sqlc

package
v0.9.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AcceptInvitationParams 

type AcceptInvitationParams struct {
	Now pgtype.Timestamptz
	ID  pgtype.UUID
}

type AccessToken 

type AccessToken struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	AccountID   pgtype.UUID
	Name        string
	TokenHash   []byte
	TokenPrefix string
	Scopes      []string
	ExpiresAt   pgtype.Timestamptz
	LastUsedAt  pgtype.Timestamptz
	RevokedAt   pgtype.Timestamptz
	CreatedAt   pgtype.Timestamptz
}

type AccessTokensForAccountRow 

type AccessTokensForAccountRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	AccountID  pgtype.UUID
	Name       string
	Scopes     []string
	ExpiresAt  pgtype.Timestamptz
	LastUsedAt pgtype.Timestamptz
	RevokedAt  pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
}

type Account 

type Account struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	DisplayName           string
	ExternalSubject       *string
	PasswordHash          *string
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Status                AccountStatus
	AiConsent             bool
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	Version               int32
	RedemptionTokenHash   []byte
	RedemptionExpiresAt   pgtype.Timestamptz
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
	PasswordSetAt         pgtype.Timestamptz
	SignInName            *string
	StartPasswordAt       pgtype.Timestamptz
	TermsUrl              *string
	TermsVersion          *string
	TermsAgreedAt         pgtype.Timestamptz
	AvatarMediaID         pgtype.UUID
}

type AccountGroup 

type AccountGroup struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	Name        string
	Description *string
	CreatedAt   pgtype.Timestamptz
	Version     int32
}

type AccountGroupMember 

type AccountGroupMember struct {
	TenantID  pgtype.UUID
	GroupID   pgtype.UUID
	AccountID pgtype.UUID
}

type AccountIdentitiesRow 

type AccountIdentitiesRow struct {
	ProviderID pgtype.UUID
	LinkedAt   pgtype.Timestamptz
}

type AccountIdentity 

type AccountIdentity struct {
	TenantID   pgtype.UUID
	AccountID  pgtype.UUID
	ProviderID pgtype.UUID
	Subject    string
	LinkedAt   pgtype.Timestamptz
}

type AccountKind 

type AccountKind string
const (
	AccountKindUSER           AccountKind = "USER"
	AccountKindSERVICEACCOUNT AccountKind = "SERVICE_ACCOUNT"
)

func (*AccountKind) Scan 

func (e *AccountKind) Scan(src interface{}) error

type AccountMfa 

type AccountMfa struct {
	AccountID              pgtype.UUID
	TenantID               pgtype.UUID
	SecretEnc              []byte
	SecretKeyID            string
	ConfirmedAt            pgtype.Timestamptz
	LastStep               *int64
	CreatedAt              pgtype.Timestamptz
	UpdatedAt              pgtype.Timestamptz
	ReplacementSecretEnc   []byte
	ReplacementSecretKeyID *string
	ReplacementSessionID   pgtype.UUID
	ReplacementExpiresAt   pgtype.Timestamptz
}

type AccountPasswordHistory 

type AccountPasswordHistory struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	PasswordHash string
	SetAt        pgtype.Timestamptz
}

type AccountRecoveryCode 

type AccountRecoveryCode struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	CodeHash  []byte
	UsedAt    pgtype.Timestamptz
	CreatedAt pgtype.Timestamptz
}

type AccountStatus 

type AccountStatus string
const (
	AccountStatusACTIVE     AccountStatus = "ACTIVE"
	AccountStatusINVITED    AccountStatus = "INVITED"
	AccountStatusDISABLED   AccountStatus = "DISABLED"
	AccountStatusRESTRICTED AccountStatus = "RESTRICTED"
	AccountStatusANONYMIZED AccountStatus = "ANONYMIZED"
)

func (*AccountStatus) Scan 

func (e *AccountStatus) Scan(src interface{}) error

type AccountsOfKindRow 

type AccountsOfKindRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	SignInName            *string
	DisplayName           string
	Status                AccountStatus
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
}

type ActivateFirstOwnerParams 

type ActivateFirstOwnerParams struct {
	PasswordHash *string
	Now          pgtype.Timestamptz
	ID           pgtype.UUID
}

type ActiveLegalHoldsRow 

type ActiveLegalHoldsRow struct {
	ID        pgtype.UUID
	ScopeKind string
	ScopeID   pgtype.UUID
	Reason    string
	PlacedAt  pgtype.Timestamptz
}

type ActivityEntry 

type ActivityEntry struct {
	ID            pgtype.UUID
	TenantID      pgtype.UUID
	ItemID        pgtype.UUID
	ContainerID   pgtype.UUID
	ActorType     string
	ActorID       pgtype.UUID
	Verb          string
	ChangeSet     []byte
	OccurredAt    pgtype.Timestamptz
	CorrelationID pgtype.UUID
	CausationID   pgtype.UUID
}

type AddGroupMemberParams 

type AddGroupMemberParams struct {
	GroupID   pgtype.UUID
	AccountID pgtype.UUID
}

type AddItemLabelParams 

type AddItemLabelParams struct {
	ItemID  pgtype.UUID
	LabelID pgtype.UUID
}

type AddItemMemberParams 

type AddItemMemberParams struct {
	ItemID    pgtype.UUID
	AccountID pgtype.UUID
}

type AddUsageParams 

type AddUsageParams struct {
	Period pgtype.Date
	Metric string
	Amount int64
}

type AdjustMediaRefCountParams 

type AdjustMediaRefCountParams struct {
	Delta int32
	ID    pgtype.UUID
}

type AdminTenantsRow 

type AdminTenantsRow struct {
	ID                      pgtype.UUID
	Slug                    string
	DisplayName             string
	Status                  string
	DefaultLocale           string
	DefaultTimeZone         string
	CreatedAt               pgtype.Timestamptz
	PurgeAfter              pgtype.Timestamptz
	PasswordOpenedUntil     pgtype.Timestamptz
	PasswordOpenedRequester string
	PasswordOpenedReason    string
	LegalHold               bool
	PurgeStartedAt          pgtype.Timestamptz
	PlanName                string
	Version                 int32
}

type AdminUsageParams 

type AdminUsageParams struct {
	FromDay     pgtype.Date
	ToDay       pgtype.Date
	WantMetric  *string
	WantTenant  pgtype.UUID
	AfterTenant pgtype.UUID
	PageSize    int32
}

type AdminUsageRow 

type AdminUsageRow struct {
	TenantID   pgtype.UUID
	Period     pgtype.Date
	Metric     string
	Value      int64
	Closing    int64
	HasClosing bool
	Purged     bool
}

type AdministratorsAlongPathParams 

type AdministratorsAlongPathParams struct {
	Roles    []string
	ScopeIds []pgtype.UUID
}

type AdvanceInstanceLevelVersionParams 

type AdvanceInstanceLevelVersionParams struct {
	UpdatedBy pgtype.UUID
	UpdatedAt pgtype.Timestamptz
	Expected  *int64
}

type AdvanceRecurrenceWatermarkParams 

type AdvanceRecurrenceWatermarkParams struct {
	MaterializedAt pgtype.Timestamptz
	ID             pgtype.UUID
	Expected       pgtype.Timestamptz
}

type AiObjectionNotice 

type AiObjectionNotice struct {
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	NoticedAt pgtype.Timestamptz
}

type AiProvider 

type AiProvider struct {
	TenantID          pgtype.UUID
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	ApiKeyEnc         []byte
	ApiKeyKeyID       *string
	Jurisdiction      string
	ProcessingAllowed bool
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	Version           int32
	ID                pgtype.UUID
	DisplayName       string
	Processor         string
}

type AiRequest 

type AiRequest struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AskedBy   pgtype.UUID
	Text      string
	CreatedAt pgtype.Timestamptz
}

type AiSource 

type AiSource struct {
	TenantID          pgtype.UUID
	Source            string
	OfferedProviderID pgtype.UUID
	UpdatedAt         pgtype.Timestamptz
	Version           int32
}

type AiSuggestion 

type AiSuggestion struct {
	ID            pgtype.UUID
	TenantID      pgtype.UUID
	TargetType    string
	TargetID      pgtype.UUID
	Kind          string
	Status        string
	Payload       []byte
	Source        string
	Model         string
	PromptID      string
	PromptVersion string
	ProducedAt    pgtype.Timestamptz
	InputDigest   []byte
	CreatedAt     pgtype.Timestamptz
	DecidedAt     pgtype.Timestamptz
	DecidedBy     pgtype.UUID
	Version       int32
	DroppedNodes  int32
}

type AnonymiseAccountParams 

type AnonymiseAccountParams struct {
	Marker    string
	UpdatedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type AppendOutboxEventParams 

type AppendOutboxEventParams struct {
	ID             pgtype.UUID
	EventType      string
	Subject        *string
	Payload        []byte
	ActorType      string
	ActorID        pgtype.UUID
	CorrelationID  pgtype.UUID
	CausationID    pgtype.UUID
	CausationDepth int32
	OccurredAt     pgtype.Timestamptz
	Replay         bool
	ReceivedAt     pgtype.Timestamptz
	PushID         pgtype.UUID
}

type AppendPasswordHistoryParams 

type AppendPasswordHistoryParams struct {
	ID           pgtype.UUID
	AccountID    pgtype.UUID
	PasswordHash string
	SetAt        pgtype.Timestamptz
}

type ArchiveItemsForRetentionParams 

type ArchiveItemsForRetentionParams struct {
	At  pgtype.Timestamptz
	Ids []pgtype.UUID
}

type AuditAnchor 

type AuditAnchor struct {
	TenantID    pgtype.UUID
	AnchoredAt  pgtype.Timestamptz
	LastSeq     int64
	ChainHash   []byte
	Destination *string
	Receipt     *string
}

type AuditLog 

type AuditLog struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Seq          int64
	OccurredAt   pgtype.Timestamptz
	Action       string
	Outcome      string
	Severity     string
	ActorType    string
	ActorID      pgtype.UUID
	ActorLabel   *string
	OnBehalfOfID pgtype.UUID
	TargetType   *string
	TargetID     pgtype.UUID
	TargetLabel  *string
	Context      []byte
	Changes      []byte
	LegalBasis   *string
	PrevHash     []byte
	Hash         []byte
}

type AuditLog202608 

type AuditLog202608 struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Seq          int64
	OccurredAt   pgtype.Timestamptz
	Action       string
	Outcome      string
	Severity     string
	ActorType    string
	ActorID      pgtype.UUID
	ActorLabel   *string
	OnBehalfOfID pgtype.UUID
	TargetType   *string
	TargetID     pgtype.UUID
	TargetLabel  *string
	Context      []byte
	Changes      []byte
	LegalBasis   *string
	PrevHash     []byte
	Hash         []byte
}

type AuditLogDefault 

type AuditLogDefault struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Seq          int64
	OccurredAt   pgtype.Timestamptz
	Action       string
	Outcome      string
	Severity     string
	ActorType    string
	ActorID      pgtype.UUID
	ActorLabel   *string
	OnBehalfOfID pgtype.UUID
	TargetType   *string
	TargetID     pgtype.UUID
	TargetLabel  *string
	Context      []byte
	Changes      []byte
	LegalBasis   *string
	PrevHash     []byte
	Hash         []byte
}

type AuditPseudonym 

type AuditPseudonym struct {
	TenantID  pgtype.UUID
	ActorID   pgtype.UUID
	Pseudonym string
	Reason    string
	CreatedAt pgtype.Timestamptz
}

type AuditPseudonymsRow 

type AuditPseudonymsRow struct {
	ActorID   pgtype.UUID
	Pseudonym string
}

type AuthAttempt 

type AuthAttempt struct {
	TenantID      pgtype.UUID
	SubjectHash   []byte
	Failures      int32
	LastFailureAt pgtype.Timestamptz
	LockedUntil   pgtype.Timestamptz
}

type AuthPending 

type AuthPending struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	AccountID          pgtype.UUID
	TokenHash          []byte
	Purpose            string
	UserAgent          *string
	IpClass            *string
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	ConsumedAt         pgtype.Timestamptz
	LinkProviderID     pgtype.UUID
	LinkSubject        *string
	LinkProof          *string
	PasswordChangeOwed bool
	Address            *string
	SignedInWith       *string
	SessionMethod      *string
	SessionVia         pgtype.UUID
	ArrivalEmail       *string
	ArrivalDisplayName *string
	ArrivalDirectory   *string
	SessionID          pgtype.UUID
	UserHandle         []byte
}

type AutoAssignPolicy 

type AutoAssignPolicy struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ScopeType  string
	ScopeID    pgtype.UUID
	Strategy   string
	Candidates []byte
	State      []byte
	Enabled    bool
	Version    int32
}

type AutomationRule 

type AutomationRule struct {
	ID                pgtype.UUID
	TenantID          pgtype.UUID
	ScopeType         string
	ScopeID           pgtype.UUID
	Name              string
	Enabled           bool
	RunAs             pgtype.UUID
	Trigger           []byte
	Conditions        []byte
	Actions           []byte
	Throttle          []byte
	OnError           string
	FailureCount      int32
	CreatedBy         pgtype.UUID
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	DeletedAt         pgtype.Timestamptz
	Version           int32
	NextRunAt         pgtype.Timestamptz
	InboundTokenHash  []byte
	InboundRotatedAt  pgtype.Timestamptz
	Findings          []byte
	CheckedAt         pgtype.Timestamptz
	PausedForDeletion bool
}

type AutomationRulesSealedNotUnderRow 

type AutomationRulesSealedNotUnderRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type BackupRun 

type BackupRun struct {
	ID          pgtype.UUID
	ScheduleID  pgtype.UUID
	TargetID    pgtype.UUID
	TenantID    pgtype.UUID
	ParentRunID pgtype.UUID
	Trigger     string
	Mode        string
	Status      string
	ArchivePath *string
	Manifest    []byte
	SizeBytes   *int64
	ItemCount   *int32
	MediaCount  *int32
	Checksum    *string
	SnapshotAt  pgtype.Timestamptz
	StartedAt   pgtype.Timestamptz
	FinishedAt  pgtype.Timestamptz
	ErrorCode   *string
	ExpiresAt   pgtype.Timestamptz
	VerifiedAt  pgtype.Timestamptz
	VerifyOk    *bool
	TrialReport []byte
	TrialAt     pgtype.Timestamptz
}

type BackupSchedule 

type BackupSchedule struct {
	ID           pgtype.UUID
	TargetID     pgtype.UUID
	TenantID     pgtype.UUID
	ScopeKind    string
	ScopeID      pgtype.UUID
	Rrule        string
	TimeZone     string
	Mode         string
	FullRrule    *string
	IncludeMedia bool
	IncludeAudit bool
	Retention    []byte
	NotifyOn     []string
	Enabled      bool
	NextRunAt    pgtype.Timestamptz
	CreatedAt    pgtype.Timestamptz
	Version      int32
	TrialRestore bool
}

type BackupTarget 

type BackupTarget struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Name            string
	Kind            string
	Config          []byte
	CredentialEnc   []byte
	CredentialKeyID *string
	EncryptionMode  string
	EncryptionKeyID *string
	RegionNote      *string
	InsecureAckBy   pgtype.UUID
	InsecureAckAt   pgtype.Timestamptz
	Enabled         bool
	LastTestAt      pgtype.Timestamptz
	LastTestOk      *bool
	LastTestError   *string
	CreatedAt       pgtype.Timestamptz
	CreatedBy       pgtype.UUID
	Version         int32
}

type BackupTargetCredentialsNotUnderRow 

type BackupTargetCredentialsNotUnderRow struct {
	ID              pgtype.UUID
	CredentialEnc   []byte
	CredentialKeyID *string
}

type BlockErasureKeptParams 

type BlockErasureKeptParams struct {
	BlockedCode   *string
	BlockedParams []byte
	RequestID     pgtype.UUID
}

type BlockItemsForRetentionParams 

type BlockItemsForRetentionParams struct {
	RuleID    pgtype.UUID
	Action    *string
	BlockedBy *string
	Ids       []pgtype.UUID
}

type Bucket 

type Bucket struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Name         string
	OrderKey     string
	WipLimit     *int32
	IsDoneBucket bool
	ColorToken   *string
	DeletedAt    pgtype.Timestamptz
	Version      int32
}

type BucketOrderKeyNeighboursParams 

type BucketOrderKeyNeighboursParams struct {
	CollectionID pgtype.UUID
	MovingID     pgtype.UUID
	BeforeID     pgtype.UUID
}

type BucketOrderKeyNeighboursRow 

type BucketOrderKeyNeighboursRow struct {
	NextKey     string
	PreviousKey string
}

type BumpRuleFailureParams 

type BumpRuleFailureParams struct {
	At pgtype.Timestamptz
	ID pgtype.UUID
}

type BurnRecoveryCodeParams 

type BurnRecoveryCodeParams struct {
	Now       pgtype.Timestamptz
	AccountID pgtype.UUID
	CodeHash  []byte
}

type CalendarFeed 

type CalendarFeed struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	ViewID    pgtype.UUID
	TokenHash []byte
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type CallJobsSealedNotUnderRow 

type CallJobsSealedNotUnderRow struct {
	ID      pgtype.UUID
	Payload []byte
}

type CancelJobParams 

type CancelJobParams struct {
	Now      pgtype.Timestamptz
	ID       pgtype.UUID
	TenantID pgtype.UUID
}

type CancelJobRow 

type CancelJobRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	State      string
	LastError  *string
	CreatedAt  pgtype.Timestamptz
	FinishedAt pgtype.Timestamptz
}

type CarryOverRetentionPolicyParams 

type CarryOverRetentionPolicyParams struct {
	ID       pgtype.UUID
	Now      pgtype.Timestamptz
	DataKind string
}

