMemberWriter
	// Covers is the writer the declared cover dispatches into, reused whole for the same reason:
	// one place decides what a cover may be, what an image has to be before it may become one, and
	// what the change owes.
	Covers CoverWriter
	// CustomFields is the use case the declared values dispatch into, one key at a time. Whole
	// rather than a slice of it, because what judges a value is the definition in force for the
	// entry's collection, and that resolution is the thing that may not be duplicated.
	CustomFields SetCustomField
	// Text brings the title and the notes to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

func (h CreateWorkItem) Descriptor() usecase.Descriptor

func (h CreateWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd CreateWorkItemCommand,
) (domain.WorkItem, *AutoAssignOutcome, error)

type CreateWorkItemCommand ¶

type CreateWorkItemCommand struct {
	// ID is the identifier the client minted, or empty for one the server mints. A device
	// creating an entry offline assigns its own UUIDv7 so that the entry has its final identity
	// at once and a repeated push is idempotent (offline-sync.md §3.2, §9); through the API a
	// caller may do the same, and one that does is held to the same rule.
	ID   shared.ID
	Type domain.ItemType
	// CollectionID may be left empty when ParentID is given: an item's collection is the one its
	// parent is in, and making a client repeat it is making it possible to contradict.
	CollectionID shared.ID
	ParentID     shared.ID
	Title        string
	Notes        string
	// BucketID is the column of the collection's board the entry starts in, empty for none.
	BucketID shared.ID
	// AssigneeID creates the entry already on somebody: the same checks and the same
	// records as :assign, in the same transaction as the creation. Empty for nobody.
	AssigneeID shared.ID
	// AutoAssign asks the collection's assignment policy to hand the new entry out, explicitly -
	// an enabled policy applies itself without this flag. Contradicts AssigneeID and is refused
	// beside it: a named person and a policy cannot both decide one scalar.
	AutoAssign bool
	// ContentLanguage is the language the entry is written in, and empty takes the creator's
	// locale (i18n-l10n.md §5). What it decides is the text search configuration the entry is
	// indexed under, which is the whole of why it is worth carrying (ADR-0034).
	ContentLanguage string
	// StartAt is when the work begins, nil for no start - the create's own field, a plain
	// attribute beside the notes.
	StartAt *time.Time
	// CalendarUID is the UID a calendar client chose for the entry it is making, and empty for
	// every other creation (offline-sync.md §4.2). The tree answers the entry at that address
	// from then on; nothing else reads it, and nothing ever changes it.
	CalendarUID string
	// Due creates the entry already carrying a due date: the same validation and the same
	// records as PUT /items/{id}/due, in the same transaction as the creation - the way an
	// explicit assignee reuses the :assign machinery. Nil for none.
	Due *domain.DueDate
	// LabelIDs creates the entry already carrying labels of its collection, and MemberIDs already
	// on a member list. Each goes through the writer that owns the set, with the same guards and
	// the same four records as the standalone route, in the same transaction as the creation. Empty
	// for none.
	LabelIDs  []shared.ID
	MemberIDs []shared.ID
	// CustomFields creates the entry already carrying values, each judged against the definition in
	// force for its collection and each written as its own change - the per-key merge rule the
	// standalone route exists to keep. Nil for none.
	CustomFields map[string]any
	// Cover creates the entry already covered: a colour token or an image, with the rules and the
	// records of `PUT /items/{id}/cover`, in the same transaction as the creation. Nil for an entry
	// with no cover. `ItemID` is filled at the dispatch - the caller of a create does not know the
	// identifier yet, which is half of why this field had to be written here rather than left to a
	// second request.
	Cover *CoverCommand
	// BeforeItemID is the sibling the new entry is ranked in front of, and empty puts it at the
	// end. It is the move's own anchor, answered by the same neighbours query and the same
	// refusal - a sibling that is not at this level is `items.before_item_not_in_level` rather
	// than a silent append, because a client that asked for a position and got the end of the list
	// has been ignored.
	BeforeItemID shared.ID
}

CreateWorkItemCommand is the input, typed.

The fields are the ones this use case owns or dispatches - the assignee, the due date, the labels, the members, the cover and the custom fields each into the writer that owns them. A field the catalogue does not declare is refused rather than accepted and dropped: a request carrying one comes back naming it (usecase.field_unknown) instead of returning a 201 for an item that is not what the caller asked for.

type CustomFieldWriter ¶

type CustomFieldWriter struct {
	Fields     repository.CustomFields
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	// Text brings the options and a TEXT value to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

CustomFieldWriter is what an edit and a deletion share.

One dependency set held by both, for the reason the label pair holds one: the two are the same walk - read the definition, resolve the scope it lives in, ask the permission there, write under the optimistic lock - and the only thing that differs is what is written at the end.

type DefineCustomField ¶

type DefineCustomField struct {
	Fields     repository.CustomFields
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	// Text brings the options and a TEXT value to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

DefineCustomField adds a field to a workspace's or a collection's vocabulary.

Two scopes and no more. A field every collection defines separately is a field nobody can filter across; a field only ever defined workspace-wide is one team's vocabulary imposed on every other (domain-model.md §3.5). Which of the two applies is the presence of a collection in the command.

func (h DefineCustomField) Descriptor() usecase.Descriptor

func (h DefineCustomField) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DefineCustomFieldCommand,
) (domain.CustomFieldDefinition, error)

type DefineCustomFieldCommand ¶

type DefineCustomFieldCommand struct {
	// CollectionID is the collection the field belongs to, zero for the whole workspace.
	CollectionID shared.ID
	Key          string
	Kind         domain.CustomFieldKind
	Options      []string
	IsRequired   bool
	// AppliesTo are the item types that carry the field. Empty means the column's default, which
	// is a task alone.
	AppliesTo []domain.ItemType
}

DefineCustomFieldCommand is the input, typed.

type DeleteBucket ¶

type DeleteBucket struct {
	Writer BucketWriter
}

DeleteBucket takes a column off a board and moves its entries somewhere they still exist.

It is not one of the verbs BucketWriter.change covers, and the difference is the point: this one writes two rows' worth of state - the column and every entry that was in it - and returns what became of them. A verb that only stamped the column would leave the entries pointing at something that is no longer on the board, and the foreign key's ON DELETE SET NULL would take a person's board apart silently instead.

A soft delete. The row stays so that a change log entry can still name it and a restore stays possible (offline-sync.md §7); the partial unique index frees the name at the same moment.

func (h DeleteBucket) Descriptor() usecase.Descriptor

func (h DeleteBucket) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DeleteBucketCommand,
) (BucketDeletion, error)

type DeleteBucketCommand ¶

type DeleteBucketCommand struct {
	BucketID shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read none
	// and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

DeleteBucketCommand is the input, typed.

type DeleteComment ¶

type DeleteComment struct {
	Writer CommentWriter
}

DeleteComment turns a comment into its tombstone.

func (h DeleteComment) Descriptor() usecase.Descriptor

func (h DeleteComment) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd ChangeCommentCommand,
) (domain.Comment, error)

type DeleteCustomField ¶

type DeleteCustomField struct {
	Writer CustomFieldWriter
}

DeleteCustomField takes a definition out of use.

func (h DeleteCustomField) Descriptor() usecase.Descriptor

func (h DeleteCustomField) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DeleteCustomFieldCommand,
) error

type DeleteCustomFieldCommand ¶

type DeleteCustomFieldCommand struct {
	FieldID         shared.ID
	ExpectedVersion int
}

DeleteCustomFieldCommand is the input, typed.

type DeleteLabel ¶

type DeleteLabel struct {
	Writer LabelWriter
}

DeleteLabel takes a label out of a collection's vocabulary.