type ChangeLog 

type ChangeLog struct {
	TenantID    pgtype.UUID
	Seq         int64
	Entity      string
	EntityID    pgtype.UUID
	Op          string
	ContainerID pgtype.UUID
	ActorID     pgtype.UUID
	DeviceID    pgtype.UUID
	Hlc         string
	OccurredAt  pgtype.Timestamptz
	Payload     []byte
}

type ChangeLog202608 

type ChangeLog202608 struct {
	TenantID    pgtype.UUID
	Seq         int64
	Entity      string
	EntityID    pgtype.UUID
	Op          string
	ContainerID pgtype.UUID
	ActorID     pgtype.UUID
	DeviceID    pgtype.UUID
	Hlc         string
	OccurredAt  pgtype.Timestamptz
	Payload     []byte
}

type ChangeLogDefault 

type ChangeLogDefault struct {
	TenantID    pgtype.UUID
	Seq         int64
	Entity      string
	EntityID    pgtype.UUID
	Op          string
	ContainerID pgtype.UUID
	ActorID     pgtype.UUID
	DeviceID    pgtype.UUID
	Hlc         string
	OccurredAt  pgtype.Timestamptz
	Payload     []byte
}

type ChildCompletionRow 

type ChildCompletionRow struct {
	Total     int32
	Completed int32
}

type ClaimDueRuleOccurrencesParams 

type ClaimDueRuleOccurrencesParams struct {
	Due      pgtype.Timestamptz
	PageSize int32
}

type ClaimDueRuleOccurrencesRow 

type ClaimDueRuleOccurrencesRow struct {
	ID     pgtype.UUID
	RuleID pgtype.UUID
	ItemID pgtype.UUID
	FireAt pgtype.Timestamptz
}

type ClaimDueSoonItemsParams 

type ClaimDueSoonItemsParams struct {
	Now       pgtype.Timestamptz
	Threshold pgtype.Timestamptz
	BatchSize int32
}

type ClaimDueSoonItemsRow 

type ClaimDueSoonItemsRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	DueAt        pgtype.Timestamptz
	DueDateOnly  bool
	DueTimeZone  *string
}

type ClaimEventConsumptionParams 

type ClaimEventConsumptionParams struct {
	Consumer   string
	EventID    pgtype.UUID
	ConsumedAt pgtype.Timestamptz
}

type ClaimImportRunParams 

type ClaimImportRunParams struct {
	StartedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type ClaimJobsParams 

type ClaimJobsParams struct {
	LockedUntil pgtype.Timestamptz
	Now         pgtype.Timestamptz
	BatchSize   int32
}

type ClaimJobsRow 

type ClaimJobsRow struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	Kind        string
	Payload     []byte
	Attempts    int32
	MaxAttempts int32
	LockedUntil pgtype.Timestamptz
}

type ClaimOverdueItemsParams 

type ClaimOverdueItemsParams struct {
	Now       pgtype.Timestamptz
	BatchSize int32
}

type ClaimOverdueItemsRow 

type ClaimOverdueItemsRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	DueAt        pgtype.Timestamptz
	DueDateOnly  bool
	DueTimeZone  *string
}

type ClaimPendingEventsRow 

type ClaimPendingEventsRow struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	EventType      string
	Subject        *string
	Payload        []byte
	ActorType      string
	ActorID        pgtype.UUID
	CorrelationID  pgtype.UUID
	CausationID    pgtype.UUID
	CausationDepth int32
	OccurredAt     pgtype.Timestamptz
	Replay         bool
	ReceivedAt     pgtype.Timestamptz
	PushID         pgtype.UUID
}

type ClaimRestoreRunParams 

type ClaimRestoreRunParams struct {
	StartedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type ClaimRulesToMaterializeParams 

type ClaimRulesToMaterializeParams struct {
	Now       pgtype.Timestamptz
	BatchSize int32
}

type ClaimRulesToMaterializeRow 

type ClaimRulesToMaterializeRow struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	SourceItemID       pgtype.UUID
	Rrule              string
	TimeZone           string
	Mode               string
	HorizonDays        int32
	EndsAt             pgtype.Timestamptz
	MaxCount           *int32
	LastMaterializedAt pgtype.Timestamptz
	CreatedAt          pgtype.Timestamptz
	UpdatedAt          pgtype.Timestamptz
	Version            int32
}

type ClaimSetupCodeParams 

type ClaimSetupCodeParams struct {
	CodeHash []byte
	Now      pgtype.Timestamptz
}

type ClearAssignmentsOnParams 

type ClearAssignmentsOnParams struct {
	UpdatedAt pgtype.Timestamptz
	AccountID pgtype.UUID
	Ids       []pgtype.UUID
}

type ClearForeignSubtreeBucketsParams 

type ClearForeignSubtreeBucketsParams struct {
	PathPrefix   string
	CollectionID pgtype.UUID
}

type ClearForeignSubtreeBucketsRow 

type ClearForeignSubtreeBucketsRow struct {
	ID       pgtype.UUID
	BucketID pgtype.UUID
}

type ClearForeignSubtreeLabelsParams 

type ClearForeignSubtreeLabelsParams struct {
	PathPrefix   string
	CollectionID pgtype.UUID
}

type ClearForeignSubtreeLabelsRow 

type ClearForeignSubtreeLabelsRow struct {
	ItemID  pgtype.UUID
	LabelID pgtype.UUID
}

type ClearInstallationDefaultParams 

type ClearInstallationDefaultParams struct {
	Now       pgtype.Timestamptz
	UpdatedBy pgtype.UUID
	ExceptID  pgtype.UUID
}

type ClearItemRetentionParams 

type ClearItemRetentionParams struct {
	KeepRule bool
	Now      pgtype.Timestamptz
	Ids      []pgtype.UUID
}

type ClearRetentionCursorParams 

type ClearRetentionCursorParams struct {
	Reader   string
	DataKind *string
	RuleID   pgtype.UUID
}

type ClearRetentionMarksOfRuleParams 

type ClearRetentionMarksOfRuleParams struct {
	Now    pgtype.Timestamptz
	RuleID pgtype.UUID
}

type ClearRuleFailureParams 

type ClearRuleFailureParams struct {
	At pgtype.Timestamptz
	ID pgtype.UUID
}

type CloseTenantPasswordParams 

type CloseTenantPasswordParams struct {
	Now pgtype.Timestamptz
	Due pgtype.Timestamptz
}

type CollectionEntryShapesParams 

type CollectionEntryShapesParams struct {
	CollectionIds []pgtype.UUID
	MaxRows       int32
}

type CollectionEntryShapesRow 

type CollectionEntryShapesRow struct {
	ID              pgtype.UUID
	CollectionID    pgtype.UUID
	Type            ItemType
	Path            string
	HasDueDate      bool
	HasAssignment   bool
	HasBucket       bool
	HasNotes        bool
	HasCover        bool
	HasAmount       bool
	HasRecurrence   bool
	HasCustomFields bool
	HasLabels       bool
	HasMembers      bool
	HasComments     bool
	HasAttachments  bool
	HasReminder     bool
}

type Comment 

type Comment struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	ItemID          pgtype.UUID
	AuthorID        pgtype.UUID
	ParentCommentID pgtype.UUID
	Body            string
	CreatedAt       pgtype.Timestamptz
	EditedAt        pgtype.Timestamptz
	DeletedAt       pgtype.Timestamptz
	Version         int32
	Kind            string
	SystemCode      *string
	SystemParams    []byte
}

type CompleteIdempotencyRecordParams 

type CompleteIdempotencyRecordParams struct {
	Key          string
	Endpoint     string
	ResponseCode *int32
	ResponseBody []byte
}

type CompleteJobParams 

type CompleteJobParams struct {
	Now     pgtype.Timestamptz
	Outcome *string
	ID      pgtype.UUID
	Lease   pgtype.Timestamptz
}

type CompleteReappliedErasureParams 

type CompleteReappliedErasureParams struct {
	ErasureMode      *string
	CompletedAt      pgtype.Timestamptz
	SubjectAccountID pgtype.UUID
	ID               pgtype.UUID
}

type ConfirmAccountAddressParams 

type ConfirmAccountAddressParams struct {
	Address   *string
	At        pgtype.Timestamptz
	AccountID pgtype.UUID
}

type ConfirmMfaEnrollmentParams 

type ConfirmMfaEnrollmentParams struct {
	Now       pgtype.Timestamptz
	Step      *int64
	AccountID pgtype.UUID
}

type ConsentRecord 

type ConsentRecord struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	Purpose   string
	Granted   bool
	GrantedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
	Source    *string
}

type ConsumeConnectOidcFlowParams 

type ConsumeConnectOidcFlowParams struct {
	Now       pgtype.Timestamptz
	StateHash []byte
	SessionID pgtype.UUID
}

type ConsumeConnectOidcFlowRow 

type ConsumeConnectOidcFlowRow struct {
	ID           pgtype.UUID
	ProviderID   pgtype.UUID
	CodeVerifier string
	Nonce        string
	SessionID    pgtype.UUID
	CreatedAt    pgtype.Timestamptz
}

type ConsumeOauthCodeParams 

type ConsumeOauthCodeParams struct {
	Now      pgtype.Timestamptz
	CodeHash []byte
}

type ConsumeOauthCodeRow 

type ConsumeOauthCodeRow struct {
	ID            pgtype.UUID
	ClientID      pgtype.UUID
	AccountID     pgtype.UUID
	GrantID       pgtype.UUID
	CodeChallenge string
	RedirectUri   string
}

type ConsumeOidcFlowParams 

type ConsumeOidcFlowParams struct {
	Now       pgtype.Timestamptz
	StateHash []byte
}

type ConsumeOidcFlowRow 

type ConsumeOidcFlowRow struct {
	ID               pgtype.UUID
	ProviderID       pgtype.UUID
	CodeVerifier     string
	Nonce            string
	InvitedAccountID pgtype.UUID
	PendingID        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	TermsUrl         *string
	TermsVersion     *string
}

type ConsumePasskeyChallengeParams 

type ConsumePasskeyChallengeParams struct {
	Now       pgtype.Timestamptz
	TokenHash []byte
	SessionID pgtype.UUID
	AccountID pgtype.UUID
}

type ConsumePasskeyChallengeRow 

type ConsumePasskeyChallengeRow struct {
	ID         pgtype.UUID
	AccountID  pgtype.UUID
	SessionID  pgtype.UUID
	UserHandle []byte
	CreatedAt  pgtype.Timestamptz
	ExpiresAt  pgtype.Timestamptz
}

type ConsumePasskeyProofChallengeParams 

type ConsumePasskeyProofChallengeParams struct {
	Now       pgtype.Timestamptz
	TokenHash []byte
	Purpose   string
	AccountID pgtype.UUID
	SessionID pgtype.UUID
}

type ConsumePasskeyProofChallengeRow 

type ConsumePasskeyProofChallengeRow struct {
	ID         pgtype.UUID
	UserHandle []byte
	CreatedAt  pgtype.Timestamptz
	ExpiresAt  pgtype.Timestamptz
}

type ConsumePasskeySignInChallengeParams 

type ConsumePasskeySignInChallengeParams struct {
	Now       pgtype.Timestamptz
	TokenHash []byte
}

type ConsumePendingCredentialParams 

type ConsumePendingCredentialParams struct {
	Now pgtype.Timestamptz
	ID  pgtype.UUID
}

type ConsumeStepUpOidcFlowParams 

type ConsumeStepUpOidcFlowParams struct {
	Now       pgtype.Timestamptz
	StateHash []byte
	SessionID pgtype.UUID
}

type ConsumeStepUpOidcFlowRow 

type ConsumeStepUpOidcFlowRow struct {
	ID           pgtype.UUID
	ProviderID   pgtype.UUID
	CodeVerifier string
	Nonce        string
	SessionID    pgtype.UUID
}

type ConsumeStepUpParams 

type ConsumeStepUpParams struct {
	Now       pgtype.Timestamptz
	TokenHash []byte
	AccountID pgtype.UUID
	Cutoff    pgtype.Timestamptz
}

type Container 

type Container struct {
	ID            pgtype.UUID
	TenantID      pgtype.UUID
	Type          ContainerType
	ParentID      pgtype.UUID
	Name          string
	Description   *string
	Icon          *string
	ColorToken    *string
	OrderKey      string
	Policies      []byte
	ArchivedAt    pgtype.Timestamptz
	DeletedAt     pgtype.Timestamptz
	TrashBatchID  pgtype.UUID
	CreatedBy     pgtype.UUID
	CreatedAt     pgtype.Timestamptz
	UpdatedAt     pgtype.Timestamptz
	Version       int32
	DeletedByType *string
	DeletedByID   pgtype.UUID
	Private       bool
	Handle        *string
	ItemCounter   int64
}

type ContainerMilestone 

type ContainerMilestone struct {
	TenantID    pgtype.UUID
	ContainerID pgtype.UUID
	ReachedAt   pgtype.Timestamptz
}

type ContainerOrderKeyNeighboursParams 

type ContainerOrderKeyNeighboursParams struct {
	ParentID pgtype.UUID
	MovingID pgtype.UUID
	BeforeID pgtype.UUID
}

type ContainerOrderKeyNeighboursRow 

type ContainerOrderKeyNeighboursRow struct {
	NextKey     string
	PreviousKey string
}

type ContainerType 

type ContainerType string
const (
	ContainerTypeHUB        ContainerType = "HUB"
	ContainerTypeCOLLECTION ContainerType = "COLLECTION"
)

func (*ContainerType) Scan 

func (e *ContainerType) Scan(src interface{}) error

type CountAgedSyncOpsParams 

type CountAgedSyncOpsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountAgedTombstonesParams 

type CountAgedTombstonesParams struct {
	Cutoff  pgtype.Timestamptz
	Now     pgtype.Timestamptz
	Ceiling int32
}

type CountAuthFailureParams 

type CountAuthFailureParams struct {
	SubjectHash []byte
	At          pgtype.Timestamptz
}

type CountBackupTargetsRow 

type CountBackupTargetsRow struct {
	Configured  int64
	Unencrypted int64
}

type CountDispatchedEventsParams 

type CountDispatchedEventsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredIdempotencyKeysParams 

type CountExpiredIdempotencyKeysParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredJumbleEntriesParams 

type CountExpiredJumbleEntriesParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredMailReceiptsParams 

type CountExpiredMailReceiptsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredNotificationsParams 

type CountExpiredNotificationsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredSessionsParams 

type CountExpiredSessionsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredSuggestionsParams 

type CountExpiredSuggestionsParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountExpiredWebhookDeliveriesParams 

type CountExpiredWebhookDeliveriesParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountFigureDaysParams 

type CountFigureDaysParams struct {
	Zone          string
	CollectionIds []pgtype.UUID
	Offered       []string
	WeekStart     pgtype.Timestamptz
	Now           pgtype.Timestamptz
}

type CountFigureDaysRow 

type CountFigureDaysRow struct {
	CollectionID pgtype.UUID
	Days         []string
}

type CountFigureDueParams 

type CountFigureDueParams struct {
	CollectionIds []pgtype.UUID
	Offered       []string
	Dated         []string
	Today         string
	DayEnd        pgtype.Timestamptz
}

type CountFigureDueRow 

type CountFigureDueRow struct {
	CollectionID pgtype.UUID
	Due          int32
}

type CountFigureFlowParams 

type CountFigureFlowParams struct {
	CollectionIds []pgtype.UUID
	Offered       []string
	Since         pgtype.Timestamptz
	Now           pgtype.Timestamptz
}

type CountFigureFlowRow 

type CountFigureFlowRow struct {
	CollectionID   pgtype.UUID
	Completed      int32
	Timed          int32
	AverageSeconds float64
	OverLimit      int32
}

type CountFigureOpenParams 

type CountFigureOpenParams struct {
	CollectionIds []pgtype.UUID
	FieldKeys     []string
}

type CountFigureOpenRow 

type CountFigureOpenRow struct {
	CollectionID pgtype.UUID
	Live         bool
	Open         int32
	Summed       int32
	Sum          string
}

type CountFigureProgressParams 

type CountFigureProgressParams struct {
	CollectionIds []pgtype.UUID
	Offered       []string
}

type CountFigureProgressRow 

type CountFigureProgressRow struct {
	CollectionID pgtype.UUID
	Total        int32
	Done         int32
}

type CountInstallationSealedValuesByStoreAndKeyRow 

type CountInstallationSealedValuesByStoreAndKeyRow struct {
	Store        string
	KeyID        string
	SealedValues int64
}

type CountMailReceiptsFromParams 

type CountMailReceiptsFromParams struct {
	Sender string
	Since  pgtype.Timestamptz
}

type CountOpenItemsByAssigneeRow 

type CountOpenItemsByAssigneeRow struct {
	AssigneeID pgtype.UUID
	OpenItems  int64
}

type CountRetainedDescendantsParams 

type CountRetainedDescendantsParams struct {
	Going []pgtype.UUID
	Ids   []pgtype.UUID
}

type CountRetainedDescendantsRow 

type CountRetainedDescendantsRow struct {
	ID       pgtype.UUID
	Retained int64
}

type CountRetentionCandidatesByArchivedAtParams 

type CountRetentionCandidatesByArchivedAtParams struct {
	Cutoff    pgtype.Timestamptz
	ScopeKind string
	ScopeID   pgtype.UUID
}

type CountRetentionCandidatesByCompletedAtParams 

type CountRetentionCandidatesByCompletedAtParams struct {
	Cutoff    pgtype.Timestamptz
	ScopeKind string
	ScopeID   pgtype.UUID
}

type CountRetentionCandidatesByDeletedAtParams 

type CountRetentionCandidatesByDeletedAtParams struct {
	Cutoff    pgtype.Timestamptz
	ScopeKind string
	ScopeID   pgtype.UUID
}

type CountRetentionScopeParams 

type CountRetentionScopeParams struct {
	ScopeKind string
	ScopeID   pgtype.UUID
}

type CountRunsSinceParams 

type CountRunsSinceParams struct {
	RuleID pgtype.UUID
	Since  pgtype.Timestamptz
}

type CountSealedValuesByStoreAndKeyRow 

type CountSealedValuesByStoreAndKeyRow struct {
	Store        string
	KeyID        string
	SealedValues int64
}

type CountStaleDevicesParams 

type CountStaleDevicesParams struct {
	Cutoff  pgtype.Timestamptz
	Ceiling int32
}

type CountStructurePresetsParams 

type CountStructurePresetsParams struct {
	Origin  string
	OwnerID pgtype.UUID
}

type CountTenantFootprintRow 

type CountTenantFootprintRow struct {
	Items        int64
	Containers   int64
	MediaObjects int64
	MediaBytes   int64
	OutboxEvents int64
	AuditEntries int64
}

type CustomFieldDefinition 

type CustomFieldDefinition struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Key          string
	Kind         string
	Options      []byte
	IsRequired   bool
	AppliesTo    []ItemType
	DeletedAt    pgtype.Timestamptz
	CreatedAt    pgtype.Timestamptz
	UpdatedAt    pgtype.Timestamptz
	Version      int32
}

type DBTX 

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
}

type DataSubjectRequest 

type DataSubjectRequest struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	Kind             string
	Status           string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	CompletedAt      pgtype.Timestamptz
	HandledBy        pgtype.UUID
	RejectionReason  *string
	ResultMediaID    pgtype.UUID
	Notes            *string
	Scope            string
	TargetID         pgtype.UUID
	ResultArchive    *string
	OriginalDueAt    pgtype.Timestamptz
	ExtensionReason  *string
	InformedOn       pgtype.Date
}

type DeadLetterJobParams 

type DeadLetterJobParams struct {
	Now       pgtype.Timestamptz
	LastError *string
	ID        pgtype.UUID
	Lease     pgtype.Timestamptz
}

type DecideSuggestionParams 

type DecideSuggestionParams struct {
	Status          string
	DecidedAt       pgtype.Timestamptz
	DecidedBy       pgtype.UUID
	ID              pgtype.UUID
	ExpectedVersion int32
}

type DefaultInstallationPresetRow 

type DefaultInstallationPresetRow struct {
	ID        pgtype.UUID
	Name      string
	Settings  []byte
	IsDefault bool
	Locks     []string
	Version   int32
}

type DeleteAgedSyncOpsParams 

type DeleteAgedSyncOpsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteAgedTombstonesParams 

type DeleteAgedTombstonesParams struct {
	Cutoff pgtype.Timestamptz
	Now    pgtype.Timestamptz
	Batch  int32
}

type DeleteAutoAssignPolicyParams 

type DeleteAutoAssignPolicyParams struct {
	ScopeType string
	ScopeID   pgtype.UUID
}

type DeleteCommentsOfParams 

type DeleteCommentsOfParams struct {
	AuthorID pgtype.UUID
	Ids      []pgtype.UUID
}

type DeleteDispatchedEventsParams 

type DeleteDispatchedEventsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredAiRequestsParams 

type DeleteExpiredAiRequestsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredConsumptionParams 

type DeleteExpiredConsumptionParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredIdempotencyKeysParams 

type DeleteExpiredIdempotencyKeysParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredJumbleEntriesParams 

type DeleteExpiredJumbleEntriesParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredMailReceiptsParams 

type DeleteExpiredMailReceiptsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredNotificationsParams 

type DeleteExpiredNotificationsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredOauthCodesParams 

type DeleteExpiredOauthCodesParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredOidcFlowsParams 

type DeleteExpiredOidcFlowsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredPendingParams 

type DeleteExpiredPendingParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredPlatformDeliveriesParams 

type DeleteExpiredPlatformDeliveriesParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredPlatformEventsParams 

type DeleteExpiredPlatformEventsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredSessionsParams 

type DeleteExpiredSessionsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredSuggestionsParams 

type DeleteExpiredSuggestionsParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteExpiredWebhookDeliveriesParams 

type DeleteExpiredWebhookDeliveriesParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteIdentityProviderParams 

type DeleteIdentityProviderParams struct {
	ID  pgtype.UUID
	Now pgtype.Timestamptz
}

type DeleteInstallationPresetParams 

type DeleteInstallationPresetParams struct {
	ID              pgtype.UUID
	ExpectedVersion *int32
}

type DeleteInstanceSettingsExceptParams 

type DeleteInstanceSettingsExceptParams struct {
	Areas []string
	Kept  []string
}

type DeleteItemAttachmentParams 

type DeleteItemAttachmentParams struct {
	ItemID  pgtype.UUID
	MediaID pgtype.UUID
}

type DeleteMediaObjectRowParams 

type DeleteMediaObjectRowParams struct {
	DeletedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type DeleteRecurrenceRuleParams 

type DeleteRecurrenceRuleParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type DeleteReminderParams 

type DeleteReminderParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type DeleteSavedViewParams 

type DeleteSavedViewParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type DeleteStaleDevicesParams 

type DeleteStaleDevicesParams struct {
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type DeleteStructurePresetParams 

type DeleteStructurePresetParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type DeletedTemplatesParams 

type DeletedTemplatesParams struct {
	After pgtype.UUID
	Batch int32
}

type DeletedTemplatesRow 

type DeletedTemplatesRow struct {
	ID        pgtype.UUID
	ScopeType string
	ScopeID   pgtype.UUID
	HubID     pgtype.UUID
}

type DeletionJournal 

type DeletionJournal struct {
	TenantID  pgtype.UUID
	Entity    string
	EntityID  pgtype.UUID
	DeletedAt pgtype.Timestamptz
	Reason    string
}

type DisableBrokenRuleParams 

type DisableBrokenRuleParams struct {
	At pgtype.Timestamptz
	ID pgtype.UUID
}

type DisableFailingRuleParams 

type DisableFailingRuleParams struct {
	At        pgtype.Timestamptz
	ID        pgtype.UUID
	Threshold int32
}

type DropAgedAuditPartitionsRow 

type DropAgedAuditPartitionsRow struct {
	Part      string
	PartMonth pgtype.Date
	Workspace pgtype.UUID
	Entries   int64
	Outcome   string
}

type DropAgedStreamPartitionsParams 

type DropAgedStreamPartitionsParams struct {
	Parent      string
	DefaultDays int32
}

type DropAgedStreamPartitionsRow 

type DropAgedStreamPartitionsRow struct {
	Dropped     string
	RowsRemoved int64
}

type DueAutomationRulesParams 

type DueAutomationRulesParams struct {
	Due      pgtype.Timestamptz
	PageSize int32
}

type DueAutomationRulesRow 

type DueAutomationRulesRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type DueBackupSchedulesParams 

type DueBackupSchedulesParams struct {
	Now   pgtype.Timestamptz
	Batch int32
}

type ElevateSessionParams 

type ElevateSessionParams struct {
	ElevatedUntil pgtype.Timestamptz
	ID            pgtype.UUID
	AccountID     pgtype.UUID
	Now           pgtype.Timestamptz
}

type EmergencyNoticesForParams 

type EmergencyNoticesForParams struct {
	RecipientID pgtype.UUID
	Since       pgtype.Timestamptz
}

type EndInvitationOfAccountParams 

type EndInvitationOfAccountParams struct {
	At        pgtype.Timestamptz
	AccountID pgtype.UUID
}

type EnlistOperatorParams 

type EnlistOperatorParams struct {
	AccountID pgtype.UUID
	AddedBy   pgtype.UUID
}

type EnqueueJobParams 

type EnqueueJobParams struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	Kind        string
	Payload     []byte
	DedupeKey   *string
	RunAt       pgtype.Timestamptz
	MaxAttempts int32
}

type EnsureRetentionPolicyParams 

type EnsureRetentionPolicyParams struct {
	DataKind   string
	RetainDays int32
	MinDays    int32
}

type EnsureStreamPartitionParams 

type EnsureStreamPartitionParams struct {
	Parent string
	Month  pgtype.Date
}

type EntriesHiddenBelowRow 

type EntriesHiddenBelowRow struct {
	RootID  pgtype.UUID
	Seen    []string
	Entries int64
}

type EqualMembershipParams 

type EqualMembershipParams struct {
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type EqualMembershipRow 

type EqualMembershipRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type EraseErasureKeptParams 

type EraseErasureKeptParams struct {
	ErasedAt     pgtype.Timestamptz
	RequestID    pgtype.UUID
	StillKeeping []pgtype.UUID
}

type ErasureContributionsRow 

type ErasureContributionsRow struct {
	Kind          string
	ID            pgtype.UUID
	ItemID        pgtype.UUID
	Path          string
	CollectionID  pgtype.UUID
	HubID         pgtype.UUID
	ItemCreatedBy pgtype.UUID
}

type ErasureKept 

type ErasureKept struct {
	TenantID      pgtype.UUID
	RequestID     pgtype.UUID
	HoldID        pgtype.UUID
	HoldScope     string
	HoldScopeID   pgtype.UUID
	Account       bool
	Entries       int32
	Comments      int32
	Assignments   int32
	Intake        int32
	RecordedAt    pgtype.Timestamptz
	ErasedAt      pgtype.Timestamptz
	BlockedCode   *string
	BlockedParams []byte
}

type ErasureKeptOfRow 

type ErasureKeptOfRow struct {
	RequestID     pgtype.UUID
	HoldID        pgtype.UUID
	HoldScope     string
	HoldScopeID   pgtype.UUID
	Account       bool
	Entries       int32
	Comments      int32
	Assignments   int32
	Intake        int32
	RecordedAt    pgtype.Timestamptz
	ErasedAt      pgtype.Timestamptz
	BlockedCode   *string
	BlockedParams []byte
}

type EventConsumption 

type EventConsumption struct {
	TenantID   pgtype.UUID
	Consumer   string
	EventID    pgtype.UUID
	ConsumedAt pgtype.Timestamptz
}

type ExpiredTrashContainersParams 

type ExpiredTrashContainersParams struct {
	Cutoff    pgtype.Timestamptz
	Due       pgtype.Timestamptz
	Skip      int32
	BatchSize int32
}

type ExpiredTrashContainersRow 

type ExpiredTrashContainersRow struct {
	ID        pgtype.UUID
	Type      ContainerType
	ParentID  pgtype.UUID
	DeletedAt pgtype.Timestamptz
}

type ExpiredTrashItemsParams 

type ExpiredTrashItemsParams struct {
	Cutoff    pgtype.Timestamptz
	Due       pgtype.Timestamptz
	Skip      int32
	BatchSize int32
}

type ExpiredTrashItemsRow 

type ExpiredTrashItemsRow struct {
	ID           pgtype.UUID
	Type         ItemType
	Path         string
	CollectionID pgtype.UUID
	HubID        pgtype.UUID
	DeletedAt    pgtype.Timestamptz
}

type ExportAccountGroupMembersParams 

type ExportAccountGroupMembersParams struct {
	AfterID     pgtype.UUID
	AfterSecond pgtype.UUID
	Batch       int32
}

type ExportAccountGroupMembersRow 

type ExportAccountGroupMembersRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportAccountGroupsParams 

type ExportAccountGroupsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportAccountGroupsRow 

type ExportAccountGroupsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportAccountsParams 

type ExportAccountsParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportAccountsRow 

type ExportAccountsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportActivityEntriesParams 

type ExportActivityEntriesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportActivityEntriesRow 

type ExportActivityEntriesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportAuditParams 

type ExportAuditParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID int64
	Batch   int32
}

type ExportAuditRow 

type ExportAuditRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportAutoAssignPoliciesParams 

type ExportAutoAssignPoliciesParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportAutoAssignPoliciesRow 

type ExportAutoAssignPoliciesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportAutomationRulesParams 

type ExportAutomationRulesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportAutomationRulesRow 

type ExportAutomationRulesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportBucketsParams 

type ExportBucketsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportBucketsRow 

type ExportBucketsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportCalendarFeedsParams 

type ExportCalendarFeedsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportCalendarFeedsRow 

type ExportCalendarFeedsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportCommentsParams 

type ExportCommentsParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportCommentsRow 

type ExportCommentsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportConsentRecordsParams 

type ExportConsentRecordsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportConsentRecordsRow 

type ExportConsentRecordsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportContainerMilestonesParams 

type ExportContainerMilestonesParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportContainerMilestonesRow 

type ExportContainerMilestonesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportContainersParams 

type ExportContainersParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportContainersRow 

type ExportContainersRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportCustomFieldDefinitionsParams 

type ExportCustomFieldDefinitionsParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportCustomFieldDefinitionsRow 

type ExportCustomFieldDefinitionsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportItemAttachmentsParams 

type ExportItemAttachmentsParams struct {
	AfterID     pgtype.UUID
	AfterSecond pgtype.UUID
	Batch       int32
}

type ExportItemAttachmentsRow 

type ExportItemAttachmentsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportItemLabelsParams 

type ExportItemLabelsParams struct {
	AfterID     pgtype.UUID
	AfterSecond pgtype.UUID
	Batch       int32
}

type ExportItemLabelsRow 

type ExportItemLabelsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportItemMembersParams 

type ExportItemMembersParams struct {
	AfterID     pgtype.UUID
	AfterSecond pgtype.UUID
	Batch       int32
}

type ExportItemMembersRow 

type ExportItemMembersRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportJumbleEntriesParams 

type ExportJumbleEntriesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportJumbleEntriesRow 

type ExportJumbleEntriesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportLabelsParams 

type ExportLabelsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportLabelsRow 

type ExportLabelsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportLegalHoldsParams 

type ExportLegalHoldsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportLegalHoldsRow 

type ExportLegalHoldsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportMediaObjectsParams 

type ExportMediaObjectsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportMediaObjectsRow 

type ExportMediaObjectsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportMembershipsParams 

type ExportMembershipsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportMembershipsRow 

type ExportMembershipsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportNotificationPreferencesParams 

type ExportNotificationPreferencesParams struct {
	Since       pgtype.Timestamptz
	AfterAt     pgtype.Timestamptz
	AfterID     pgtype.UUID
	AfterSecond string
	AfterThird  string
	Batch       int32
}

type ExportNotificationPreferencesRow 

type ExportNotificationPreferencesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportPasskeysParams 

type ExportPasskeysParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportPasskeysRow 

type ExportPasskeysRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportPrivateHubAccessesParams 

type ExportPrivateHubAccessesParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportPrivateHubAccessesRow 

type ExportPrivateHubAccessesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportRecurrenceRulesParams 

type ExportRecurrenceRulesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportRecurrenceRulesRow 

type ExportRecurrenceRulesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportRemindersParams 

type ExportRemindersParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportRemindersRow 

type ExportRemindersRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportRetentionPoliciesParams 

type ExportRetentionPoliciesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID string
	Batch   int32
}

type ExportRetentionPoliciesRow 

type ExportRetentionPoliciesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportSavedViewsParams 

type ExportSavedViewsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportSavedViewsRow 

type ExportSavedViewsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportSetElementsParams 

type ExportSetElementsParams struct {
	AfterID     pgtype.UUID
	AfterSecond string
	AfterThird  pgtype.UUID
	Batch       int32
}

type ExportSetElementsRow 

type ExportSetElementsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportStructurePresetsParams 

type ExportStructurePresetsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportStructurePresetsRow 

type ExportStructurePresetsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportTemplatesParams 

type ExportTemplatesParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportTemplatesRow 

type ExportTemplatesRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportTenantsParams 

type ExportTenantsParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportTenantsRow 

type ExportTenantsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportTombstonesParams 

type ExportTombstonesParams struct {
	Entity  string
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportTombstonesRow 

type ExportTombstonesRow struct {
	EntityID  string
	DeletedAt pgtype.Timestamptz
}

type ExportWebhookSubscriptionsParams 

type ExportWebhookSubscriptionsParams struct {
	AfterID pgtype.UUID
	Batch   int32
}

type ExportWebhookSubscriptionsRow 

type ExportWebhookSubscriptionsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExportWorkItemsParams 

type ExportWorkItemsParams struct {
	Since   pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type ExportWorkItemsRow 

type ExportWorkItemsRow struct {
	RecordID  string
	ChangedAt pgtype.Timestamptz
	Payload   []byte
}

type ExtendDataSubjectRequestParams 

type ExtendDataSubjectRequestParams struct {
	DueAt           pgtype.Timestamptz
	ExtensionReason *string
	InformedOn      pgtype.Date
	ID              pgtype.UUID
	Now             pgtype.Timestamptz
}

type ExtendSessionParams 

type ExtendSessionParams struct {
	ExpiresAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type FieldClock 

type FieldClock struct {
	TenantID pgtype.UUID
	Entity   string
	EntityID pgtype.UUID
	Field    string
	Hlc      string
}

type FieldClocksOfParams 

type FieldClocksOfParams struct {
	Entity   string
	EntityID pgtype.UUID
}

type FieldClocksOfRow 

type FieldClocksOfRow struct {
	Field string
	Hlc   string
}

type FindAccessTokenByHashRow 

type FindAccessTokenByHashRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	AccountID             pgtype.UUID
	Scopes                []string
	ExpiresAt             pgtype.Timestamptz
	RevokedAt             pgtype.Timestamptz
	LastUsedAt            pgtype.Timestamptz
	AccountDisplayName    string
	AccountKind           AccountKind
	AccountStatus         AccountStatus
	AccountLocale         *string
	AccountTimeZone       *string
	AccountWeekStart      *string
	DefaultLocale         string
	DefaultTimeZone       string
	TenantWeekStart       string
	InstallationWeekStart []byte
	TenantSlug            string
	TenantStatus          string
	TokenRateOverride     interface{}
}