A soft delete, and the entries that carried it are not rewritten: the read side filters on the label's own stamp, which is what makes the deletion undoable without having to remember who wore it. That is the difference from a deleted column, whose entries have to go somewhere - a chip that is no longer in the vocabulary simply stops being rendered, while an entry in a column that is no longer on the board would be nowhere at all.

func (h DeleteLabel) Descriptor() usecase.Descriptor

func (h DeleteLabel) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DeleteLabelCommand,
) (domain.Label, error)

type DeleteLabelCommand ¶

type DeleteLabelCommand struct {
	LabelID         shared.ID
	ExpectedVersion int
}

DeleteLabelCommand is the input, typed.

type DeleteReminder ¶

type DeleteReminder struct {
	Writer ReminderWriter
}

DeleteReminder removes a reminder.

func (h DeleteReminder) Descriptor() usecase.Descriptor

func (h DeleteReminder) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd ChangeReminderCommand,
) error

type DeleteSavedView ¶

type DeleteSavedView struct {
	Writer SavedViewWriter
}

DeleteSavedView removes a view. A calendar feed that served it keeps its token and serves nothing, saying why - the reference nulls rather than cascading (migration 0005).

func (h DeleteSavedView) Descriptor() usecase.Descriptor

func (h DeleteSavedView) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd SavedViewCommand,
) error

type DeleteTemplate ¶

type DeleteTemplate struct {
	Writer TemplateWriter
}

DeleteTemplate removes a template, leaving the trees it has stamped out standing.

func (h DeleteTemplate) Descriptor() usecase.Descriptor

func (h DeleteTemplate) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd ChangeTemplateCommand,
) error

type DetachMedia ¶

type DetachMedia struct {
	Writer ItemAttachmentWriter
}

DetachMedia takes a file off an entry. The object itself stays - it may serve other entries, and what decides its life is the count rather than this call.

func (h DetachMedia) Descriptor() usecase.Descriptor

func (h DetachMedia) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd AttachmentCommand,
) (ItemAttachmentSet, error)

type DueDateCommand ¶

type DueDateCommand struct {
	ItemID shared.ID
	Due    *domain.DueDate
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read
	// none and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

DueDateCommand is the input of both directions, typed. The due date is nil for a clearing, which is the one field the two do not share.

type DueDateWriter ¶

type DueDateWriter struct {
	Items      repository.Items
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	// Reminders is here because a due date that moves takes the relative reminders with it: the
	// reminder lives on the same entry, so its moment is recomputed in the same transaction rather
	// than by a job that would leave the two disagreeing until it ran.
	Reminders repository.Reminders
	// Jobs is where the tenant's next wake-up is asked for, in the transaction that moved the
	// date: a reminder that came forward with it needs the schedule to come forward too.
	Jobs       queue.Queue
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

DueDateWriter is what both directions of the due date need.

One dependency set held by both use cases, for the reason AssignmentWriter is one: the two operations are the same walk in opposite directions - the same guards, the same four records - and the only thing that differs is whether a date arrives or leaves. It is also the writer the create and update paths dispatch into: the contract carries the three due fields on their schemas, and serving them through a second implementation would be a second answer to what a due date means.

type DuplicateResult ¶

type DuplicateResult struct {
	Item domain.WorkItem
	// Copied is the size of the copy, the entry itself included.
	Copied int
	// DroppedReferences is what could not be carried over, from every entry that lost something.
	// Empty rather than nil: a client that iterates the losses should not have to nil-check the
	// field.
	DroppedReferences []domain.DroppedReference
}

DuplicateResult is what a duplication answers with: the copy of the entry that was asked about, how many entries the copy consists of, and what the destination could not carry over (I-W6).

type DuplicateWorkItem ¶

type DuplicateWorkItem struct {
	Quota       ItemQuota
	Items       repository.Items
	ItemLabels  repository.ItemLabels
	ItemMembers repository.ItemMembers
	Labels      repository.Labels
	Buckets     repository.Buckets
	Fields      repository.CustomFields
	Containers  repository.Containers
	Attachments mediarepo.Attachments
	Media       MediaReferences
	Profiles    metarepo.CapabilityProfiles
	Authorizer  Authorizer
	// Ownership is the same question the create path asks: does the role the actor holds write only
	// what is assigned to them. A copy is a create, so it has to ask it too.
	Ownership  Ownership
	Visibility Visibility
	// Restrictions answers whether a rule is copying an entry onto a restricted person: the copy is
	// made unassigned and the drop reported (data-protection.md §4). Nil restricts nobody.
	Restrictions RestrictedAccounts
	Events       outbox.Events
	Changes      changelog.ChangeLog
	Audit        audit.Sink
	Activity     ActivityJournal
	UnitOfWork   persistence.UnitOfWork
	Clock        clock.Clock
	IDs          clock.IDGenerator
	HLC          clock.HLCSource
	// Text is what a copied TEXT value is checked with; a value written before the form was
	// applied is composed by the copy, exactly as its next edit would compose it.
	Text text.Normalizer
}

DuplicateWorkItem copies an entry, and everything below it when asked for.

The copy is a new entry rather than a fork of a conversation: what travels is the description - the title, the notes, the column, the labels, the members, the assignee, the cover, the attachments and the custom field values, as far as each type's capability profile allows - and what does not is the discussion and the history. A comment is an exchange between people about one entry, and there is no sense in which a copy has already had it.

What the destination cannot resolve is reported rather than dropped in silence (I-W6), exactly as a move reports it: a label belongs to one collection's vocabulary, a column to one board, a custom field key to whatever definition that collection gives it, and an account may see one collection and not another. A person who spent an afternoon labelling learns what to redo.

func (h DuplicateWorkItem) Descriptor() usecase.Descriptor

func (h DuplicateWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd DuplicateWorkItemCommand,
) (DuplicateResult, error)

type DuplicateWorkItemCommand ¶

type DuplicateWorkItemCommand struct {
	ItemID shared.ID
	// IncludeSubtree copies everything below the entry with it. Without it the entry is copied
	// alone and its children stay where they are.
	IncludeSubtree bool
	// TargetParentID is the entry the copy sits under, meaningful only together with ParentGiven:
	// the zero value is both "the top level" and "not asked for", and those are different requests.
	TargetParentID shared.ID
	ParentGiven    bool
	// TargetCollectionID may be omitted when a parent is given: an entry's collection is the one
	// its parent is in, and making a client repeat it is making it possible to contradict.
	TargetCollectionID shared.ID
	// Title is the copy's title, and empty keeps the original's. A server that invented "Copy of …"
	// would be writing display text (ADR-0011).
	Title string
}

DuplicateWorkItemCommand is the input, typed.

type EditComment ¶

type EditComment struct {
	Writer CommentWriter
}

EditComment rewrites a comment's text.

func (h EditComment) Descriptor() usecase.Descriptor

func (h EditComment) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd ChangeCommentCommand,
) (domain.Comment, error)

type EmbedItems ¶

type EmbedItems struct {
	Embeddings repository.Embeddings
	Providers  AiProviders
	Semantic   SemanticSearch
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	// BatchSize bounds one pass. Zero takes the default below.
	BatchSize int
	// Kept is whose content stays out of AI: their entries are not embedded, and their vectors
	// are forgotten by the pass (data-protection.md §4.1). Nil keeps nobody out.
	Kept KeptOutReader
}

EmbedItems brings one workspace's vectors up to date with its entries.

Not a use case, and deliberately not in the catalogue: nobody asks for their entries to be embedded. It is the pass behind a job, in the shape the retention sweep has - a batch, then a decision about whether to come straight back - because what it does is a backlog rather than a question.