type FindAccessTokenRow 

type FindAccessTokenRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	AccountID  pgtype.UUID
	Name       string
	Scopes     []string
	ExpiresAt  pgtype.Timestamptz
	LastUsedAt pgtype.Timestamptz
	RevokedAt  pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
}

type FindAccountByEmailForPasswordRow 

type FindAccountByEmailForPasswordRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Kind            AccountKind
	Email           *string
	DisplayName     string
	Status          AccountStatus
	Locale          *string
	TimeZone        *string
	WeekStart       *string
	PasswordHash    *string
	PasswordSetAt   pgtype.Timestamptz
	SignInName      *string
	StartPasswordAt pgtype.Timestamptz
}

type FindAccountByEmailRow 

type FindAccountByEmailRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	SignInName            *string
	DisplayName           string
	Status                AccountStatus
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
}

type FindAccountByProviderSubjectParams 

type FindAccountByProviderSubjectParams struct {
	ProviderID pgtype.UUID
	Subject    string
}

type FindAccountByProviderSubjectRow 

type FindAccountByProviderSubjectRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	DisplayName           string
	Status                AccountStatus
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
}

type FindAccountByRedemptionHashRow 

type FindAccountByRedemptionHashRow struct {
	ID                  pgtype.UUID
	Kind                AccountKind
	Email               *string
	DisplayName         string
	Status              AccountStatus
	AccountLocale       *string
	AccountTimeZone     *string
	RedemptionExpiresAt pgtype.Timestamptz
	DefaultLocale       string
	DefaultTimeZone     string
	TenantSlug          string
	TenantStatus        string
	TenantName          string
}

type FindAccountBySignInNameRow 

type FindAccountBySignInNameRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	SignInName            *string
	DisplayName           string
	Status                AccountStatus
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
}

type FindAccountForPasswordRow 

type FindAccountForPasswordRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Kind            AccountKind
	Email           *string
	DisplayName     string
	Status          AccountStatus
	Locale          *string
	TimeZone        *string
	WeekStart       *string
	PasswordHash    *string
	PasswordSetAt   pgtype.Timestamptz
	SignInName      *string
	StartPasswordAt pgtype.Timestamptz
}

type FindAccountForSignInParams 

type FindAccountForSignInParams struct {
	Address    *string
	SignInName *string
}

type FindAccountForSignInRow 

type FindAccountForSignInRow struct {
	ID              pgtype.UUID
	Kind            AccountKind
	Email           *string
	SignInName      *string
	DisplayName     string
	Status          AccountStatus
	AccountLocale   *string
	AccountTimeZone *string
	PasswordHash    *string
	DefaultLocale   string
	DefaultTimeZone string
	TenantSlug      string
	TenantStatus    string
}

type FindAccountRow 

type FindAccountRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	Kind                  AccountKind
	Email                 *string
	SignInName            *string
	DisplayName           string
	Status                AccountStatus
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
	AvatarMediaID         pgtype.UUID
}

type FindAddressRequestByHashRow 

type FindAddressRequestByHashRow struct {
	ID            pgtype.UUID
	AccountID     pgtype.UUID
	Address       string
	CreatedAt     pgtype.Timestamptz
	ExpiresAt     pgtype.Timestamptz
	ConsumedAt    pgtype.Timestamptz
	AccountStatus AccountStatus
	TenantStatus  string
}

type FindAiProviderKeyRow 

type FindAiProviderKeyRow struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	ApiKeyEnc         []byte
	ApiKeyKeyID       *string
	Jurisdiction      string
	ProcessingAllowed bool
}

type FindAiProviderRow 

type FindAiProviderRow struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	HasApiKey         bool
	Jurisdiction      string
	ProcessingAllowed bool
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	Version           int32
}

type FindAiRequestRow 

type FindAiRequestRow struct {
	ID        pgtype.UUID
	AskedBy   pgtype.UUID
	Text      string
	CreatedAt pgtype.Timestamptz
}

type FindArrivalPendingByHashRow 

type FindArrivalPendingByHashRow struct {
	ID                 pgtype.UUID
	Purpose            string
	UserAgent          *string
	IpClass            *string
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	ConsumedAt         pgtype.Timestamptz
	LinkProviderID     pgtype.UUID
	LinkSubject        *string
	SessionMethod      *string
	SessionVia         pgtype.UUID
	ArrivalEmail       *string
	ArrivalDisplayName *string
	ArrivalDirectory   *string
	DefaultLocale      string
	DefaultTimeZone    string
	TenantSlug         string
	TenantStatus       string
}

type FindAuthAttemptRow 

type FindAuthAttemptRow struct {
	Failures      int32
	LastFailureAt pgtype.Timestamptz
	LockedUntil   pgtype.Timestamptz
}

type FindAutoAssignPolicyParams 

type FindAutoAssignPolicyParams struct {
	ScopeType string
	ScopeID   pgtype.UUID
}

type FindAutomationRuleByInboundTokenRow 

type FindAutomationRuleByInboundTokenRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type FindAutomationRuleRow 

type FindAutomationRuleRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type FindBackupRunRow 

type FindBackupRunRow struct {
	ID          pgtype.UUID
	ScheduleID  pgtype.UUID
	TargetID    pgtype.UUID
	TenantID    pgtype.UUID
	ParentRunID pgtype.UUID
	Trigger     string
	Mode        string
	Status      string
	ArchivePath *string
	SizeBytes   *int64
	ItemCount   *int32
	MediaCount  *int32
	Checksum    *string
	SnapshotAt  pgtype.Timestamptz
	StartedAt   pgtype.Timestamptz
	FinishedAt  pgtype.Timestamptz
	ErrorCode   *string
	ExpiresAt   pgtype.Timestamptz
	VerifiedAt  pgtype.Timestamptz
	VerifyOk    *bool
	TrialReport []byte
	TrialAt     pgtype.Timestamptz
}

type FindBackupTargetCredentialRow 

type FindBackupTargetCredentialRow struct {
	CredentialEnc   []byte
	CredentialKeyID *string
}

type FindBackupTargetRow 

type FindBackupTargetRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Name            string
	Kind            string
	Config          []byte
	CredentialKeyID *string
	EncryptionMode  string
	EncryptionKeyID *string
	RegionNote      *string
	InsecureAckBy   pgtype.UUID
	InsecureAckAt   pgtype.Timestamptz
	Enabled         bool
	LastTestAt      pgtype.Timestamptz
	LastTestOk      *bool
	LastTestError   *string
	CreatedAt       pgtype.Timestamptz
	CreatedBy       pgtype.UUID
	Version         int32
}

type FindCalendarFeedByHashRow 

type FindCalendarFeedByHashRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	ViewID    pgtype.UUID
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type FindCalendarFeedRow 

type FindCalendarFeedRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	ViewID    pgtype.UUID
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type FindCommentRow 

type FindCommentRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	ItemID          pgtype.UUID
	AuthorID        pgtype.UUID
	ParentCommentID pgtype.UUID
	Body            string
	CreatedAt       pgtype.Timestamptz
	EditedAt        pgtype.Timestamptz
	DeletedAt       pgtype.Timestamptz
	Version         int32
	Kind            string
	SystemCode      *string
	SystemParams    []byte
}

type FindContainerRow 

type FindContainerRow struct {
	ID                   pgtype.UUID
	TenantID             pgtype.UUID
	Type                 ContainerType
	ParentID             pgtype.UUID
	Name                 string
	Description          *string
	Icon                 *string
	ColorToken           *string
	OrderKey             string
	CompletionPolicy     string
	Structure            string
	AutoAssignStrategy   *string
	AutoAssignCandidates []byte
	AutoAssignEnabled    *bool
	ArchivedAt           pgtype.Timestamptz
	ParentArchivedAt     pgtype.Timestamptz
	DeletedAt            pgtype.Timestamptz
	TrashBatchID         pgtype.UUID
	CreatedBy            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	UpdatedAt            pgtype.Timestamptz
	Version              int32
	Private              bool
	Handle               *string
}

type FindCustomFieldInScopeParams 

type FindCustomFieldInScopeParams struct {
	Key          string
	CollectionID pgtype.UUID
}

type FindCustomFieldInScopeRow 

type FindCustomFieldInScopeRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Key          string
	Kind         string
	Options      []byte
	IsRequired   bool
	AppliesTo    []ItemType
	CreatedAt    pgtype.Timestamptz
	UpdatedAt    pgtype.Timestamptz
	DeletedAt    pgtype.Timestamptz
	Version      int32
}

type FindCustomFieldRow 

type FindCustomFieldRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Key          string
	Kind         string
	Options      []byte
	IsRequired   bool
	AppliesTo    []ItemType
	CreatedAt    pgtype.Timestamptz
	UpdatedAt    pgtype.Timestamptz
	DeletedAt    pgtype.Timestamptz
	Version      int32
}

type FindDataSubjectRequestRow 

type FindDataSubjectRequestRow struct {
	ID               pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	Kind             string
	Status           string
	Scope            string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	CompletedAt      pgtype.Timestamptz
	HandledBy        pgtype.UUID
	RejectionReason  *string
	TargetID         pgtype.UUID
	ResultArchive    *string
	Notes            *string
	OriginalDueAt    pgtype.Timestamptz
	ExtensionReason  *string
	InformedOn       pgtype.Date
}

type FindDeviceRow 

type FindDeviceRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	LastSeenAt   pgtype.Timestamptz
	Blocked      bool
	CreatedAt    pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type FindGroupRow 

type FindGroupRow struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	Name        string
	Description *string
	Version     int32
}

type FindIdempotencyRecordParams 

type FindIdempotencyRecordParams struct {
	Key      string
	Endpoint string
}

type FindIdempotencyRecordRow 

type FindIdempotencyRecordRow struct {
	RequestHash  []byte
	ResponseCode *int32
	ResponseBody []byte
}

type FindIdentityProviderByIDRow 

type FindIdentityProviderByIDRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	OfferedWorkspaces   int32
}

type FindIdentityProviderSecretRow 

type FindIdentityProviderSecretRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	ClientSecretEnc     []byte
	ClientSecretKeyID   string
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
}

type FindInstallationPresetRow 

type FindInstallationPresetRow struct {
	ID        pgtype.UUID
	Name      string
	Settings  []byte
	IsDefault bool
	Locks     []string
	Version   int32
}

type FindItemRetentionRow 

type FindItemRetentionRow struct {
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
}

type FindJobAskerParams 

type FindJobAskerParams struct {
	ID       pgtype.UUID
	TenantID pgtype.UUID
}

type FindJobAskerRow 

type FindJobAskerRow struct {
	Kind       string
	AskedBy    string
	TargetType string
	TargetID   string
}

type FindJobByDedupeKeyParams 

type FindJobByDedupeKeyParams struct {
	Kind      string
	DedupeKey string
}

type FindJobParams 

type FindJobParams struct {
	ID       pgtype.UUID
	TenantID pgtype.UUID
}

type FindJobRow 

type FindJobRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	State           string
	LastError       *string
	LastErrorParams []byte
	Outcome         *string
	CreatedAt       pgtype.Timestamptz
	FinishedAt      pgtype.Timestamptz
	Progress        *float32
}

type FindJumbleEntryRow 

type FindJumbleEntryRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Channel      string
	Sender       *string
	RawSubject   *string
	RawBody      *string
	Attachments  []pgtype.UUID
	Status       string
	TargetItemID pgtype.UUID
	ReceivedAt   pgtype.Timestamptz
	ProcessedAt  pgtype.Timestamptz
	CreatedBy    pgtype.UUID
	MeantForKind *string
	MeantForID   pgtype.UUID
	IntakeReason *string
	ArrivalJobID pgtype.UUID
}

type FindJumbleIntakeByTokenRow 

type FindJumbleIntakeByTokenRow struct {
	TenantID  pgtype.UUID
	RotatedAt pgtype.Timestamptz
}

type FindLegalHoldRow 

type FindLegalHoldRow struct {
	ID             pgtype.UUID
	ScopeKind      string
	ScopeID        pgtype.UUID
	Reason         string
	PlacedBy       pgtype.UUID
	PlacedAt       pgtype.Timestamptz
	ReleasedBy     pgtype.UUID
	ReleasedAt     pgtype.Timestamptz
	ReleasedReason *string
}

type FindMailSettingRow 

type FindMailSettingRow struct {
	Enabled             bool
	Name                *string
	DefaultCollectionID pgtype.UUID
	SenderLevel         string
	Allowed             []string
	Blocked             []string
	SenderRoutes        string
	OpenedBy            pgtype.UUID
	UpdatedAt           pgtype.Timestamptz
}

type FindMailboxRow 

type FindMailboxRow struct {
	ID                pgtype.UUID
	Protocol          string
	Address           string
	Host              *string
	Port              *int32
	SessionUrl        *string
	Username          string
	Folder            string
	DoneFolder        string
	Preset            *string
	Enabled           bool
	CheckedAt         pgtype.Timestamptz
	Failure           *string
	FailingSince      pgtype.Timestamptz
	CreatedAt         pgtype.Timestamptz
	Auth              string
	OauthProvider     *string
	OauthAuthorizeUrl *string
	OauthTokenUrl     *string
	OauthScopes       []string
	OauthClientID     *string
	OauthInstallation bool
	SecretEnc         []byte
	SecretKeyID       string
}

type FindMediaObjectRow 

type FindMediaObjectRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	StorageKey string
	FileName   *string
	MimeType   string
	ByteSize   int64
	Checksum   *string
	Usage      string
	Status     string
	RefCount   int32
	CreatedBy  pgtype.UUID
	CreatedAt  pgtype.Timestamptz
	DeletedAt  pgtype.Timestamptz
}

type FindMediaStorageKeyRow 

type FindMediaStorageKeyRow struct {
	StorageKey string
	ByteSize   int64
}

type FindMembershipRow 

type FindMembershipRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type FindMfaEnrollmentRow 

type FindMfaEnrollmentRow struct {
	AccountID              pgtype.UUID
	SecretEnc              []byte
	SecretKeyID            string
	ConfirmedAt            pgtype.Timestamptz
	LastStep               *int64
	ReplacementSecretEnc   []byte
	ReplacementSecretKeyID *string
	ReplacementSessionID   pgtype.UUID
	ReplacementExpiresAt   pgtype.Timestamptz
}

type FindNotificationPreferenceParams 

type FindNotificationPreferenceParams struct {
	AccountID pgtype.UUID
	Category  string
	Channel   string
}

type FindOauthClientRow 

type FindOauthClientRow struct {
	ID           pgtype.UUID
	Name         string
	Confidential bool
	SecretHash   []byte
	RedirectUris []string
	CreatedAt    pgtype.Timestamptz
}

type FindOauthGrantRow 

type FindOauthGrantRow struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	ClientID  pgtype.UUID
	Scopes    []string
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type FindOfferedAiProviderKeyRow 

type FindOfferedAiProviderKeyRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	ApiKeyEnc       []byte
	ApiKeyKeyID     *string
	Jurisdiction    string
}

type FindOfferedAiProviderRow 

type FindOfferedAiProviderRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	HasApiKey       bool
	Jurisdiction    string
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
}

type FindOutboxEventRow 

type FindOutboxEventRow struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	EventType      string
	Subject        *string
	Payload        []byte
	ActorType      string
	ActorID        pgtype.UUID
	CorrelationID  pgtype.UUID
	CausationID    pgtype.UUID
	CausationDepth int32
	OccurredAt     pgtype.Timestamptz
	Replay         bool
	ReceivedAt     pgtype.Timestamptz
	PushID         pgtype.UUID
}

type FindPasskeyHolderRow 

type FindPasskeyHolderRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	AccountID       pgtype.UUID
	CredentialID    []byte
	PublicKey       []byte
	Algorithm       int32
	SignCount       int64
	UserHandle      []byte
	BackupEligible  bool
	BackedUp        bool
	Transports      []string
	Name            string
	CreatedAt       pgtype.Timestamptz
	LastUsedAt      pgtype.Timestamptz
	RpID            *string
	Kind            AccountKind
	Email           *string
	SignInName      *string
	DisplayName     string
	Status          AccountStatus
	AccountLocale   *string
	AccountTimeZone *string
	StartPasswordAt pgtype.Timestamptz
	DefaultLocale   string
	DefaultTimeZone string
	TenantSlug      string
	TenantStatus    string
}

type FindPendingByHashRow 

type FindPendingByHashRow struct {
	ID                 pgtype.UUID
	AccountID          pgtype.UUID
	Purpose            string
	UserAgent          *string
	IpClass            *string
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	ConsumedAt         pgtype.Timestamptz
	LinkProviderID     pgtype.UUID
	LinkSubject        *string
	LinkProof          *string
	PasswordChangeOwed bool
	SignedInWith       *string
	SessionMethod      *string
	SessionVia         pgtype.UUID
	AccountKind        AccountKind
	AccountStatus      AccountStatus
	AccountDisplayName string
	AccountLocale      *string
	AccountTimeZone    *string
	DefaultLocale      string
	DefaultTimeZone    string
	TenantSlug         string
	TenantStatus       string
}