**Nothing about it is on the write path.** An embedding cannot be maintained by a trigger the way `search_document` is, because a trigger cannot make a network call, and a write that waited on a provider is precisely what ai-first.md §2 forbids. So an entry whose text just changed is found lexically until the pass reaches it, which is the correct degradation rather than a gap: the entry is searchable the whole time, by the words somebody would use to find something they just wrote.

func (h EmbedItems) Execute(
	ctx context.Context, actor appshared.ActorContext,
) (EmbedOutcome, error)

type EmbedOutcome ¶

type EmbedOutcome struct {
	// Embedded is how many vectors were written.
	Embedded int
	// Exhausted is true when the pass filled its batch, which means there is probably more owed.
	Exhausted bool
}

EmbedOutcome is what one pass did, for the job that decides whether to come back.

type EmbeddingQueue ¶

type EmbeddingQueue interface {
	Enqueue(ctx context.Context, request queue.Request) (shared.ID, error)
}

EmbeddingQueue is the slice of the job queue this subscriber needs. Narrow, so what it can do is one line: ask for work.

type EmergencyNotices ¶

type EmergencyNotices interface {
	EmergencyAccessOpened(ctx context.Context, access domain.EmergencyAccess, members []shared.ID) error
}

EmergencyNotices tells a private hub's members that it was opened - the notification service's RecordEmergencyAccess - inside the caller's transaction.

type ExportView ¶

type ExportView struct {
	Views      viewrepo.SavedViews
	Containers repository.Containers
	Permits    Permitting
	// Query is the same use case an ad-hoc query goes through. Held rather than reimplemented:
	// an export that selected rows its own way would be a second answer to "what does this view
	// contain", and the two would drift.
	Query      QueryItems
	ItemLabels repository.ItemLabels
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
}

ExportView renders a saved view's result whole.

The rows are selected here and rendered by whichever channel asked: a wire format is an adapter's business (project-structure.md §3), and the backend composes no document text of its own (rule 8). What this use case owes is the selection, the cap, and the honest statement that the cap was reached.

The query executes under the **caller's** authorisation, exactly as reading the view does: two people exporting one shared view export two different files, and neither gets a row their role hides (T-04, T-05).

func (h ExportView) Descriptor() usecase.Descriptor

func (h ExportView) Execute(
	ctx context.Context, actor appshared.ActorContext, viewID shared.ID,
) (ExportedView, error)

func (h ExportView) Select(
	ctx context.Context, actor appshared.ActorContext, viewID shared.ID,
) (ExportedView, error)

type ExportedView ¶

type ExportedView struct {
	View  view.SavedView
	Items []domain.WorkItem
	// Labels is the label identifiers per entry, so that a rendering that shows them does not
	// have to ask again.
	Labels map[shared.ID][]shared.ID
	// Truncated says the result reached view.MaxExportRows and there was more behind it.
	Truncated bool
	// TimeZone is the zone the selection ran under - the caller's own, or the feed owner's. It
	// decides nothing about which rows came back and everything about which day an all-day entry
	// falls on when one is rendered (i18n-l10n.md §4).
	TimeZone    string
	GeneratedAt time.Time
}

ExportedView is what an export answers.

type FireReminders ¶

type FireReminders struct {
	Reminders repository.Reminders
	Items     repository.Items
	// Schedule is the scan the two announcements run on: the same repository as Items, under the
	// narrow interface that says what this pass may do with it.
	Schedule    repository.DueAnnouncements
	Containers  repository.Containers
	ItemMembers repository.ItemMembers
	// Visibility answers whether a named recipient can still see the entry. A membership revoked
	// since the reminder was written is not survived by a reminder that remembers better days -
	// the same question the write asked, asked again at the moment it matters.
	Visibility Visibility
	Notifier   ReminderNotifier
	// Events is where the two scheduling announcements go: item.due_soon and item.overdue are
	// facts about a deadline rather than messages to a person, and what reacts to them is
	// automation (domain-model.md §4).
	Events outbox.Events
	// Changes is how a device learns that a reminder fired. offline-sync.md §8 requires a client
	// to reconcile the local notification it scheduled, and it can only do that if the server's
	// decision reaches it - so the state the pass writes travels like any other field.
	Changes changelog.ChangeLog
	Clock   clock.Clock
	IDs     clock.IDGenerator
	HLC     clock.HLCSource
	Signals ReminderSignals
	// BatchSize bounds one pass. A pass is one transaction, and a transaction that fired ten
	// thousand reminders would hold its locks for as long as that took.
	BatchSize int
}

FireReminders turns the reminders whose moment has come into notifications.

Internal, and deliberately absent from the catalogue in domain-model.md §5, for the reason ReconcileMedia is absent from it: the catalogue is what a person, an agent or a rule can ask for, and "fire everybody's reminders now" is not something anybody should be able to ask for - the way to influence when a reminder fires is the reminder.

It runs inside the transaction the job runner opened, which is the whole reliability argument: the guarded transition, the notification records, the delivery jobs and the job's own completion commit together. A process killed halfway leaves none of them and the reminders are still pending when the job is claimed again - nothing is lost and nothing is doubled (test RT-3).

func (h FireReminders) Execute(
	ctx context.Context, actor appshared.ActorContext,
) (ReminderOutcome, error)

type GetContainer ¶

type GetContainer struct {
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

GetContainer reads one hub or collection.

Read-only throughout, which is not a detail: the transaction may be served by a read replica (multi-tenancy.md §7), and a read that opened a write transaction would pin every list in the product to the primary.

func (h GetContainer) Descriptor() usecase.Descriptor

func (h GetContainer) Execute(
	ctx context.Context, actor appshared.ActorContext, query GetContainerQuery,
) (domain.Container, error)

type GetContainerQuery ¶

type GetContainerQuery struct {
	ContainerID shared.ID
}

GetContainerQuery is the input, typed.

type GetRecurrence ¶

type GetRecurrence struct {
	Recurrences repository.Recurrences
	Items       repository.Items
	Containers  repository.Containers
	Authorizer  Authorizer
	UnitOfWork  persistence.UnitOfWork
}

GetRecurrence reads an entry's series.

The right to read the entry is the right to read what it repeats by, for the reason the history draws the same line: a separate right would be one more thing to get wrong for no protection gained (domain-model.md §3.2).

func (h GetRecurrence) Descriptor() usecase.Descriptor

func (h GetRecurrence) Execute(
	ctx context.Context, actor appshared.ActorContext, itemID shared.ID,
) (domain.RecurrenceRule, error)

type GetSavedView ¶

type GetSavedView struct {
	Views      viewrepo.SavedViews
	Containers repository.Containers
	Permits    Permitting
	UnitOfWork persistence.UnitOfWork
}

GetSavedView answers one view.

func (h GetSavedView) Descriptor() usecase.Descriptor

func (h GetSavedView) Execute(
	ctx context.Context, actor appshared.ActorContext, id shared.ID,
) (view.SavedView, error)

type GetTemplate ¶

type GetTemplate struct {
	Writer TemplateWriter
}

GetTemplate reads one template.

func (h GetTemplate) Descriptor() usecase.Descriptor

func (h GetTemplate) Execute(
	ctx context.Context, actor appshared.ActorContext, id shared.ID,
) (domain.Template, error)

type GetWorkItem ¶

type GetWorkItem struct {
	Items      repository.Items
	ItemLabels repository.ItemLabels
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

GetWorkItem reads one task, work package or activity.

func (h GetWorkItem) Descriptor() usecase.Descriptor

func (h GetWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, query GetWorkItemQuery,
) (domain.WorkItem, error)

type GetWorkItemQuery ¶

type GetWorkItemQuery struct {
	ItemID shared.ID
	// CalendarUID names the entry by the address a calendar client knows it by instead of by its
	// identifier (offline-sync.md §4.2) - the tree's question when a PUT arrives at an address the
	// view does not answer. Read when ItemID is empty; the permission is decided the same way,
	// because the entry found is the same entry.
	CalendarUID string
	// ExpandLabels asks for the labels the entry carries.
	//
	// Asked for rather than always included, which is what `expand` is for (api-guidelines.md §4):
	// the labels are a second query, and a client rendering a plain list should not pay for chips
	// it is not drawing. Absent rather than empty when it was not asked for - so that a client can
	// tell "this entry has no labels" from "I did not ask".
	ExpandLabels bool
}

GetWorkItemQuery is the input, typed.

type InstantiateTemplate ¶

type InstantiateTemplate struct {
	Quota       ItemQuota
	Writer      TemplateWriter
	Items       repository.Items
	ItemMembers repository.ItemMembers
	// Visibility answers whether a node's fixed assignee can see the collection the tree lands in.
	// The same question an assignment asks, asked here because a template written last year
	// may name somebody who has left.
	Visibility Visibility
	// Restrictions answers whether a rule is instantiating for a node's restricted assignee: the
	// entry is made unassigned and the drop reported (data-protection.md §4). Nil restricts nobody.
	Restrictions RestrictedAccounts
	Events       outbox.Events
	Activity     ActivityJournal
}

InstantiateTemplate stamps a template out into a collection.

A sibling of DuplicateWorkItem rather than the same machinery: there is no source tree to read - the shape is a document - but everything else is the same shape of problem, and the answers are the ones the copy already gave. Every entry carries its own records, because a client synchronising the collection has to learn about every row; the references the destination cannot carry are reported rather than dropped silently (I-W6); and the whole act is one audit entry and one announcement.

func (h InstantiateTemplate) Descriptor() usecase.Descriptor

func (h InstantiateTemplate) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd InstantiateTemplateCommand,
) (InstantiationResult, error)

type InstantiateTemplateCommand ¶

type InstantiateTemplateCommand struct {
	TemplateID   shared.ID
	CollectionID shared.ID
	ParentID     shared.ID
	// Anchor is the day the relative dates count from, and the zero time for "now". A day rather
	// than an instant: "+3 days for a project starting Monday" is about days, and it is read in
	// the caller's own zone.
	Anchor time.Time
	Title  string
}

InstantiateTemplateCommand is the input, typed.

type InstantiationResult ¶

type InstantiationResult struct {
	TemplateID shared.ID
	Root       domain.WorkItem
	// Created is the size of the tree, the root included.
	Created int
	// DroppedReferences is what the destination could not carry, from every entry that lost
	// something. Empty rather than nil: a client that iterates the losses should not have to
	// nil-check the field.
	DroppedReferences []domain.DroppedReference
}

InstantiationResult is what an instantiation answers with.

type ItemAttachmentSet ¶

type ItemAttachmentSet struct {
	ItemID   shared.ID
	MediaIDs []shared.ID
}

ItemAttachmentSet is what an entry carries, as every channel reports it.

type ItemAttachmentWriter ¶

type ItemAttachmentWriter struct {
	Items       repository.Items
	Containers  repository.Containers
	Profiles    metarepo.CapabilityProfiles
	Attachments mediarepo.Attachments
	Media       MediaReferences
	Authorizer  Authorizer
	Events      outbox.Events
	Changes     changelog.ChangeLog
	Audit       audit.Sink
	Activity    ActivityJournal
	UnitOfWork  persistence.UnitOfWork
	Clock       clock.Clock
	IDs         clock.IDGenerator
	HLC         clock.HLCSource
}

ItemAttachmentWriter is what both directions share.

The tokens are the entry's rather than the media context's, for the reason the label pair's are the entry's: attaching a file to an entry is work on that entry, and somebody who may edit it may attach to it. Staging the file needed `media:write`; putting it on an entry needs the right to change the entry (security.md §5, domain-model.md §3.2).

type ItemLabelSet ¶

type ItemLabelSet struct {
	ItemID   shared.ID
	LabelIDs []shared.ID
}

ItemLabelSet is the labels an entry carries, as every channel reports them.

type ItemLabelWriter ¶

type ItemLabelWriter struct {
	Items      repository.Items
	ItemLabels repository.ItemLabels
	Labels     repository.Labels
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

ItemLabelWriter is what both use cases share.

The tokens are the item's rather than the container's, unlike the label itself: defining a collection's vocabulary is structure, and tagging an entry with a word from it is work. Somebody who may edit entries may label them, and somebody who may not must not be able to reach around through this endpoint (security.md §5, domain-model.md §3.2).

type ItemMemberSet ¶

type ItemMemberSet struct {
	ItemID     shared.ID
	AccountIDs []shared.ID
}

ItemMemberSet is the members an entry carries, as every channel reports them.

type ItemMemberWriter ¶

type ItemMemberWriter struct {
	Items       repository.Items
	ItemMembers repository.ItemMembers
	Containers  repository.Containers
	Profiles    metarepo.CapabilityProfiles
	Authorizer  Authorizer
	Visibility  Visibility
	// Accounts answers whether a rule is about to put a restricted person on the entry: no rule
	// does (data-protection.md §4). Nil restricts nobody.
	Accounts   RestrictedAccounts
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

ItemMemberWriter is what both use cases share.

The same shape ItemLabelWriter has, because the member list is the same kind of thing as the label set: an OR-set beside the entry rather than a field on it. What differs is the question asked before the write - a label has to belong to the entry's collection, an account has to be able to see the entry - and the capability that gates it.

type ItemQuota ¶

type ItemQuota interface {
	Items(ctx context.Context, tenant string, adding int64) error
}

CreateWorkItem creates a task, a work package, or an activity.

It is the second walking skeleton, and it owes what CreateContainer owes: the permission check before the transaction, the invariants in the domain, and inside one transaction the row, the event, the change log entry for offline clients and the audit entry.

What is new here is that the rules are data. Which type may sit under which, and how deep, come from the capability profiles through the hierarchy service (ADR-0006) - so this file, like that one, names none of the three levels. ItemQuota is the §4 items ceiling, asked before an entry is created. The slice the work package needs of quota.Guard.

type Jobs ¶

type Jobs interface {
	Enqueue(ctx context.Context, request queue.Request) (shared.ID, error)
}

Jobs is the slice of the queue this use case needs.

type KeptOutReader ¶

type KeptOutReader interface {
	Read(ctx context.Context, tenantID shared.ID) (integration.KeptOut, error)
}

KeptOutReader answers whose content stays out of AI, inside the caller's transaction. Declared here because the application layer may not import a sibling service.

type LabelCommand ¶

type LabelCommand struct {
	ItemID  shared.ID
	LabelID shared.ID
}

LabelCommand is the input of both directions, typed.

No expected version. A label lives beside the entry rather than on its row, so there is no version of the entry that an addition would be racing - which is also why neither operation spends one. Two devices adding two different labels at once is the case the OR-set exists to serve, and an optimistic lock on the entry would make one of them fail for no reason (offline-sync.md §4.2).

type LabelWriter ¶

type LabelWriter struct {
	Labels     repository.Labels
	Containers repository.Containers
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Text brings the names people type to normal form C on the way in (i18n-l10n.md §5).
	Text text.Normalizer
}

LabelWriter is what both use cases that change an existing label share.

One dependency set rather than two: they read the same label, ask the same permission question of the same collection, and owe the same four writes. What differs is which domain method decides the new state and what the change log calls it.

type LastMember ¶

type LastMember struct {
	Hubs   repository.OrphanedHubs
	Writer ContainerWriter
	// Owners tells the workspace's owners. Optional: wired without it the hub still goes to the
	// trash, which is the half nobody could do by hand.
	Owners OwnersNotice
}

LastMember moves a private hub into the trash once nobody is left in it (ADR-0073 §5).

Nobody else may open a private hub, so one without a member is a hub nobody can reach - not the workspace's owners, who hold nothing in it. Trashed rather than purged: the ordinary grace runs, and the workspace's owners are told that one went, without its name. Taking it over is the emergency access; letting it go is the purge.