type FindPendingByIDRow 

type FindPendingByIDRow struct {
	ID                 pgtype.UUID
	AccountID          pgtype.UUID
	Purpose            string
	UserAgent          *string
	IpClass            *string
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	ConsumedAt         pgtype.Timestamptz
	LinkProviderID     pgtype.UUID
	LinkSubject        *string
	LinkProof          *string
	PasswordChangeOwed bool
	SignedInWith       *string
	SessionMethod      *string
	SessionVia         pgtype.UUID
	AccountKind        AccountKind
	AccountStatus      AccountStatus
	AccountDisplayName string
	AccountLocale      *string
	AccountTimeZone    *string
	DefaultLocale      string
	DefaultTimeZone    string
	TenantSlug         string
	TenantStatus       string
}

type FindPendingDeliveryOfPushParams 

type FindPendingDeliveryOfPushParams struct {
	SubscriptionID pgtype.UUID
	PushID         pgtype.UUID
	Subject        *string
	EventType      *string
}

type FindPlanByNameRow 

type FindPlanByNameRow struct {
	ID          pgtype.UUID
	Name        string
	DisplayName string
	Version     int32
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
}

type FindPlatformEventRow 

type FindPlatformEventRow struct {
	Number     int64
	ID         pgtype.UUID
	EventType  string
	TenantID   pgtype.UUID
	OccurredAt pgtype.Timestamptz
	ActorType  string
	ActorID    pgtype.UUID
	Payload    []byte
}

type FindPlatformSubscriptionRow 

type FindPlatformSubscriptionRow struct {
	ID             pgtype.UUID
	TargetUrl      string
	SecretEnc      []byte
	SecretKeyID    string
	State          string
	LastError      *string
	LastDeliveryAt pgtype.Timestamptz
	FromFile       bool
	CreatedAt      pgtype.Timestamptz
	Version        int32
	DeadLetters    int64
}

type FindPrivateHubAccessRow 

type FindPrivateHubAccessRow struct {
	ID       pgtype.UUID
	TenantID pgtype.UUID
	HubID    pgtype.UUID
	OpenedBy pgtype.UUID
	Reason   string
	OpenedAt pgtype.Timestamptz
	EndsAt   pgtype.Timestamptz
	HubName  string
}

type FindRecurrenceRuleForItemRow 

type FindRecurrenceRuleForItemRow struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	SourceItemID       pgtype.UUID
	Rrule              string
	TimeZone           string
	Mode               string
	HorizonDays        int32
	EndsAt             pgtype.Timestamptz
	MaxCount           *int32
	LastMaterializedAt pgtype.Timestamptz
	CreatedAt          pgtype.Timestamptz
	UpdatedAt          pgtype.Timestamptz
	Version            int32
}

type FindRefreshTokenByHashRow 

type FindRefreshTokenByHashRow struct {
	ID                 pgtype.UUID
	SessionID          pgtype.UUID
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	RotatedAt          pgtype.Timestamptz
	TenantID           pgtype.UUID
	AccountID          pgtype.UUID
	SessionCreatedAt   pgtype.Timestamptz
	SessionLastSeenAt  pgtype.Timestamptz
	SessionUserAgent   *string
	SessionIpClass     *string
	SessionExpiresAt   pgtype.Timestamptz
	SessionRevokedAt   pgtype.Timestamptz
	AccountKind        AccountKind
	AccountStatus      AccountStatus
	AccountDisplayName string
	AccountLocale      *string
	AccountTimeZone    *string
	DefaultLocale      string
	DefaultTimeZone    string
	TenantSlug         string
	TenantStatus       string
}

type FindReminderRow 

type FindReminderRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
	UpdatedAt  pgtype.Timestamptz
	Version    int32
}

type FindRestoreRunRow 

type FindRestoreRunRow struct {
	ID                 pgtype.UUID
	TargetID           pgtype.UUID
	SourceArchive      string
	TenantID           pgtype.UUID
	TargetTenantID     pgtype.UUID
	Mode               string
	ConflictRule       string
	Selection          []byte
	DryRun             bool
	CreateSafetyBackup bool
	SafetyBackupRunID  pgtype.UUID
	Status             string
	Report             []byte
	Progress           []byte
	RequestedBy        pgtype.UUID
	ApprovedBy         pgtype.UUID
	StartedAt          pgtype.Timestamptz
	FinishedAt         pgtype.Timestamptz
	ErrorCode          *string
}

type FindRetentionCursorParams 

type FindRetentionCursorParams struct {
	Reader   string
	DataKind *string
	RuleID   pgtype.UUID
}

type FindRetentionCursorRow 

type FindRetentionCursorRow struct {
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
}

type FindRetentionPolicyRow 

type FindRetentionPolicyRow struct {
	DataKind   string
	RetainDays int32
	MinDays    int32
	MaxDays    *int32
}

type FindRuleRunRow 

type FindRuleRunRow struct {
	ID               pgtype.UUID
	RuleID           pgtype.UUID
	EventID          pgtype.UUID
	Trigger          string
	TriggeredBy      pgtype.UUID
	SubjectID        pgtype.UUID
	Status           string
	ConditionResults []byte
	ActionResults    []byte
	Occasion         *string
	ErrorCode        *string
	StartedAt        pgtype.Timestamptz
	FinishedAt       pgtype.Timestamptz
	CausationDepth   int32
}

type FindSessionForAuthRow 

type FindSessionForAuthRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	AccountID             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	LastSeenAt            pgtype.Timestamptz
	ExpiresAt             pgtype.Timestamptz
	RevokedAt             pgtype.Timestamptz
	GrantID               pgtype.UUID
	Scopes                []string
	HardExpiresAt         pgtype.Timestamptz
	IdleMinutes           *int32
	SignedInWith          *string
	ElevatedUntil         pgtype.Timestamptz
	RotationFrom          interface{}
	GrantClientID         pgtype.UUID
	AccountKind           AccountKind
	AccountStatus         AccountStatus
	AccountDisplayName    string
	AccountLocale         *string
	AccountTimeZone       *string
	AccountWeekStart      *string
	DefaultLocale         string
	DefaultTimeZone       string
	TenantWeekStart       string
	InstallationWeekStart []byte
	TenantSlug            string
	TenantStatus          string
	TokenRateOverride     interface{}
}

type FindStepUpMethodParams 

type FindStepUpMethodParams struct {
	TokenHash []byte
	AccountID pgtype.UUID
}

type FindStructurePresetRow 

type FindStructurePresetRow struct {
	ID        pgtype.UUID
	Origin    string
	OwnerID   pgtype.UUID
	Name      string
	Settings  []byte
	CreatedAt pgtype.Timestamptz
	Version   int32
}

type FindSuggestionRow 

type FindSuggestionRow struct {
	ID            pgtype.UUID
	TargetType    string
	TargetID      pgtype.UUID
	Kind          string
	Status        string
	Payload       []byte
	Source        string
	Model         string
	PromptID      string
	PromptVersion string
	ProducedAt    pgtype.Timestamptz
	InputDigest   []byte
	CreatedAt     pgtype.Timestamptz
	DecidedAt     pgtype.Timestamptz
	DecidedBy     pgtype.UUID
	Version       int32
	DroppedNodes  int32
}

type FindSyncOpRow 

type FindSyncOpRow struct {
	OpID      pgtype.UUID
	DeviceID  pgtype.UUID
	Result    string
	EntityID  pgtype.UUID
	AppliedAt pgtype.Timestamptz
	Response  []byte
}

type FindTemplateRow 

type FindTemplateRow struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	ScopeType   string
	ScopeID     pgtype.UUID
	Name        string
	Description *string
	RootType    ItemType
	Nodes       []byte
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
	DeletedAt   pgtype.Timestamptz
	Version     int32
}

type FindTenantForAdminRow 

type FindTenantForAdminRow struct {
	ID                      pgtype.UUID
	Slug                    string
	DisplayName             string
	Status                  TenantStatus
	DefaultLocale           string
	DefaultTimeZone         string
	CreatedAt               pgtype.Timestamptz
	PurgeAfter              pgtype.Timestamptz
	Version                 int32
	PasswordOpenedUntil     pgtype.Timestamptz
	PasswordOpenedRequester *string
	PasswordOpenedReason    *string
	StatusBeforeDeletion    *TenantStatus
	PurgeStartedAt          pgtype.Timestamptz
	PlanName                string
	ExternalReference       string
}

type FindTermsAgreementRow 

type FindTermsAgreementRow struct {
	TermsUrl      *string
	TermsVersion  *string
	TermsAgreedAt pgtype.Timestamptz
}

type FindVoiceSettingRow 

type FindVoiceSettingRow struct {
	Enabled             bool
	DefaultCollectionID pgtype.UUID
	SkillID             *string
	InvocationName      *string
	UpdatedAt           pgtype.Timestamptz
}

type FindWebhookSubscriptionRow 

type FindWebhookSubscriptionRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	TargetUrl           string
	EventTypes          []string
	FilterExpr          *string
	ScopeType           *string
	ScopeID             pgtype.UUID
	SecretEnc           []byte
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	PreviousSecretUntil pgtype.Timestamptz
	State               string
	FailureCount        int32
	LastError           *string
	DisabledAt          pgtype.Timestamptz
	CreatedBy           pgtype.UUID
	CreatedAt           pgtype.Timestamptz
	Version             int32
}

type FindWorkItemByCalendarUIDRow 

type FindWorkItemByCalendarUIDRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type FindWorkItemRow 

type FindWorkItemRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type FindWorkItemsRow 

type FindWorkItemsRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type FindWorkspaceRow 

type FindWorkspaceRow struct {
	ID                      pgtype.UUID
	Slug                    string
	DisplayName             string
	Status                  TenantStatus
	DefaultLocale           string
	DefaultTimeZone         string
	Settings                []byte
	CreatedAt               pgtype.Timestamptz
	UpdatedAt               pgtype.Timestamptz
	Version                 int32
	PasswordOpenedUntil     pgtype.Timestamptz
	PasswordOpenedRequester *string
	PasswordOpenedReason    *string
}

type FindWorkspaceStructureForShareRow 

type FindWorkspaceStructureForShareRow struct {
	Structure string
	Version   int32
}

type FindWorkspaceStructureForUpdateRow 

type FindWorkspaceStructureForUpdateRow struct {
	Structure string
	Version   int32
}

type FindWorkspaceStructureRow 

type FindWorkspaceStructureRow struct {
	Structure string
	Version   int32
}

type FinishBackupRunParams 

type FinishBackupRunParams struct {
	Status      string
	ArchivePath *string
	Manifest    []byte
	SizeBytes   *int64
	ItemCount   *int32
	MediaCount  *int32
	Checksum    *string
	SnapshotAt  pgtype.Timestamptz
	FinishedAt  pgtype.Timestamptz
	ErrorCode   *string
	TrialReport []byte
	TrialAt     pgtype.Timestamptz
	ID          pgtype.UUID
}

type FinishImportRunParams 

type FinishImportRunParams struct {
	Status     string
	Report     []byte
	Refused    []byte
	ErrorCode  *string
	FinishedAt pgtype.Timestamptz
	ID         pgtype.UUID
}

type FinishRestoreRunParams 

type FinishRestoreRunParams struct {
	Status            string
	Report            []byte
	SafetyBackupRunID pgtype.UUID
	FinishedAt        pgtype.Timestamptz
	ErrorCode         *string
	ID                pgtype.UUID
}

type FinishRetentionRunParams 

type FinishRetentionRunParams struct {
	Matched        int32
	Affected       int32
	Blocked        int32
	BlockedReasons []byte
	FinishedAt     pgtype.Timestamptz
	Status         string
	ID             pgtype.UUID
}

type FinishRuleRunParams 

type FinishRuleRunParams struct {
	Status           string
	ConditionResults []byte
	ActionResults    []byte
	ErrorCode        *string
	FinishedAt       pgtype.Timestamptz
	ID               pgtype.UUID
}

type FirstBucketParams 

type FirstBucketParams struct {
	CollectionID pgtype.UUID
	ExcludedID   pgtype.UUID
}

type FlattenWorkItemParams 

type FlattenWorkItemParams struct {
	Type            ItemType
	Path            string
	OrderKey        string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type ForgetDeviceParams 

type ForgetDeviceParams struct {
	Now       pgtype.Timestamptz
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type ForgetDeviceRow 

type ForgetDeviceRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	LastSeenAt   pgtype.Timestamptz
	Blocked      bool
	CreatedAt    pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type ForgetOtherQuotaPeriodsParams 

type ForgetOtherQuotaPeriodsParams struct {
	Quota  string
	Period string
}

type ForgetRuleOccurrenceParams 

type ForgetRuleOccurrenceParams struct {
	RuleID pgtype.UUID
	ItemID pgtype.UUID
}

type GiveKudosParams 

type GiveKudosParams struct {
	ItemID  pgtype.UUID
	GivenBy pgtype.UUID
	GivenTo pgtype.UUID
	GivenAt pgtype.Timestamptz
}

type GrantMembershipParams 

type GrantMembershipParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type HoldJobParams 

type HoldJobParams struct {
	ID    pgtype.UUID
	Lease pgtype.Timestamptz
}

type HoldsTombstoneParams 

type HoldsTombstoneParams struct {
	Entity   string
	EntityID pgtype.UUID
}

type HubsOfRow 

type HubsOfRow struct {
	NamedID      pgtype.UUID
	HubID        pgtype.UUID
	Private      bool
	CollectionID pgtype.UUID
}

type HubsOpenedForParams 

type HubsOpenedForParams struct {
	AccountID pgtype.UUID
	HubIds    []pgtype.UUID
	Now       pgtype.Timestamptz
}

type IdempotencyKey 

type IdempotencyKey struct {
	TenantID     pgtype.UUID
	Key          string
	Endpoint     string
	RequestHash  []byte
	ResponseCode *int32
	ResponseBody []byte
	CreatedAt    pgtype.Timestamptz
}

type IdentityProvider 

type IdentityProvider struct {
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	ClientSecretEnc     []byte
	ClientSecretKeyID   string
	AllowedEmailDomains []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	ID                  pgtype.UUID
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	// The provider's own identifiers for the organisations this row admits: Microsoft tid, Google hd. Empty under DOMAINS with a preset that has a directory claim admits nobody (ADR-0071 §2).
	AllowedDirectories []string
	OfferedWorkspaces  int32
	WithdrawAt         pgtype.Timestamptz
	NewcomerRole       *MembershipRole
	NewcomerGroupID    pgtype.UUID
}

type ImportAccountGroupMemberParams 

type ImportAccountGroupMemberParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportAccountGroupParams 

type ImportAccountGroupParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportAccountParams 

type ImportAccountParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportActivityEntryParams 

type ImportActivityEntryParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportAutoAssignPolicyParams 

type ImportAutoAssignPolicyParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportAutomationRuleParams 

type ImportAutomationRuleParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportBucketParams 

type ImportBucketParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportCalendarFeedParams 

type ImportCalendarFeedParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportCommentParams 

type ImportCommentParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportConsentRecordParams 

type ImportConsentRecordParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportContainerMilestoneParams 

type ImportContainerMilestoneParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportContainerParams 

type ImportContainerParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportCustomFieldDefinitionParams 

type ImportCustomFieldDefinitionParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportItemAttachmentParams 

type ImportItemAttachmentParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportItemLabelParams 

type ImportItemLabelParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportItemMemberParams 

type ImportItemMemberParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportJumbleEntryParams 

type ImportJumbleEntryParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportLabelParams 

type ImportLabelParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportLegalHoldParams 

type ImportLegalHoldParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportMediaObjectParams 

type ImportMediaObjectParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportMembershipParams 

type ImportMembershipParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportNotificationPreferenceParams 

type ImportNotificationPreferenceParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportPasskeyParams 

type ImportPasskeyParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportPrivateHubAccessParams 

type ImportPrivateHubAccessParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportRecurrenceRuleParams 

type ImportRecurrenceRuleParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportReminderParams 

type ImportReminderParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportRetentionPolicyParams 

type ImportRetentionPolicyParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportRun 

type ImportRun struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	RequestedBy  pgtype.UUID
	Kind         string
	MediaID      pgtype.UUID
	HubID        pgtype.UUID
	Mapping      []byte
	TimeZone     *string
	Language     *string
	Status       string
	Report       []byte
	Refused      []byte
	Progress     []byte
	ErrorCode    *string
	CreatedAt    pgtype.Timestamptz
	StartedAt    pgtype.Timestamptz
	FinishedAt   pgtype.Timestamptz
	CollectionID pgtype.UUID
}

type ImportSavedViewParams 

type ImportSavedViewParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportSetElementParams 

type ImportSetElementParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportStructurePresetParams 

type ImportStructurePresetParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportTemplateParams 

type ImportTemplateParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportTenantParams 

type ImportTenantParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportWebhookSubscriptionParams 

type ImportWebhookSubscriptionParams struct {
	Payload   []byte
	Overwrite bool
}

type ImportWorkItemParams 

type ImportWorkItemParams struct {
	Payload   []byte
	Overwrite bool
}

type InsertAccessTokenParams 

type InsertAccessTokenParams struct {
	ID          pgtype.UUID
	AccountID   pgtype.UUID
	Name        string
	TokenHash   []byte
	TokenPrefix string
	Scopes      []string
	ExpiresAt   pgtype.Timestamptz
	CreatedAt   pgtype.Timestamptz
}

type InsertAccountParams 

type InsertAccountParams struct {
	ID          pgtype.UUID
	Kind        AccountKind
	Email       *string
	DisplayName string
	Status      AccountStatus
	Locale      *string
	TimeZone    *string
	WeekStart   *string
}

type InsertAddressRequestParams 

type InsertAddressRequestParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	Address   *string
	CreatedAt pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
}