Asked by whatever ends a membership - a revocation, an erasure - in that act's own transaction, and by the retention pass for whatever a path missed. A member is an account, neither anonymised nor deleted, holding a role on the hub, on a collection in it or on an entry in one.

func (l LastMember) AfterMemberLeft(
	ctx context.Context, tenantID shared.ID, named []shared.ID,
) (int, error)

func (l LastMember) HeldBy(ctx context.Context, accountID shared.ID) ([]shared.ID, error)

func (l LastMember) Sweep(ctx context.Context, tenantID shared.ID) (int, error)

type LifecycleCommand ¶

type LifecycleCommand struct {
	ItemID shared.ID
	// ExpectedVersion is the version the caller read, from If-Match. Zero means the caller read none
	// and accepts whatever is there (api-guidelines.md §5).
	ExpectedVersion int
}

LifecycleCommand is the input every lifecycle verb takes: which entry, and the version the caller read. The same shape for all of them, because they all take exactly that.

type LifecycleWriter ¶

type LifecycleWriter struct {
	Items      repository.Items
	Containers repository.Containers
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
	// Queue is where a deletion asks for the tenant's cleanup to be scheduled.
	//
	// A deletion scheduling its own cleanup is not only convenient, it is the only shape available:
	// nothing in this system may enumerate tenants - the `tenant` table is behind row level security
	// with no bypass for the application role - so no scheduler can create one sweep job per tenant.
	// The job reschedules itself forever afterwards (queue.KindRetentionSweep); provisioning and
	// every session opened seed it too, so a deletion is not the only way a workspace gets one.
	Queue queue.Queue
}

LifecycleWriter is what every verb that moves an entry between the archive and the trash needs.

One dependency set held by all of them rather than a copy per verb. They are the same walk with a different transition in the middle - read the entry and the collection it is in, ask whether the actor may, apply the transition, write it, and record the three things a change owes - and keeping the machinery in one place is what makes "restoring records what trashing records" true by construction rather than by somebody remembering.

type ListActivity ¶

type ListActivity struct {
	History    activityrepo.History
	Items      repository.Items
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListActivity reads one entry's history, newest first.

The right to read the entry is the right to read what happened to it. There is no narrower permission and there should not be: the history says who moved a thing somebody can already see, and a separate right would be one more thing to get wrong for no protection gained (domain-model.md §3.2).

Read-only throughout, which is not a detail: the transaction may be served by a read replica (multi-tenancy.md §7), and a read that opened a write transaction would pin it to the primary.

func (h ListActivity) Descriptor() usecase.Descriptor

func (h ListActivity) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListActivityQuery,
) (activityrepo.EntryPage, error)

type ListActivityQuery ¶

type ListActivityQuery struct {
	ItemID shared.ID
	Cursor string
	Size   int
}

ListActivityQuery is the input, typed.

type ListBuckets ¶

type ListBuckets struct {
	Buckets    repository.Buckets
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListBuckets reads a collection's board.

Read-only throughout, which is not a detail: the transaction may be served by a read replica (multi-tenancy.md §7), and a read that opened a write transaction would pin every board in the product to the primary.

func (h ListBuckets) Descriptor() usecase.Descriptor

func (h ListBuckets) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListBucketsQuery,
) ([]domain.Bucket, error)

type ListBucketsQuery ¶

type ListBucketsQuery struct {
	CollectionID shared.ID
}

ListBucketsQuery is the input, typed.

type ListCalendarFeeds ¶

type ListCalendarFeeds struct{ Writer CalendarFeedWriter }

ListCalendarFeeds answers the caller's own feeds.

func (h ListCalendarFeeds) Descriptor() usecase.Descriptor

func (h ListCalendarFeeds) Execute(
	ctx context.Context, actor appshared.ActorContext,
) ([]domain.CalendarFeed, error)

type ListComments ¶

type ListComments struct {
	Comments   repository.Comments
	Items      repository.Items
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListComments reads one entry's discussion, oldest first - a conversation reads top down.

The right to read the entry is the right to read what was said about it, for the reason the history draws the same line: a separate right would be one more thing to get wrong for no protection gained (domain-model.md §3.2). Tombstones are in the page - that is what keeps a thread with deletions readable - and they travel without their body, which is already gone from the row rather than hidden by this reader.

func (h ListComments) Descriptor() usecase.Descriptor

func (h ListComments) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListCommentsQuery,
) (repository.CommentPage, error)

type ListCommentsQuery ¶

type ListCommentsQuery struct {
	ItemID shared.ID
	Cursor string
	Size   int
}

ListCommentsQuery is the input, typed.

type ListContainers ¶

type ListContainers struct {
	Containers repository.Containers
	Authorizer Authorizer
	Reader     Reader
	UnitOfWork persistence.UnitOfWork
}

ListContainers reads one level of the container tree.

func (h ListContainers) Descriptor() usecase.Descriptor

func (h ListContainers) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListContainersQuery,
) (repository.ContainerPage, error)

type ListContainersQuery ¶

type ListContainersQuery struct {
	// ParentID is the hub whose collections are wanted. Empty means the hubs, which is the one level
	// anchored to nothing.
	ParentID shared.ID
	// Type narrows the level; empty means both kinds.
	Type            domain.ContainerType
	IncludeArchived bool
	Cursor          string
	Size            int
}

ListContainersQuery is the input, typed.

type ListCustomFields ¶

type ListCustomFields struct {
	Fields     repository.CustomFields
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListCustomFields reads the definitions in force.

func (h ListCustomFields) Descriptor() usecase.Descriptor

func (h ListCustomFields) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListCustomFieldsQuery,
) ([]domain.CustomFieldDefinition, error)

type ListCustomFieldsQuery ¶

type ListCustomFieldsQuery struct {
	// CollectionID is the collection whose definitions are wanted, together with the
	// workspace-wide ones above it. Zero answers the workspace-wide ones alone.
	CollectionID shared.ID
}

ListCustomFieldsQuery is the input, typed.

type ListEmergencyNotices ¶

type ListEmergencyNotices struct {
	Accesses   repository.EmergencyAccesses
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
}

ListEmergencyNotices answers the person's own notices of the last 30 days: each time the workspace's owner opened a private hub they are a member of, from the record written when it was opened, whatever the mail about it did. It is how a person without a mailbox - a child's managed account - or one whose mail failed is told (ADR-0073 §4, identity.md §22). Not a list of notifications: one kind of notice, and nothing to mark read.

func (h ListEmergencyNotices) Descriptor() usecase.Descriptor

func (h ListEmergencyNotices) Execute(
	ctx context.Context, actor appshared.ActorContext,
) ([]domain.EmergencyAccess, error)

type ListLabels ¶

type ListLabels struct {
	Labels     repository.Labels
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListLabels reads a collection's vocabulary.

Read-only throughout: the transaction may be served by a read replica (multi-tenancy.md §7).

func (h ListLabels) Descriptor() usecase.Descriptor

func (h ListLabels) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListLabelsQuery,
) ([]domain.Label, error)

type ListLabelsQuery ¶

type ListLabelsQuery struct {
	CollectionID shared.ID
}

ListLabelsQuery is the input, typed.

type ListPrivateHubAccesses ¶

type ListPrivateHubAccesses struct {
	Accesses   repository.EmergencyAccesses
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListPrivateHubAccesses answers every emergency access to a hub, newest first - the members' record of who opened their hub, when and why (ADR-0073 §4). Whoever reads the hub reads it: its members, and the owner while their access runs; for everybody else the hub is not there.

func (h ListPrivateHubAccesses) Descriptor() usecase.Descriptor

func (h ListPrivateHubAccesses) Execute(
	ctx context.Context, actor appshared.ActorContext, hubID shared.ID,
) ([]domain.EmergencyAccess, error)

type ListPrivateHubs ¶

type ListPrivateHubs struct {
	Hubs       repository.PrivateHubs
	Policies   lifecyclerepo.Policies
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
	// Accesses, Owners and Clock answer each row's emergency access for the caller (ADR-0073
	// §4): whether they may open the hub now, and until when theirs runs. Without them every row
	// says it is not offered - the safe answer for a control that must not be drawn where the
	// server would refuse it (P-05).
	Accesses repository.EmergencyAccesses
	Owners   Permitting
	Clock    clock.Clock
}

ListPrivateHubs answers the administrators what ADR-0073 §3 lets them know of the workspace's private hubs: that they exist, whose they are, how much they hold, and when a trashed one goes - no name, no description, no content.

MANAGE_MEMBERS rather than READ_CONFIGURATION: the list is for running the workspace - a person leaving, the storage they leave behind - which is membership management, and an auditor reads how the workspace is configured, not the people's hubs.

func (h ListPrivateHubs) Descriptor() usecase.Descriptor

func (h ListPrivateHubs) Execute(ctx context.Context, actor appshared.ActorContext) ([]PrivateHubRow, error)

type ListReminders ¶

type ListReminders struct {
	Reminders  repository.Reminders
	Items      repository.Items
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListReminders reads one entry's reminders, oldest first.

The right to read the entry is the right to read what it reminds about, for the reason the discussion draws the same line: a separate right would be one more thing to get wrong for no protection gained (domain-model.md §3.2). Unpaged, because what one entry may carry is bounded where reminders are written.

func (h ListReminders) Descriptor() usecase.Descriptor

func (h ListReminders) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListRemindersQuery,
) ([]domain.Reminder, error)

type ListRemindersQuery ¶

type ListRemindersQuery struct {
	ItemID shared.ID
}

ListRemindersQuery is the input, typed.

type ListSavedViews ¶

type ListSavedViews struct {
	Views      viewrepo.SavedViews
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListSavedViews answers the views the caller may see.

func (h ListSavedViews) Descriptor() usecase.Descriptor

func (h ListSavedViews) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListSavedViewsQuery,
) ([]view.SavedView, error)

type ListSavedViewsQuery ¶

type ListSavedViewsQuery struct {
	// ContainerID widens the answer to what is shared along that container's path. Zero answers
	// the caller's own views alone.
	ContainerID shared.ID
}

ListSavedViewsQuery is the input, typed.

type ListTemplates ¶

type ListTemplates struct {
	Templates  repository.Templates
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
}

ListTemplates reads the templates reachable from a container's path.

func (h ListTemplates) Descriptor() usecase.Descriptor

func (h ListTemplates) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListTemplatesQuery,
) (repository.TemplatePage, error)

type ListTemplatesQuery ¶

type ListTemplatesQuery struct {
	ContainerID shared.ID
	Cursor      string
	Size        int
}

ListTemplatesQuery is the input, typed.

type ListTrash ¶

type ListTrash struct {
	Trash      repository.Trash
	Reader     Reader
	UnitOfWork persistence.UnitOfWork
	// Policies and TombstoneWindow are the two numbers the retention pass removes by - the trash
	// period it reads and the installation's offline window the Purger is given - so that the date
	// each entry carries is the pass's own.
	Policies        lifecyclerepo.Policies
	TombstoneWindow time.Duration
	// Holds and Contributors are what says whether a legal hold keeps a deletion: its rows are
	// judged as the retention pass judges them (lifecycle.Holds.Blocking), so `held` is the pass's
	// own answer rather than a second rule.
	Holds        lifecyclerepo.HoldList
	Contributors lifecyclerepo.ContributorReader
}

ListTrash reads what is in the trash, newest deletion first.

One entry per deletion rather than per deleted row. A hub with two hundred entries under it went in as one act and comes back as one act (I-C2), so what is listed is the root of each deletion - the thing somebody deleted - and the batch beside it is what took the rest.

Read-only throughout, which is not a detail: the transaction may be served by a read replica (multi-tenancy.md §7), and a read that opened a write transaction would pin it to the primary.

func (h ListTrash) Descriptor() usecase.Descriptor

func (h ListTrash) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListTrashQuery,
) (TrashListing, error)

type ListTrashQuery ¶

type ListTrashQuery struct {
	Cursor string
	Size   int
}

ListTrashQuery is the input, typed.

type ListWorkItems ¶

type ListWorkItems struct {
	Items      repository.Items
	ItemLabels repository.ItemLabels
	Containers repository.Containers
	Authorizer Anchored
	UnitOfWork persistence.UnitOfWork
}

ListWorkItems reads one level of one collection.

func (h ListWorkItems) Descriptor() usecase.Descriptor

func (h ListWorkItems) Execute(
	ctx context.Context, actor appshared.ActorContext, query ListWorkItemsQuery,
) (repository.ItemPage, error)

type ListWorkItemsQuery ¶

type ListWorkItemsQuery struct {
	// CollectionID is required. A list of every item in a tenant is an unindexed scan, and every
	// filter beyond one level is the query DSL's.
	CollectionID shared.ID
	// ParentID is the item whose children are wanted. Empty means the items directly in the
	// collection.
	ParentID        shared.ID
	IncludeArchived bool
	Cursor          string
	Size            int
}

ListWorkItemsQuery is the input, typed.

type MaterializationOutcome ¶

type MaterializationOutcome struct {
	// Created counts the occurrences that came into being, Considered the series the pass looked
	// at - which is what tells the handler whether its batch filled.
	Created    int
	Considered int
	// NextAt is when the tenant next owes an occurrence, and nil when it owes none for now. It is
	// the moment the horizon reaches the next occurrence, not the occurrence itself: a series with
	// a ninety-day window owes tomorrow's entry ninety days before it is due.
	NextAt *time.Time
}

MaterializationOutcome is what one pass did and what it leaves behind.

type MaterializeOccurrences ¶

type MaterializeOccurrences struct {
	Recurrences repository.Recurrences
	Items       repository.Items
	Containers  repository.Containers
	// Copy is DuplicateWorkItem, reused rather than rebuilt: an occurrence is a copy of the
	// template with its subtree, and everything that makes a copy correct - the vocabulary of the
	// destination, the references it cannot carry (I-W6), the records each entry owes - is already
	// decided there.
	Copy     DuplicateWorkItem
	Expander recurrenceport.Expander
	Events   outbox.Events
	Clock    clock.Clock
	IDs      clock.IDGenerator
	Signals  OccurrenceSignals
	// RuleBatch bounds how many series one pass looks at, OccurrenceBatch how many entries one
	// series may produce in it. A pass is one transaction, and a transaction that materialised a
	// year of everything would hold its locks for as long as that took.
	RuleBatch       int
	OccurrenceBatch int
}

MaterializeOccurrences turns the series of one tenant into the entries their rolling windows owe (arc42 §6.3).

Internal, and deliberately absent from the catalogue in domain-model.md §5 for the reason ReconcileMedia and FireReminders are absent from it: the catalogue is what a person, an agent or a rule can ask for, and "materialise everybody's series now" is not something anybody should be able to ask for. The way to influence what a series produces is the rule, and the way to skip one occurrence is SkipOccurrence.

It runs inside the transaction the job runner opened, which is what makes it exactly-once: the occurrences, their events, the watermark's compare-and-set and the job's own completion commit together. Two leaders that both wake up cannot mint the same morning twice - the second finds the watermark moved, fails the update, and rolls back the entries it wrote with it.

func (h MaterializeOccurrences) Execute(
	ctx context.Context, actor appshared.ActorContext,
) (MaterializationOutcome, error)

type MediaReferences ¶

type MediaReferences interface {
	Find(ctx context.Context, id shared.ID) (media.Object, error)
	AdjustRefCount(ctx context.Context, id shared.ID, delta int) error
}

MediaReferences is the slice of the media record store this package needs: read one object, and move its reference counter.

Narrow rather than the whole port, for the reason Visibility is narrow: a use case declaring a dependency it does not use is a use case whose test has to satisfy it anyway. The counter is the only thing this package writes about a media object - what the object is, and whether it may be used at all, is the media domain's answer (media.Object.Attachable).

type MemberCommand ¶

type MemberCommand struct {
	ItemID    shared.ID
	AccountID shared.ID
}

MemberCommand is the input of both directions, typed.