type InsertAuditEntryParams 

type InsertAuditEntryParams struct {
	ID           pgtype.UUID
	Seq          int64
	OccurredAt   pgtype.Timestamptz
	Action       string
	Outcome      string
	Severity     string
	ActorType    string
	ActorID      pgtype.UUID
	ActorLabel   *string
	OnBehalfOfID pgtype.UUID
	TargetType   *string
	TargetID     pgtype.UUID
	TargetLabel  *string
	Context      []byte
	Changes      []byte
	LegalBasis   *string
	PrevHash     []byte
	Hash         []byte
}

type InsertAuditPseudonymParams 

type InsertAuditPseudonymParams struct {
	ActorID   pgtype.UUID
	Pseudonym string
	Reason    string
	CreatedAt pgtype.Timestamptz
}

type InsertAutomationRuleParams 

type InsertAutomationRuleParams struct {
	ID         pgtype.UUID
	ScopeType  string
	ScopeID    pgtype.UUID
	Name       string
	Enabled    bool
	RunAs      pgtype.UUID
	Trigger    []byte
	Conditions []byte
	Actions    []byte
	Throttle   []byte
	OnError    string
	CreatedBy  pgtype.UUID
	CreatedAt  pgtype.Timestamptz
	NextRunAt  pgtype.Timestamptz
}

type InsertBackupRunParams 

type InsertBackupRunParams struct {
	ID          pgtype.UUID
	ScheduleID  pgtype.UUID
	TargetID    pgtype.UUID
	TenantID    pgtype.UUID
	ParentRunID pgtype.UUID
	Trigger     string
	Mode        string
	SnapshotAt  pgtype.Timestamptz
	StartedAt   pgtype.Timestamptz
}

type InsertBackupScheduleParams 

type InsertBackupScheduleParams struct {
	ID           pgtype.UUID
	TargetID     pgtype.UUID
	TenantID     pgtype.UUID
	ScopeKind    string
	ScopeID      pgtype.UUID
	Rrule        string
	TimeZone     string
	Mode         string
	FullRrule    *string
	IncludeMedia bool
	IncludeAudit bool
	Retention    []byte
	NotifyOn     []string
	NextRunAt    pgtype.Timestamptz
	CreatedAt    pgtype.Timestamptz
	TrialRestore bool
}

type InsertBackupTargetParams 

type InsertBackupTargetParams struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Name            string
	Kind            string
	Config          []byte
	CredentialEnc   []byte
	CredentialKeyID *string
	EncryptionMode  string
	EncryptionKeyID *string
	RegionNote      *string
	InsecureAckBy   pgtype.UUID
	InsecureAckAt   pgtype.Timestamptz
	CreatedAt       pgtype.Timestamptz
	CreatedBy       pgtype.UUID
}

type InsertBucketParams 

type InsertBucketParams struct {
	ID           pgtype.UUID
	CollectionID pgtype.UUID
	Name         string
	OrderKey     string
	WipLimit     *int32
	IsDoneBucket bool
	ColorToken   *string
}

type InsertCalendarFeedParams 

type InsertCalendarFeedParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	ViewID    pgtype.UUID
	TokenHash []byte
	CreatedAt pgtype.Timestamptz
}

type InsertCommentParams 

type InsertCommentParams struct {
	ID              pgtype.UUID
	ItemID          pgtype.UUID
	AuthorID        pgtype.UUID
	ParentCommentID pgtype.UUID
	Body            string
	CreatedAt       pgtype.Timestamptz
	Kind            string
	SystemCode      *string
	SystemParams    []byte
}

type InsertConsentRecordParams 

type InsertConsentRecordParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	Purpose   string
	Granted   bool
	GrantedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
	Source    *string
}

type InsertContainerParams 

type InsertContainerParams struct {
	ID               pgtype.UUID
	Type             ContainerType
	ParentID         pgtype.UUID
	Name             string
	Description      *string
	Icon             *string
	ColorToken       *string
	OrderKey         string
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	Private          bool
	CompletionPolicy string
	Structure        []byte
}

type InsertCustomFieldParams 

type InsertCustomFieldParams struct {
	ID           pgtype.UUID
	CollectionID pgtype.UUID
	Key          string
	Kind         string
	Options      []byte
	IsRequired   bool
	AppliesTo    []ItemType
	CreatedAt    pgtype.Timestamptz
}

type InsertDataSubjectRequestParams 

type InsertDataSubjectRequestParams struct {
	ID               pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	Kind             string
	Status           string
	Scope            string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	HandledBy        pgtype.UUID
	TargetID         pgtype.UUID
	Notes            *string
}

type InsertGroupParams 

type InsertGroupParams struct {
	ID          pgtype.UUID
	Name        string
	Description *string
}

type InsertIdentityProviderParams 

type InsertIdentityProviderParams struct {
	ID                  pgtype.UUID
	Issuer              string
	ClientID            string
	ClientSecretEnc     []byte
	ClientSecretKeyID   string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	Now                 pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
}

type InsertIdentityProviderRow 

type InsertIdentityProviderRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	OfferedWorkspaces   int32
}

type InsertImportRunParams 

type InsertImportRunParams struct {
	ID           pgtype.UUID
	RequestedBy  pgtype.UUID
	Kind         string
	MediaID      pgtype.UUID
	HubID        pgtype.UUID
	CollectionID pgtype.UUID
	Mapping      []byte
	TimeZone     *string
	Language     *string
}

type InsertInstallationPresetParams 

type InsertInstallationPresetParams struct {
	ID        pgtype.UUID
	Name      string
	Settings  []byte
	IsDefault bool
	Locks     []string
	Now       pgtype.Timestamptz
	UpdatedBy pgtype.UUID
}

type InsertInstanceEventParams 

type InsertInstanceEventParams struct {
	ID         pgtype.UUID
	OccurredAt pgtype.Timestamptz
	Action     string
	TenantID   pgtype.UUID
	TenantSlug *string
	ActorLabel *string
	Details    []byte
}

type InsertItemAttachmentParams 

type InsertItemAttachmentParams struct {
	ItemID  pgtype.UUID
	MediaID pgtype.UUID
}

type InsertJumbleEntryParams 

type InsertJumbleEntryParams struct {
	ID           pgtype.UUID
	Channel      string
	Sender       *string
	RawSubject   *string
	RawBody      *string
	Attachments  []pgtype.UUID
	Status       string
	ReceivedAt   pgtype.Timestamptz
	CreatedBy    pgtype.UUID
	MeantForKind *string
	MeantForID   pgtype.UUID
	IntakeReason *string
}

type InsertLabelParams 

type InsertLabelParams struct {
	ID           pgtype.UUID
	CollectionID pgtype.UUID
	Name         string
	ColorToken   string
	Description  *string
}

type InsertLegalHoldParams 

type InsertLegalHoldParams struct {
	ID        pgtype.UUID
	ScopeKind string
	ScopeID   pgtype.UUID
	Reason    string
	PlacedBy  pgtype.UUID
	PlacedAt  pgtype.Timestamptz
}

type InsertMailReceiptParams 

type InsertMailReceiptParams struct {
	ID         pgtype.UUID
	MessageID  string
	ReceivedAt pgtype.Timestamptz
	Sender     string
	Subject    string
	Outcome    string
	Reason     string
	ItemID     pgtype.UUID
	EntryID    pgtype.UUID
	Door       string
}

type InsertMailboxAuthorizationParams 

type InsertMailboxAuthorizationParams struct {
	ID                pgtype.UUID
	AccountID         pgtype.UUID
	StateHash         []byte
	Provider          string
	AuthorizeUrl      string
	TokenUrl          string
	Scopes            []string
	ClientID          string
	Installation      bool
	Host              string
	Port              int32
	LoginHint         *string
	VerifierEnc       []byte
	VerifierKeyID     string
	ClientSecretEnc   []byte
	ClientSecretKeyID *string
	ExpiresAt         pgtype.Timestamptz
}

type InsertMailboxParams 

type InsertMailboxParams struct {
	ID                pgtype.UUID
	Protocol          string
	Address           string
	Host              *string
	Port              *int32
	SessionUrl        *string
	Username          string
	Folder            string
	DoneFolder        string
	Preset            *string
	Enabled           bool
	SecretEnc         []byte
	SecretKeyID       string
	CreatedAt         pgtype.Timestamptz
	CreatedBy         pgtype.UUID
	Auth              string
	OauthProvider     *string
	OauthAuthorizeUrl *string
	OauthTokenUrl     *string
	OauthScopes       []string
	OauthClientID     *string
	OauthInstallation bool
}

type InsertManagedAccountParams 

type InsertManagedAccountParams struct {
	ID           pgtype.UUID
	SignInName   *string
	DisplayName  string
	PasswordHash *string
	Now          pgtype.Timestamptz
}

type InsertMediaObjectParams 

type InsertMediaObjectParams struct {
	ID         pgtype.UUID
	StorageKey string
	FileName   *string
	MimeType   string
	ByteSize   int64
	Usage      string
	Status     string
	CreatedBy  pgtype.UUID
	CreatedAt  pgtype.Timestamptz
}

type InsertNotificationParams 

type InsertNotificationParams struct {
	ID                 pgtype.UUID
	RecipientID        pgtype.UUID
	Category           string
	Channel            string
	State              string
	Reason             *string
	EventID            pgtype.UUID
	ItemID             pgtype.UUID
	ActorID            pgtype.UUID
	CreatedAt          pgtype.Timestamptz
	RuleID             pgtype.UUID
	SubscriptionID     pgtype.UUID
	PrivateHubAccessID pgtype.UUID
	MembershipID       pgtype.UUID
}

type InsertOauthClientParams 

type InsertOauthClientParams struct {
	ID           pgtype.UUID
	Name         string
	Confidential bool
	SecretHash   []byte
	RedirectUris []string
	CreatedAt    pgtype.Timestamptz
	CreatedBy    pgtype.UUID
}

type InsertOauthCodeParams 

type InsertOauthCodeParams struct {
	ID            pgtype.UUID
	ClientID      pgtype.UUID
	AccountID     pgtype.UUID
	GrantID       pgtype.UUID
	CodeHash      []byte
	CodeChallenge string
	RedirectUri   string
	CreatedAt     pgtype.Timestamptz
	ExpiresAt     pgtype.Timestamptz
}

type InsertOfferedAiProviderParams 

type InsertOfferedAiProviderParams struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	ApiKeyEnc       []byte
	ApiKeyKeyID     *string
	Jurisdiction    string
	Now             pgtype.Timestamptz
}

type InsertOfferedAiProviderRow 

type InsertOfferedAiProviderRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	HasApiKey       bool
	Jurisdiction    string
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
}

type InsertOidcFlowParams 

type InsertOidcFlowParams struct {
	ID               pgtype.UUID
	ProviderID       pgtype.UUID
	StateHash        []byte
	CodeVerifier     string
	Nonce            string
	CreatedAt        pgtype.Timestamptz
	ExpiresAt        pgtype.Timestamptz
	SessionID        pgtype.UUID
	InvitedAccountID pgtype.UUID
	PendingID        pgtype.UUID
	TermsUrl         *string
	TermsVersion     *string
	Connect          bool
}

type InsertPasskeyChallengeParams 

type InsertPasskeyChallengeParams struct {
	ID         pgtype.UUID
	AccountID  pgtype.UUID
	TokenHash  []byte
	CreatedAt  pgtype.Timestamptz
	ExpiresAt  pgtype.Timestamptz
	SessionID  pgtype.UUID
	UserHandle []byte
}

type InsertPasskeyParams 

type InsertPasskeyParams struct {
	ID             pgtype.UUID
	AccountID      pgtype.UUID
	CredentialID   []byte
	PublicKey      []byte
	Algorithm      int32
	SignCount      int64
	UserHandle     []byte
	BackupEligible bool
	BackedUp       bool
	Transports     []string
	Name           string
	CreatedAt      pgtype.Timestamptz
	RpID           *string
}

type InsertPasskeyProofChallengeParams 

type InsertPasskeyProofChallengeParams struct {
	ID         pgtype.UUID
	AccountID  pgtype.UUID
	TokenHash  []byte
	Purpose    string
	CreatedAt  pgtype.Timestamptz
	ExpiresAt  pgtype.Timestamptz
	SessionID  pgtype.UUID
	UserHandle []byte
}

type InsertPasskeySignInChallengeParams 

type InsertPasskeySignInChallengeParams struct {
	ID        pgtype.UUID
	TokenHash []byte
	UserAgent *string
	IpClass   *string
	CreatedAt pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
}

type InsertPendingCredentialParams 

type InsertPendingCredentialParams struct {
	ID                 pgtype.UUID
	AccountID          pgtype.UUID
	TokenHash          []byte
	Purpose            string
	UserAgent          *string
	IpClass            *string
	CreatedAt          pgtype.Timestamptz
	ExpiresAt          pgtype.Timestamptz
	LinkProviderID     pgtype.UUID
	LinkSubject        *string
	LinkProof          *string
	PasswordChangeOwed bool
	SignedInWith       *string
	SessionMethod      *string
	SessionVia         pgtype.UUID
	ArrivalEmail       *string
	ArrivalDisplayName *string
	ArrivalDirectory   *string
}

type InsertPlanParams 

type InsertPlanParams struct {
	ID          pgtype.UUID
	Name        string
	DisplayName string
	Now         pgtype.Timestamptz
	UpdatedBy   pgtype.UUID
}

type InsertPlatformDeliveryParams 

type InsertPlatformDeliveryParams struct {
	ID             pgtype.UUID
	SubscriptionID pgtype.UUID
	EventID        pgtype.UUID
	EventType      string
	Now            pgtype.Timestamptz
}

type InsertPlatformEventParams 

type InsertPlatformEventParams struct {
	ID         pgtype.UUID
	EventType  string
	TenantID   pgtype.UUID
	OccurredAt pgtype.Timestamptz
	ActorType  string
	ActorID    pgtype.UUID
	Payload    []byte
	DedupeKey  *string
}

type InsertPlatformSubscriptionParams 

type InsertPlatformSubscriptionParams struct {
	ID          pgtype.UUID
	TargetUrl   string
	SecretEnc   []byte
	SecretKeyID string
	FromFile    bool
	Now         pgtype.Timestamptz
	CreatedBy   pgtype.UUID
}

type InsertPrivateHubAccessParams 

type InsertPrivateHubAccessParams struct {
	ID       pgtype.UUID
	HubID    pgtype.UUID
	OpenedBy pgtype.UUID
	Reason   string
	OpenedAt pgtype.Timestamptz
	EndsAt   pgtype.Timestamptz
}

type InsertRecoveredErasureCaseParams 

type InsertRecoveredErasureCaseParams struct {
	ID               pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	HandledBy        pgtype.UUID
	Notes            *string
	OriginalDueAt    pgtype.Timestamptz
	ExtensionReason  *string
	InformedOn       pgtype.Date
}

type InsertRecoveryCodeParams 

type InsertRecoveryCodeParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	CodeHash  []byte
	CreatedAt pgtype.Timestamptz
}

type InsertRecurrenceRuleParams 

type InsertRecurrenceRuleParams struct {
	ID           pgtype.UUID
	SourceItemID pgtype.UUID
	Rrule        string
	TimeZone     string
	Mode         string
	HorizonDays  int32
	EndsAt       pgtype.Timestamptz
	MaxCount     *int32
	CreatedAt    pgtype.Timestamptz
}

type InsertRefreshTokenParams 

type InsertRefreshTokenParams struct {
	ID        pgtype.UUID
	SessionID pgtype.UUID
	TokenHash []byte
	CreatedAt pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
}

type InsertReminderParams 

type InsertReminderParams struct {
	ID         pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
}

type InsertRestoreRunParams 

type InsertRestoreRunParams struct {
	ID                 pgtype.UUID
	TargetID           pgtype.UUID
	SourceArchive      string
	TargetTenantID     pgtype.UUID
	Mode               string
	ConflictRule       string
	Selection          []byte
	DryRun             bool
	CreateSafetyBackup bool
	RequestedBy        pgtype.UUID
}

type InsertRetentionRuleParams 

type InsertRetentionRuleParams struct {
	ID             pgtype.UUID
	ScopeKind      string
	ScopeID        pgtype.UUID
	DataKind       string
	Condition      *string
	RetainDays     int32
	Action         string
	ThenAfterDays  *int32
	ThenAction     *string
	GraceDays      int32
	Notify         []byte
	Justification  *string
	Enabled        bool
	ExportTargetID pgtype.UUID
	CreatedBy      pgtype.UUID
	Now            pgtype.Timestamptz
}

type InsertRuleRunParams 

type InsertRuleRunParams struct {
	ID               pgtype.UUID
	RuleID           pgtype.UUID
	EventID          pgtype.UUID
	Trigger          string
	TriggeredBy      pgtype.UUID
	SubjectID        pgtype.UUID
	Status           string
	ConditionResults []byte
	ActionResults    []byte
	Occasion         *string
	StartedAt        pgtype.Timestamptz
	CausationDepth   int32
}

type InsertSavedViewParams 

type InsertSavedViewParams struct {
	ID            pgtype.UUID
	ScopeType     string
	ScopeID       pgtype.UUID
	OwnerID       pgtype.UUID
	Name          string
	Layout        string
	Query         []byte
	Grouping      []byte
	VisibleFields []string
	Sharing       string
	CreatedAt     pgtype.Timestamptz
}

type InsertSessionParams 

type InsertSessionParams struct {
	ID                 pgtype.UUID
	AccountID          pgtype.UUID
	CreatedAt          pgtype.Timestamptz
	UserAgent          *string
	IpClass            *string
	ExpiresAt          pgtype.Timestamptz
	GrantID            pgtype.UUID
	Scopes             []string
	HardExpiresAt      pgtype.Timestamptz
	IdleMinutes        *int32
	SignedInWith       *string
	SignedInProviderID pgtype.UUID
}

type InsertStructurePresetParams 

type InsertStructurePresetParams struct {
	ID        pgtype.UUID
	Origin    string
	OwnerID   pgtype.UUID
	Name      string
	Settings  []byte
	CreatedAt pgtype.Timestamptz
}

type InsertTemplateParams 

type InsertTemplateParams struct {
	ID          pgtype.UUID
	ScopeType   string
	ScopeID     pgtype.UUID
	Name        string
	Description *string
	RootType    ItemType
	Nodes       []byte
	CreatedAt   pgtype.Timestamptz
}

type InsertTenantHostParams 

type InsertTenantHostParams struct {
	Host         string
	State        string
	Verification string
	VerifiedAt   pgtype.Timestamptz
	IsCanonical  bool
	CreatedAt    pgtype.Timestamptz
}

type InsertTenantParams 

type InsertTenantParams struct {
	Slug            string
	DisplayName     string
	DefaultLocale   string
	DefaultTimeZone string
	Settings        []byte
	Now             pgtype.Timestamptz
}

type InsertVoiceAliasParams 

type InsertVoiceAliasParams struct {
	ID           pgtype.UUID
	Phrase       string
	Folded       string
	CollectionID pgtype.UUID
	LabelID      pgtype.UUID
	CreatedAt    pgtype.Timestamptz
}

type InsertWebhookDeliveryParams 

type InsertWebhookDeliveryParams struct {
	ID             pgtype.UUID
	SubscriptionID pgtype.UUID
	EventID        pgtype.UUID
	Attempt        int32
	Status         string
	ErrorCode      *string
	NextAttemptAt  pgtype.Timestamptz
	CreatedAt      pgtype.Timestamptz
	PushID         pgtype.UUID
	Subject        *string
	EventType      *string
}

type InsertWebhookSubscriptionParams 

type InsertWebhookSubscriptionParams struct {
	ID          pgtype.UUID
	TargetUrl   string
	EventTypes  []string
	FilterExpr  *string
	ScopeType   *string
	ScopeID     pgtype.UUID
	SecretEnc   []byte
	SecretKeyID *string
	State       string
	CreatedBy   pgtype.UUID
	CreatedAt   pgtype.Timestamptz
}

type InsertWorkItemCopyParams 

type InsertWorkItemCopyParams struct {
	ID              pgtype.UUID
	CollectionID    pgtype.UUID
	Type            ItemType
	ParentID        pgtype.UUID
	Path            string
	Depth           int32
	Title           string
	Amount          *string
	Notes           *string
	BucketID        pgtype.UUID
	OrderKey        string
	AssigneeID      pgtype.UUID
	StartAt         pgtype.Timestamptz
	DueAt           pgtype.Timestamptz
	DueDateOnly     interface{}
	DueTimeZone     *string
	CoverKind       *string
	CoverColorToken *string
	CoverMediaID    pgtype.UUID
	CustomFields    []byte
	CustomFieldRefs []byte
	ContentLanguage *string
	ArchivedAt      pgtype.Timestamptz
	CreatedBy       pgtype.UUID
	CreatedAt       pgtype.Timestamptz
}

type InsertWorkItemParams 

type InsertWorkItemParams struct {
	ID              pgtype.UUID
	CollectionID    pgtype.UUID
	Type            ItemType
	ParentID        pgtype.UUID
	Path            string
	Depth           int32
	Title           string
	Amount          *string
	Notes           *string
	BucketID        pgtype.UUID
	OrderKey        string
	StartAt         pgtype.Timestamptz
	ContentLanguage *string
	CalendarUid     *string
	CreatedBy       pgtype.UUID
	CreatedAt       pgtype.Timestamptz
}

type InstallationPreset 

type InstallationPreset struct {
	ID        pgtype.UUID
	Name      string
	Settings  []byte
	IsDefault bool
	Locks     []string
	Version   int32
	CreatedAt pgtype.Timestamptz
	UpdatedAt pgtype.Timestamptz
	UpdatedBy pgtype.UUID
}

type InstanceCensusRow 

type InstanceCensusRow struct {
	WorkspacesActive          int64
	WorkspacesSuspended       int64
	WorkspacesPendingDeletion int64
	AccountsActive            int64
	AccountsTotal             int64
	WorkspacesServiceOnly     int64
}

type InstanceEvent 

type InstanceEvent struct {
	ID         pgtype.UUID
	OccurredAt pgtype.Timestamptz
	Action     string
	TenantID   pgtype.UUID
	TenantSlug *string
	ActorLabel *string
	Details    []byte
}

type InstanceQuotaDefaultsRow 

type InstanceQuotaDefaultsRow struct {
	Key        string
	Value      []byte
	LockOrigin string
}

type InstanceSetting 

type InstanceSetting struct {
	Key        string
	Value      []byte
	LockOrigin string
	UpdatedBy  pgtype.UUID
	UpdatedAt  pgtype.Timestamptz
}

type InstanceSetupCode 

type InstanceSetupCode struct {
	ID        pgtype.UUID
	CodeHash  []byte
	IssuedAt  pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
}

type IssueSetupCodeParams 

type IssueSetupCodeParams struct {
	ID        pgtype.UUID
	CodeHash  []byte
	IssuedAt  pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
}

type IssueStartPasswordParams 

type IssueStartPasswordParams struct {
	PasswordHash *string
	At           pgtype.Timestamptz
	AccountID    pgtype.UUID
}

type ItemAttachment 

type ItemAttachment struct {
	TenantID pgtype.UUID
	ItemID   pgtype.UUID
	MediaID  pgtype.UUID
}

type ItemByKeyParams 

type ItemByKeyParams struct {
	Handle *string
	Number int64
}

type ItemCapabilityProfile 

type ItemCapabilityProfile struct {
	TenantID          pgtype.UUID
	Type              ItemType
	Capabilities      []string
	AllowedChildTypes []ItemType
	MaxDepth          int32
}

type ItemContributorsRow 

type ItemContributorsRow struct {
	ItemID    pgtype.UUID
	AccountID pgtype.UUID
}

type ItemKeyRow 

type ItemKeyRow struct {
	Handle *string
	Number *int64
}

type ItemLabel 

type ItemLabel struct {
	TenantID pgtype.UUID
	ItemID   pgtype.UUID
	LabelID  pgtype.UUID
}

type ItemMember 

type ItemMember struct {
	TenantID  pgtype.UUID
	ItemID    pgtype.UUID
	AccountID pgtype.UUID
}

type ItemType 

type ItemType string
const (
	ItemTypeTASK        ItemType = "TASK"
	ItemTypeWORKPACKAGE ItemType = "WORK_PACKAGE"
	ItemTypeACTIVITY    ItemType = "ACTIVITY"
)

func (*ItemType) Scan 

func (e *ItemType) Scan(src interface{}) error

type Job 

type Job struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Kind            string
	Payload         []byte
	DedupeKey       *string
	RunAt           pgtype.Timestamptz
	State           string
	Attempts        int32
	MaxAttempts     int32
	LockedUntil     pgtype.Timestamptz
	LastError       *string
	Priority        int16
	CreatedAt       pgtype.Timestamptz
	FinishedAt      pgtype.Timestamptz
	Progress        *float32
	LastErrorParams []byte
	Outcome         *string
}

type JobQueueDepthRow 

type JobQueueDepthRow struct {
	Kind    string
	Pending int64
}

type JournalledDeletionsParams 

type JournalledDeletionsParams struct {
	Since       pgtype.Timestamptz
	AfterAt     pgtype.Timestamptz
	AfterEntity string
	AfterID     pgtype.UUID
	Batch       int32
}

type JournalledDeletionsRow 

type JournalledDeletionsRow struct {
	Entity    string
	EntityID  pgtype.UUID
	DeletedAt pgtype.Timestamptz
	Reason    string
}

type JumbleEntry 

type JumbleEntry struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Channel      string
	Sender       *string
	RawSubject   *string
	RawBody      *string
	Attachments  []pgtype.UUID
	Suggestion   []byte
	Status       string
	TargetItemID pgtype.UUID
	ReceivedAt   pgtype.Timestamptz
	ProcessedAt  pgtype.Timestamptz
	CreatedBy    pgtype.UUID
	MeantForKind *string
	MeantForID   pgtype.UUID
	IntakeReason *string
}

type JumbleIntake 

type JumbleIntake struct {
	TenantID  pgtype.UUID
	TokenHash []byte
	RotatedAt pgtype.Timestamptz
}

type KeptCommentTextsParams 

type KeptCommentTextsParams struct {
	After pgtype.UUID
	Batch int32
}

type KeptCommentTextsRow 

type KeptCommentTextsRow struct {
	ID           pgtype.UUID
	ItemID       pgtype.UUID
	Path         string
	CollectionID pgtype.UUID
	HubID        pgtype.UUID
}

type Kudo 

type Kudo struct {
	TenantID pgtype.UUID
	ItemID   pgtype.UUID
	GivenBy  pgtype.UUID
	GivenTo  pgtype.UUID
	GivenAt  pgtype.Timestamptz
}

type KudosGivenParams 

type KudosGivenParams struct {
	ItemID  pgtype.UUID
	GivenBy pgtype.UUID
	GivenTo pgtype.UUID
}

type KudosOfAccountParams 

type KudosOfAccountParams struct {
	AccountID pgtype.UUID
	AfterItem pgtype.UUID
	AfterBy   pgtype.UUID
	AfterTo   pgtype.UUID
	Batch     int32
}

type KudosOfAccountRow 

type KudosOfAccountRow struct {
	ItemID  pgtype.UUID
	GivenBy pgtype.UUID
	GivenTo pgtype.UUID
	GivenAt pgtype.Timestamptz
}

type KudosReceivedParams 

type KudosReceivedParams struct {
	ItemID  pgtype.UUID
	GivenTo pgtype.UUID
}

type KudosReceivedRow 

type KudosReceivedRow struct {
	GivenBy pgtype.UUID
	GivenAt pgtype.Timestamptz
}

type Label 

type Label struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Name         string
	ColorToken   string
	Description  *string
	DeletedAt    pgtype.Timestamptz
	Version      int32
}

type LastAuditAnchorRow 

type LastAuditAnchorRow struct {
	AnchoredAt  pgtype.Timestamptz
	LastSeq     int64
	ChainHash   []byte
	Destination *string
	Receipt     *string
}

type LastAuditEntryRow 

type LastAuditEntryRow struct {
	Seq  int64
	Hash []byte
}

type LastSuccessfulBackupPerTargetRow 

type LastSuccessfulBackupPerTargetRow struct {
	TargetID      pgtype.UUID
	LastSuccessAt pgtype.Timestamptz
}

type LastWorkItemOrderKeyParams 

type LastWorkItemOrderKeyParams struct {
	CollectionID pgtype.UUID
	ParentID     pgtype.UUID
}

type LatestConsentParams 

type LatestConsentParams struct {
	Purpose   string
	AccountID pgtype.UUID
}

type LatestConsentRow 

type LatestConsentRow struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	Purpose   string
	Granted   bool
	GrantedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
	Source    *string
}

type LatestRuleRunsRow 

type LatestRuleRunsRow struct {
	RuleID    pgtype.UUID
	Status    string
	StartedAt pgtype.Timestamptz
}

type LatestSuccessfulBackupRunRow 

type LatestSuccessfulBackupRunRow struct {
	ID          pgtype.UUID
	ScheduleID  pgtype.UUID
	TargetID    pgtype.UUID
	TenantID    pgtype.UUID
	ParentRunID pgtype.UUID
	Trigger     string
	Mode        string
	Status      string
	ArchivePath *string
	SizeBytes   *int64
	ItemCount   *int32
	MediaCount  *int32
	Checksum    *string
	SnapshotAt  pgtype.Timestamptz
	StartedAt   pgtype.Timestamptz
	FinishedAt  pgtype.Timestamptz
	ErrorCode   *string
	ExpiresAt   pgtype.Timestamptz
	VerifiedAt  pgtype.Timestamptz
	VerifyOk    *bool
	TrialReport []byte
	TrialAt     pgtype.Timestamptz
}

type LeftOutOfWorkspaceRow 

type LeftOutOfWorkspaceRow struct {
	Key   string
	Value []byte
}

type LegalHold 

type LegalHold struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	ScopeKind      string
	ScopeID        pgtype.UUID
	Reason         string
	PlacedBy       pgtype.UUID
	PlacedAt       pgtype.Timestamptz
	ReleasedBy     pgtype.UUID
	ReleasedAt     pgtype.Timestamptz
	ReleasedReason *string
}

type LegalHoldTargetExistsParams 

type LegalHoldTargetExistsParams struct {
	ScopeKind string
	ScopeID   pgtype.UUID
}

type LinkAccountIdentityParams 

type LinkAccountIdentityParams struct {
	ProviderID pgtype.UUID
	Subject    string
	Now        pgtype.Timestamptz
	AccountID  pgtype.UUID
}

type ListActivityParams 

type ListActivityParams struct {
	ItemID           pgtype.UUID
	CursorOccurredAt pgtype.Timestamptz
	CursorID         pgtype.UUID
	PageSize         int32
}

type ListActivityRow 

type ListActivityRow struct {
	ID          pgtype.UUID
	ItemID      pgtype.UUID
	ContainerID pgtype.UUID
	ActorType   string
	ActorID     pgtype.UUID
	Verb        string
	ChangeSet   []byte
	OccurredAt  pgtype.Timestamptz
}

type ListAuditEntriesParams 

type ListAuditEntriesParams struct {
	FromTime         pgtype.Timestamptz
	ToTime           pgtype.Timestamptz
	ActionPrefix     *string
	ActionAlso       []string
	ActorID          pgtype.UUID
	TargetType       *string
	TargetID         pgtype.UUID
	Outcome          *string
	CursorOccurredAt pgtype.Timestamptz
	CursorID         pgtype.UUID
	PageSize         int32
}

type ListAutomationRulesParams 

type ListAutomationRulesParams struct {
	Enabled  *bool
	After    pgtype.UUID
	PageSize int32
}

type ListAutomationRulesRow 

type ListAutomationRulesRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type ListBackupTargetsRow 

type ListBackupTargetsRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	Name            string
	Kind            string
	Config          []byte
	CredentialKeyID *string
	EncryptionMode  string
	EncryptionKeyID *string
	RegionNote      *string
	InsecureAckBy   pgtype.UUID
	InsecureAckAt   pgtype.Timestamptz
	Enabled         bool
	LastTestAt      pgtype.Timestamptz
	LastTestOk      *bool
	LastTestError   *string
	CreatedAt       pgtype.Timestamptz
	CreatedBy       pgtype.UUID
	Version         int32
}

type ListCalendarFeedsForAccountRow 

type ListCalendarFeedsForAccountRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	ViewID    pgtype.UUID
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type ListCapabilityProfilesRow 

type ListCapabilityProfilesRow struct {
	Type              ItemType
	Capabilities      []string
	AllowedChildTypes []ItemType
	MaxDepth          int32
}

type ListCollectionsInOrderParams 

type ListCollectionsInOrderParams struct {
	IncludePrivate    bool
	CursorHubOrderKey *string
	CursorHubID       pgtype.UUID
	CursorOrderKey    *string
	CursorID          pgtype.UUID
	PageSize          int32
}

type ListCollectionsInOrderRow 

type ListCollectionsInOrderRow struct {
	ID                   pgtype.UUID
	TenantID             pgtype.UUID
	Type                 ContainerType
	ParentID             pgtype.UUID
	Name                 string
	Description          *string
	Icon                 *string
	ColorToken           *string
	OrderKey             string
	CompletionPolicy     string
	AutoAssignStrategy   *string
	AutoAssignCandidates []byte
	AutoAssignEnabled    *bool
	ArchivedAt           pgtype.Timestamptz
	ParentArchivedAt     pgtype.Timestamptz
	DeletedAt            pgtype.Timestamptz
	TrashBatchID         pgtype.UUID
	CreatedBy            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	UpdatedAt            pgtype.Timestamptz
	Version              int32
	Private              bool
	Handle               *string
	HubName              string
	HubOrderKey          string
	HubPrivate           bool
}

type ListCommentsParams 

type ListCommentsParams struct {
	ItemID          pgtype.UUID
	CursorCreatedAt pgtype.Timestamptz
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListCommentsRow 

type ListCommentsRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	ItemID          pgtype.UUID
	AuthorID        pgtype.UUID
	ParentCommentID pgtype.UUID
	Body            string
	CreatedAt       pgtype.Timestamptz
	EditedAt        pgtype.Timestamptz
	DeletedAt       pgtype.Timestamptz
	Version         int32
	Kind            string
	SystemCode      *string
	SystemParams    []byte
}

type ListContainersParams 

type ListContainersParams struct {
	ParentID        pgtype.UUID
	Type            *ContainerType
	IncludeArchived bool
	CursorOrderKey  *string
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListContainersRow 

type ListContainersRow struct {
	ID                   pgtype.UUID
	TenantID             pgtype.UUID
	Type                 ContainerType
	ParentID             pgtype.UUID
	Name                 string
	Description          *string
	Icon                 *string
	ColorToken           *string
	OrderKey             string
	CompletionPolicy     string
	Structure            string
	AutoAssignStrategy   *string
	AutoAssignCandidates []byte
	AutoAssignEnabled    *bool
	ArchivedAt           pgtype.Timestamptz
	ParentArchivedAt     pgtype.Timestamptz
	DeletedAt            pgtype.Timestamptz
	TrashBatchID         pgtype.UUID
	CreatedBy            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	UpdatedAt            pgtype.Timestamptz
	Version              int32
	Private              bool
	Handle               *string
}