No expected version, for the reason LabelCommand spends none: a member lives beside the entry rather than on its row, so there is no version of the entry an addition would be racing. Two devices adding two different people at once is the case the OR-set exists to serve, and an optimistic lock on the entry would make one of them fail for no reason (offline-sync.md §4.2).

type MintedFeed ¶

type MintedFeed struct {
	Feed  domain.CalendarFeed
	Token domain.FeedToken
}

MintedFeed is what a minting answers: the feed as it will be listed, and the credential that will never be readable again.

type Moderation ¶

type Moderation interface {
	RoleAlong(
		ctx context.Context, actor appshared.ActorContext, path []identity.Scope,
	) (identity.Role, bool, error)
}

Moderation is the slice of the authorisation service the comment changes need beyond Authorizer: the actor's own effective role, for the rule the permission matrix cannot express - only the author or an administrator may change a comment (domain-model.md §3.5).

type MoveContainer ¶

type MoveContainer struct {
	Writer ContainerWriter
	// Revocations tells the devices of whoever read the collection through the hub it left, and
	// cannot read it where it now sits, that they lost it.
	Revocations MoveRevoker
}

MoveContainer moves a collection into another hub, and ranks it there.

A hub is refused: it sits in the tenant and in nothing else (I-C1), so there is no destination to name. Naming the hub a collection already sits in reorders it there, which is the same operation with the same event - a drag within a level and a drag between hubs are one gesture to a person.

Nothing under the collection is written. A container tree is two deep, so a collection has no containers below it whose placement would have to follow, and the items it holds reference their collection rather than a path through the hubs.

func (h MoveContainer) Descriptor() usecase.Descriptor

func (h MoveContainer) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd MoveContainerCommand,
) (domain.Container, error)

type MoveContainerCommand ¶

type MoveContainerCommand struct {
	ContainerID shared.ID
	// TargetParentID is the hub to move into. Required, and not nullable: there is no level above a
	// hub for a collection to be moved to.
	TargetParentID shared.ID
	// BeforeContainerID is the sibling to land in front of at the destination. Empty appends.
	BeforeContainerID shared.ID
	ExpectedVersion   int
}

MoveContainerCommand is the input, typed.

type MoveResult ¶

type MoveResult struct {
	Item domain.WorkItem
	// SubtreeSize is how many rows moved, the item included. The event reports it so that a client knows how
	// much of its own copy to rewrite.
	SubtreeSize int
	// DroppedReferences is what the destination collection could not resolve: the labels of the
	// vocabulary the subtree left, and the columns of the board it was on (I-W6). Empty rather than
	// nil, and empty for every move within one collection - nothing there has to be resolved again.
	//
	// The members and the custom fields join it with the use cases that own them.
	DroppedReferences []domain.DroppedReference
}

MoveResult is what a move answers with: the item, and the references a change of collection could not carry over (I-W6).

type MoveRevoker ¶

type MoveRevoker interface {
	AfterContainerMoved(ctx context.Context, from, to domain.Container) (access.Loss, error)
	Announce(ctx context.Context, tenantID shared.ID, losses ...access.Loss) error
}

MoveRevoker is the slice of access.Revocations a move needs: who may have lost the collection, and the ACCESS_REVOKED record for each of them who did.

type MoveWorkItem ¶

type MoveWorkItem struct {
	Placement PlacementWriter
}

MoveWorkItem moves an item, and its subtree with it, to a new parent or a new collection.

func (h MoveWorkItem) Descriptor() usecase.Descriptor

func (h MoveWorkItem) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd MoveWorkItemCommand,
) (MoveResult, error)

type MoveWorkItemCommand ¶

type MoveWorkItemCommand struct {
	ItemID shared.ID
	// TargetParentID is the item to move under. Meaningful only together with ParentGiven: the zero value is
	// both "the top level" and "not asked for", and those are different requests.
	TargetParentID shared.ID
	// ParentGiven says the caller named a parent, null included. Without it, a request that omitted the field
	// entirely would be read as "move to the top level" - which is how an item ends up somewhere nobody asked
	// for.
	ParentGiven bool
	// TargetCollectionID may be omitted when a parent is given: an item's collection is the one its parent is
	// in, and making a client repeat it is making it possible to contradict.
	TargetCollectionID shared.ID
	// BeforeItemID is the sibling to land in front of at the destination. Empty appends.
	BeforeItemID shared.ID
	// OrderKey is the rank a device computed itself, between the neighbours it holds, in place of
	// naming one (offline-sync.md §4.2: the position is a key between neighbours, not an integer).
	// Empty means the server computes the key from BeforeItemID. Both is a contradiction.
	OrderKey string
	// TargetBucketID is the column of the destination's board to land in, meaningful only together
	// with BucketGiven: the zero value is both "no column" and "not asked for".
	TargetBucketID  shared.ID
	BucketGiven     bool
	ExpectedVersion int
}

MoveWorkItemCommand is the input, typed.

type OccurrenceSignals ¶

type OccurrenceSignals interface {
	OccurrenceMaterialized(ctx context.Context, mode string, lagSeconds float64)
}

OccurrenceSignals is the slice of the metrics adapter the materialisation reports through (observability-reliability.md §3.2, ADR-0008's promised occurrence lag).

One measurement: how late an occurrence was created against the moment it is for. A series whose occurrences appear the morning they are due is working; one whose lag grows is a scheduler that has stopped, and the entries a person expects to find are not there.

type OpenPrivateHub ¶

type OpenPrivateHub struct {
	Accesses   repository.EmergencyAccesses
	Hubs       identityrepository.HubLocks
	Notices    EmergencyNotices
	Authorizer Authorizer
	// StepUp judges the fresh proof. Nil refuses rather than letting the act through unproven.
	StepUp     stepup.Verifier
	Audit      audit.Sink
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
}

OpenPrivateHub is the workspace owner's emergency access to a private hub (ADR-0073 §4): a fresh proof, a stated reason, one hour, not renewable - and every member of the hub told in the same transaction that opens it, so that nobody reads the hub before its members are told.

Only the workspace's owner - a person, never a service account or a rule - and only for a private hub they hold nothing in: a shared hub is theirs to read already, and one they hold a role in is open to them. A second access while one runs is refused, naming its end; one after it ended is a new act, told again. What it opens, and for whom, is the authoriser's (identity.md §22).

func (h OpenPrivateHub) Descriptor() usecase.Descriptor

func (h OpenPrivateHub) Execute(
	ctx context.Context, actor appshared.ActorContext, cmd OpenPrivateHubCommand,
) (domain.EmergencyAccess, error)

type OpenPrivateHubCommand ¶

type OpenPrivateHubCommand struct {
	HubID       shared.ID
	Reason      string
	StepUpToken string
}

OpenPrivateHubCommand is the input, typed.

type OwnHubs ¶

type OwnHubs interface {
	AuthorizeOwnPrivateHub(ctx context.Context, actor appshared.ActorContext, request access.Request) error
}

OwnHubs is the authorisation question a private hub of one's own asks instead of STRUCTURE (ADR-0073 §2).

type OwnersNotice ¶

type OwnersNotice interface {
	PrivateHubTrashed(ctx context.Context, tenantID shared.ID, recipients []shared.ID) error
}

OwnersNotice tells the workspace's owners that a private hub went to the trash, naming nothing - the notification context's recorder.

type Ownership ¶

type Ownership interface {
	WritesOnlyWhatIsAssigned(
		ctx context.Context, actor appshared.ActorContext, path []identity.Scope,
	) (bool, error)
}

Ownership is the slice of the authorisation service the create path needs beyond Authorizer: whether the role the actor holds writes only what is assigned to them.

Its own interface rather than a method on Authorizer, for the reason that split Visibility off: a use case declaring a dependency it does not use is a use case whose test has to satisfy it anyway, and creation is the only write that has to know this.

type Permitting ¶

type Permitting interface {
	Permits(ctx context.Context, actor appshared.ActorContext, request access.Request) (bool, error)
}

Permitting is the slice of the authorisation service the view reads need beyond Authorizer: the same question, answered without an audited refusal - a view the actor may not see is not found, and a DENIED entry for every invisible bookmark would make the trail unreadable (T-04).

type PlacementWriter ¶

type PlacementWriter struct {
	Items      repository.Items
	Buckets    repository.Buckets
	Containers repository.Containers
	Profiles   metarepo.CapabilityProfiles
	Authorizer Authorizer
	Events     outbox.Events
	Changes    changelog.ChangeLog
	Audit      audit.Sink
	Activity   ActivityJournal
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

PlacementWriter is what moving and reordering share.

One dependency set held by both use cases, on the reasoning that keeps them one event type: a reorder is a move that keeps its parent. What differs is how much has to be rewritten, and that is one branch rather than two implementations.

type PrivacyRevocations ¶

type PrivacyRevocations interface {
	AfterHubMadePrivate(ctx context.Context, hub domain.Container) (access.Loss, error)
	Announce(ctx context.Context, tenantID shared.ID, losses ...access.Loss) error
}

PrivacyRevocations is the slice of access.Revocations a hub turning private needs: who held it through the workspace, and the record telling their devices (offline-sync.md §6).

type PrivateHubRow ¶

type PrivateHubRow struct {
	repository.PrivateHubSummary
	// PurgeOn is the day a trashed hub goes for good, by the workspace's trash period.
	PurgeOn string
	// EmergencyOffered is whether the caller may open the hub through the emergency access now:
	// the workspace's owner, a person, holding nothing in it, with no access of theirs running -
	// the full condition OpenPrivateHub asks, so the control is absent wherever it would refuse.
	EmergencyOffered bool
	// OpenUntil is the end of the caller's running access, nil where none runs.
	OpenUntil *time.Time
}

PrivateHubRow is one row of the answer.

type PrivateHubsRule ¶

type PrivateHubsRule interface {
	PrivateHubsAllowed(ctx context.Context, tenantID shared.ID) (bool, error)
}

PrivateHubsRule answers whether the workspace allows new private hubs now: *Private hubs allowed* at the workspace, the plan and the installation, resolved (ADR-0073 §6).

type QueryItems ¶

type QueryItems struct {
	Items      repository.Items
	ItemLabels repository.ItemLabels
	Containers repository.Containers
	Authorizer Authorizer
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
}

QueryItems answers the query language: one filter over one anchored scope, sorted, paged, and optionally grouped into the columns a board draws (api-guidelines.md §3).

It lives in this package rather than in a `view` one of its own, although the catalogue groups it with the saved views. What it reads is work items, and it answers them through this package's projection, its authorisation path, its page size and its label expansion - four things a second package would have to import or copy. `view` is for SavedView, which stores a query rather than running one; the *grammar* is already in core/domain/model/view, where project-structure.md §1 puts it.

func (h QueryItems) Descriptor() usecase.Descriptor

func (h QueryItems) Execute(
	ctx context.Context, actor appshared.ActorContext, spec view.Spec,
) (repository.ItemQueryResult, error)

type QueryMeaning ¶

type QueryMeaning interface {
	// Of embeds the query and names the model that did. An empty vector and a nil error is
	// "search lexically", which is the answer for every reason a provider might not be reachable
	// - a search must not fail because somebody else's machine is slow. The model travels because
	// the vector is compared only with rows of the same model.
	Of(ctx context.Context, actor appshared.ActorContext, words string) (vector []float32, model string, err error)
}

QueryMeaning turns what somebody typed into a vector, or says it cannot.

A seam of its own rather than the provider, because the interesting part is not the call but the *policy around it*: whether this installation has a store at all, whether the workspace has consented, and what to do when the provider is slow. All of that is decided in one place, and what this use case receives is a vector or nothing.

type ReadCalendarFeed ¶

type ReadCalendarFeed struct {
	Feeds    feedrepo.CalendarFeeds
	Accounts identityrepo.Accounts
	// Export is the selection the view export performs, without its audit entry: the same rows,
	// the same cap, the same visibility question. Shared rather than reimplemented, so a feed and
	// an export of one view can never disagree about what is in it.
	Export     ExportView
	UnitOfWork persistence.UnitOfWork
}

ReadCalendarFeed answers what one subscription contains.

It is not a use case and is deliberately not in the catalogue, for MediaContent's reason: a catalogue entry is something a person, an agent or a rule may ask for, and this is a route answering a credential nobody in the system holds. What it shares with a use case is the rule that matters - the tenant comes from the credential and from nowhere else (multi-tenancy.md §2.2) - and the rule that matters more: every permission question is asked here, in the application layer, and the adapter only ever parses a string (ADR-0005).

The feed reads as its **owner**, evaluated now rather than when the token was minted. An owner who has lost access to half the view sees the feed narrow with them, a disabled account's feed stops answering, and a revoked membership is not survived by a token that remembers better days.

func (h ReadCalendarFeed) Execute(
	ctx context.Context, token domain.FeedToken,
) (ExportedView, error)

type Reader ¶

type Reader interface {
	Permitted(
		ctx context.Context, actor appshared.ActorContext, request access.Request,
		paths [][]identity.Scope,
	) ([]bool, error)
}

Reader is the slice of the authorisation service the read side needs beyond Authorizer: the same question asked of a whole page at once.

Two interfaces rather than one with two methods, because the two reads need different halves - a single Get asks about one path, and only the unanchored list needs the plural form. A use case declaring a dependency it does not use is a use case whose test has to satisfy it anyway.

type RebuildOutcome ¶

type RebuildOutcome struct {
	// Rewritten is how many rows this pass rewrote.
	Rewritten int64
	// Remaining is how many were still stale after it, which is what the job reports as progress.
	Remaining int64
}

RebuildOutcome is what one pass did.

type RebuildSearchIndex ¶

type RebuildSearchIndex struct {
	Index      repository.SearchIndex
	UnitOfWork persistence.UnitOfWork
	// BatchSize bounds one pass. Zero takes the default below.
	BatchSize int
}

RebuildSearchIndex is the pass behind the job: one batch of stale rows rewritten in its own transaction, and a decision about whether to come straight back.

Not a use case and not in the catalogue: nobody asks for a batch, they ask for the index to be current (ReindexSearch). The shape is the embedding pass's - a batch, then the outcome says whether there is more - with no provider anywhere near it: the rewrite is one statement over rows this PostgreSQL holds.

func (h RebuildSearchIndex) Execute(
	ctx context.Context, actor appshared.ActorContext,
) (RebuildOutcome, error)

type RecurrenceWriter ¶

type RecurrenceWriter struct {
	Recurrences repository.Recurrences
	Items       repository.Items
	Containers  repository.Containers
	Profiles    metarepo.CapabilityProfiles
	Authorizer  Authorizer
	// Expander is the library behind ADR-0008's decision, as a port: it is what turns "is this a
	// rule, and is it a sane one" from an opinion into an answer, and it is asked before anything
	// is stored rather than by the scheduler afterwards (T-17, R-07).
	Expander recurrenceport.Expander
	Changes  changelog.ChangeLog
	Audit    audit.Sink
	Activity ActivityJournal
	// Jobs is where the series asks to be materialised. The write that made something owed seeds
	// it, because nothing may enumerate tenants (multi-tenancy.md §2.1) - the same shape the
	// reminder's wake-up has.
	Jobs       queue.Queue
	UnitOfWork persistence.UnitOfWork
	Clock      clock.Clock
	IDs        clock.IDGenerator
	HLC        clock.HLCSource
}

RecurrenceWriter is what both directions of a series need: the same reads, the same permission question, the same records - and the port that decides whether the text is a rule at all.

type ReindexAccepted ¶

type ReindexAccepted struct {
	JobID shared.ID
	Stale int64
}

ReindexAccepted is what a 202 hands back: the job to watch, and how many rows it will rewrite.

type ReindexSearch ¶