type ListCustomFieldsInScopeRow 

type ListCustomFieldsInScopeRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	CollectionID pgtype.UUID
	Key          string
	Kind         string
	Options      []byte
	IsRequired   bool
	AppliesTo    []ItemType
	CreatedAt    pgtype.Timestamptz
	UpdatedAt    pgtype.Timestamptz
	DeletedAt    pgtype.Timestamptz
	Version      int32
}

type ListDataSubjectRequestsParams 

type ListDataSubjectRequestsParams struct {
	IncludeClosed bool
	Status        *string
	Kind          *string
	DueBefore     pgtype.Timestamptz
	CursorDueAt   pgtype.Timestamptz
	CursorID      pgtype.UUID
	PageSize      int32
}

type ListDataSubjectRequestsRow 

type ListDataSubjectRequestsRow struct {
	ID               pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	Kind             string
	Status           string
	Scope            string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	CompletedAt      pgtype.Timestamptz
	HandledBy        pgtype.UUID
	RejectionReason  *string
	TargetID         pgtype.UUID
	ResultArchive    *string
	Notes            *string
	OriginalDueAt    pgtype.Timestamptz
	ExtensionReason  *string
	InformedOn       pgtype.Date
}

type ListDevicesOfAccountRow 

type ListDevicesOfAccountRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	LastSeenAt   pgtype.Timestamptz
	Blocked      bool
	CreatedAt    pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type ListDueRemindersParams 

type ListDueRemindersParams struct {
	Now       pgtype.Timestamptz
	BatchSize int32
}

type ListDueRemindersRow 

type ListDueRemindersRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
	UpdatedAt  pgtype.Timestamptz
	Version    int32
}

type ListGroupsParams 

type ListGroupsParams struct {
	CursorName *string
	CursorID   pgtype.UUID
	PageSize   int32
}

type ListGroupsRow 

type ListGroupsRow struct {
	ID          pgtype.UUID
	Name        string
	Description *string
	Version     int32
}

type ListIdentityProviderSecretsRow 

type ListIdentityProviderSecretsRow struct {
	ID                pgtype.UUID
	ClientSecretEnc   []byte
	ClientSecretKeyID string
}

type ListIdentityProvidersRow 

type ListIdentityProvidersRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	OfferedWorkspaces   int32
}

type ListInstallationPresetsRow 

type ListInstallationPresetsRow struct {
	ID        pgtype.UUID
	Name      string
	Settings  []byte
	IsDefault bool
	Locks     []string
	Version   int32
}

type ListItemAttachmentsParams 

type ListItemAttachmentsParams struct {
	ItemID          pgtype.UUID
	CursorCreatedAt pgtype.Timestamptz
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListItemAttachmentsRow 

type ListItemAttachmentsRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	StorageKey string
	FileName   *string
	MimeType   string
	ByteSize   int64
	Checksum   *string
	Usage      string
	Status     string
	RefCount   int32
	CreatedBy  pgtype.UUID
	CreatedAt  pgtype.Timestamptz
	DeletedAt  pgtype.Timestamptz
}

type ListJumbleEntriesParams 

type ListJumbleEntriesParams struct {
	Status   *string
	Channel  *string
	After    pgtype.UUID
	PageSize int32
}

type ListJumbleEntriesRow 

type ListJumbleEntriesRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Channel      string
	Sender       *string
	RawSubject   *string
	RawBody      *string
	Attachments  []pgtype.UUID
	Status       string
	TargetItemID pgtype.UUID
	ReceivedAt   pgtype.Timestamptz
	ProcessedAt  pgtype.Timestamptz
	CreatedBy    pgtype.UUID
	MeantForKind *string
	MeantForID   pgtype.UUID
	IntakeReason *string
	ArrivalJobID pgtype.UUID
}

type ListLabelsOfItemsRow 

type ListLabelsOfItemsRow struct {
	ItemID  pgtype.UUID
	LabelID pgtype.UUID
}

type ListLegalHoldsRow 

type ListLegalHoldsRow struct {
	ID             pgtype.UUID
	ScopeKind      string
	ScopeID        pgtype.UUID
	Reason         string
	PlacedBy       pgtype.UUID
	PlacedAt       pgtype.Timestamptz
	ReleasedBy     pgtype.UUID
	ReleasedAt     pgtype.Timestamptz
	ReleasedReason *string
}

type ListMailboxesRow 

type ListMailboxesRow struct {
	ID                pgtype.UUID
	Protocol          string
	Address           string
	Host              *string
	Port              *int32
	SessionUrl        *string
	Username          string
	Folder            string
	DoneFolder        string
	Preset            *string
	Enabled           bool
	CheckedAt         pgtype.Timestamptz
	Failure           *string
	FailingSince      pgtype.Timestamptz
	CreatedAt         pgtype.Timestamptz
	Auth              string
	OauthProvider     *string
	OauthAuthorizeUrl *string
	OauthTokenUrl     *string
	OauthScopes       []string
	OauthClientID     *string
	OauthInstallation bool
}

type ListMediaReferencingItemsRow 

type ListMediaReferencingItemsRow struct {
	ID           pgtype.UUID
	CollectionID pgtype.UUID
}

type ListMembershipsAtScopeParams 

type ListMembershipsAtScopeParams struct {
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	After     pgtype.UUID
	PageSize  int32
}

type ListMembershipsAtScopeRow 

type ListMembershipsAtScopeRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type ListOauthClientsRow 

type ListOauthClientsRow struct {
	ID           pgtype.UUID
	Name         string
	Confidential bool
	RedirectUris []string
	CreatedAt    pgtype.Timestamptz
}

type ListOauthGrantsRow 

type ListOauthGrantsRow struct {
	ID         pgtype.UUID
	ClientID   pgtype.UUID
	ClientName string
	Scopes     []string
	CreatedAt  pgtype.Timestamptz
	LastUsedAt interface{}
}

type ListOfferedAiProviderSecretsRow 

type ListOfferedAiProviderSecretsRow struct {
	ID          pgtype.UUID
	ApiKeyEnc   []byte
	ApiKeyKeyID *string
}

type ListOfferedAiProvidersRow 

type ListOfferedAiProvidersRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	HasApiKey       bool
	Jurisdiction    string
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
}

type ListPausedAutomationRulesRow 

type ListPausedAutomationRulesRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type ListPendingRemindersOfItemRow 

type ListPendingRemindersOfItemRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
	UpdatedAt  pgtype.Timestamptz
	Version    int32
}

type ListPlansRow 

type ListPlansRow struct {
	ID          pgtype.UUID
	Name        string
	DisplayName string
	Version     int32
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
}

type ListPlatformSubscriptionsRow 

type ListPlatformSubscriptionsRow struct {
	ID             pgtype.UUID
	TargetUrl      string
	SecretEnc      []byte
	SecretKeyID    string
	State          string
	LastError      *string
	LastDeliveryAt pgtype.Timestamptz
	FromFile       bool
	CreatedAt      pgtype.Timestamptz
	Version        int32
	DeadLetters    int64
}

type ListPrivateHubAccessesParams 

type ListPrivateHubAccessesParams struct {
	HubID    pgtype.UUID
	PageSize int32
}

type ListPrivateHubsRow 

type ListPrivateHubsRow struct {
	ID              pgtype.UUID
	CreatedAt       pgtype.Timestamptz
	DeletedAt       pgtype.Timestamptz
	Owners          []pgtype.UUID
	Collections     int64
	Entries         int64
	AttachmentBytes int64
}

type ListRemindersOfItemRow 

type ListRemindersOfItemRow struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
	UpdatedAt  pgtype.Timestamptz
	Version    int32
}

type ListRuleRunsParams 

type ListRuleRunsParams struct {
	RuleID   pgtype.UUID
	Status   *string
	Trigger  *string
	FromTime pgtype.Timestamptz
	ToTime   pgtype.Timestamptz
	After    pgtype.UUID
	PageSize int32
}

type ListRuleRunsRow 

type ListRuleRunsRow struct {
	ID               pgtype.UUID
	RuleID           pgtype.UUID
	EventID          pgtype.UUID
	Trigger          string
	TriggeredBy      pgtype.UUID
	SubjectID        pgtype.UUID
	Status           string
	ConditionResults []byte
	ActionResults    []byte
	Occasion         *string
	ErrorCode        *string
	StartedAt        pgtype.Timestamptz
	FinishedAt       pgtype.Timestamptz
	CausationDepth   int32
}

type ListSavedViewsReachableParams 

type ListSavedViewsReachableParams struct {
	OwnerID  pgtype.UUID
	ScopeIds []pgtype.UUID
}

type ListSetElementsParams 

type ListSetElementsParams struct {
	ItemID  pgtype.UUID
	SetName string
}

type ListSetElementsRow 

type ListSetElementsRow struct {
	ElementID pgtype.UUID
	AddTag    *string
	RemoveTag *string
}

type ListStructureHeirsParams 

type ListStructureHeirsParams struct {
	HubID   pgtype.UUID
	Ceiling int32
}

type ListStructureHeirsRow 

type ListStructureHeirsRow struct {
	ID                   pgtype.UUID
	TenantID             pgtype.UUID
	Type                 ContainerType
	ParentID             pgtype.UUID
	Name                 string
	Description          *string
	Icon                 *string
	ColorToken           *string
	OrderKey             string
	CompletionPolicy     string
	Structure            string
	AutoAssignStrategy   *string
	AutoAssignCandidates []byte
	AutoAssignEnabled    *bool
	ArchivedAt           pgtype.Timestamptz
	ParentArchivedAt     pgtype.Timestamptz
	DeletedAt            pgtype.Timestamptz
	TrashBatchID         pgtype.UUID
	CreatedBy            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	UpdatedAt            pgtype.Timestamptz
	Version              int32
	Private              bool
	Handle               *string
}

type ListStructurePresetsOfferedRow 

type ListStructurePresetsOfferedRow struct {
	ID        pgtype.UUID
	Origin    string
	OwnerID   pgtype.UUID
	Name      string
	Settings  []byte
	CreatedAt pgtype.Timestamptz
	Version   int32
}

type ListSuggestionsParams 

type ListSuggestionsParams struct {
	TargetType      string
	TargetID        pgtype.UUID
	Status          *string
	CursorCreatedAt pgtype.Timestamptz
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListSuggestionsRow 

type ListSuggestionsRow struct {
	ID            pgtype.UUID
	TargetType    string
	TargetID      pgtype.UUID
	Kind          string
	Status        string
	Payload       []byte
	Source        string
	Model         string
	PromptID      string
	PromptVersion string
	ProducedAt    pgtype.Timestamptz
	InputDigest   []byte
	CreatedAt     pgtype.Timestamptz
	DecidedAt     pgtype.Timestamptz
	DecidedBy     pgtype.UUID
	Version       int32
	DroppedNodes  int32
}

type ListSystemCapabilityProfilesRow 

type ListSystemCapabilityProfilesRow struct {
	Type              ItemType
	Capabilities      []string
	AllowedChildTypes []ItemType
	MaxDepth          int32
}

type ListTemplatesInScopesParams 

type ListTemplatesInScopesParams struct {
	ScopeIds        []pgtype.UUID
	CursorCreatedAt pgtype.Timestamptz
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListTemplatesInScopesRow 

type ListTemplatesInScopesRow struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	ScopeType   string
	ScopeID     pgtype.UUID
	Name        string
	Description *string
	RootType    ItemType
	Nodes       []byte
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
	DeletedAt   pgtype.Timestamptz
	Version     int32
}

type ListTenantHostsRow 

type ListTenantHostsRow struct {
	Host         string
	State        string
	Verification string
	VerifiedAt   pgtype.Timestamptz
	IsCanonical  bool
	CreatedAt    pgtype.Timestamptz
}

type ListTenantStorageKeysParams 

type ListTenantStorageKeysParams struct {
	After string
	Batch int32
}

type ListTrashParams 

type ListTrashParams struct {
	CursorDeletedAt pgtype.Timestamptz
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListTrashRow 

type ListTrashRow struct {
	Kind          string
	ID            pgtype.UUID
	TrashBatchID  pgtype.UUID
	DeletedAt     pgtype.Timestamptz
	DeletedByType *string
	DeletedByID   pgtype.UUID
	Title         string
	Subtype       string
	HubID         pgtype.UUID
	CollectionID  pgtype.UUID
	ParentID      pgtype.UUID
	Version       int32
}

type ListVoiceAliasesRow 

type ListVoiceAliasesRow struct {
	ID           pgtype.UUID
	Phrase       string
	CollectionID pgtype.UUID
	LabelID      pgtype.UUID
}

type ListWebhookSubscriptionsRow 

type ListWebhookSubscriptionsRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	TargetUrl           string
	EventTypes          []string
	FilterExpr          *string
	ScopeType           *string
	ScopeID             pgtype.UUID
	SecretEnc           []byte
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	PreviousSecretUntil pgtype.Timestamptz
	State               string
	FailureCount        int32
	LastError           *string
	DisabledAt          pgtype.Timestamptz
	CreatedBy           pgtype.UUID
	CreatedAt           pgtype.Timestamptz
	Version             int32
}

type ListWorkItemsParams 

type ListWorkItemsParams struct {
	CollectionID    pgtype.UUID
	ParentID        pgtype.UUID
	IncludeArchived bool
	RestrictTo      []pgtype.UUID
	CursorOrderKey  *string
	CursorID        pgtype.UUID
	PageSize        int32
}

type ListWorkItemsRow 

type ListWorkItemsRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type LockAccountForAddressRow 

type LockAccountForAddressRow struct {
	ID         pgtype.UUID
	Email      *string
	SignInName *string
	Status     AccountStatus
}

type LockAccountStatusRow 

type LockAccountStatusRow struct {
	Status         AccountStatus
	InvitationOpen bool
}

type LockAutoAssignPolicyParams 

type LockAutoAssignPolicyParams struct {
	ScopeType string
	ScopeID   pgtype.UUID
}

type LockHubOfRow 

type LockHubOfRow struct {
	ID      pgtype.UUID
	Private bool
}

type MailReceipt 

type MailReceipt struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	MessageID  string
	ReceivedAt pgtype.Timestamptz
	Sender     string
	Subject    string
	Outcome    string
	Reason     string
	ItemID     pgtype.UUID
	EntryID    pgtype.UUID
	Door       string
}

type MailSetting 

type MailSetting struct {
	TenantID            pgtype.UUID
	Enabled             bool
	Name                *string
	DefaultCollectionID pgtype.UUID
	SenderLevel         string
	Allowed             []string
	Blocked             []string
	SenderRoutes        []byte
	OpenedBy            pgtype.UUID
	UpdatedAt           pgtype.Timestamptz
	UpdatedBy           pgtype.UUID
}

type Mailbox 

type Mailbox struct {
	ID                pgtype.UUID
	TenantID          pgtype.UUID
	Protocol          string
	Address           string
	Host              *string
	Port              *int32
	SessionUrl        *string
	Username          string
	Folder            string
	DoneFolder        string
	Preset            *string
	Enabled           bool
	SecretEnc         []byte
	SecretKeyID       string
	CheckedAt         pgtype.Timestamptz
	Failure           *string
	FailingSince      pgtype.Timestamptz
	Auth              string
	OauthProvider     *string
	OauthAuthorizeUrl *string
	OauthTokenUrl     *string
	OauthScopes       []string
	OauthClientID     *string
	OauthInstallation bool
	CreatedAt         pgtype.Timestamptz
	CreatedBy         pgtype.UUID
}

type MailboxAuthorization 

type MailboxAuthorization struct {
	ID                pgtype.UUID
	TenantID          pgtype.UUID
	AccountID         pgtype.UUID
	StateHash         []byte
	Provider          string
	AuthorizeUrl      string
	TokenUrl          string
	Scopes            []string
	ClientID          string
	Installation      bool
	Host              string
	Port              int32
	LoginHint         *string
	VerifierEnc       []byte
	VerifierKeyID     string
	ClientSecretEnc   []byte
	ClientSecretKeyID *string
	ExpiresAt         pgtype.Timestamptz
}

type MarkEventsDispatchedParams 

type MarkEventsDispatchedParams struct {
	DispatchedAt pgtype.Timestamptz
	Ids          []pgtype.UUID
}

type MarkItemsForRetentionParams 

type MarkItemsForRetentionParams struct {
	EffectiveAt pgtype.Timestamptz
	RuleID      pgtype.UUID
	Action      *string
	Ids         []pgtype.UUID
}

type MarkMediaOrphansParams 

type MarkMediaOrphansParams struct {
	Now                pgtype.Timestamptz
	UnreferencedBefore pgtype.Timestamptz
	PendingBefore      pgtype.Timestamptz
}

type MarkPasskeyUsedParams 

type MarkPasskeyUsedParams struct {
	SignCount int64
	UsedAt    pgtype.Timestamptz
	BackedUp  bool
	ID        pgtype.UUID
}

type MarkQuotaReachedParams 

type MarkQuotaReachedParams struct {
	Quota     string
	Period    string
	ReachedAt pgtype.Timestamptz
}

type MediaObject 

type MediaObject struct {
	ID                pgtype.UUID
	TenantID          pgtype.UUID
	StorageKey        string
	MimeType          string
	ByteSize          int64
	Checksum          *string
	Usage             string
	RefCount          int32
	CreatedBy         pgtype.UUID
	CreatedAt         pgtype.Timestamptz
	DeletedAt         pgtype.Timestamptz
	Status            string
	FileName          *string
	UnreferencedSince pgtype.Timestamptz
}

type MediaUploadedByRow 

type MediaUploadedByRow struct {
	ID         pgtype.UUID
	StorageKey string
}

type Membership 

type Membership struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
	CreatedAt pgtype.Timestamptz
}

type MembershipRole 

type MembershipRole string
const (
	MembershipRoleOWNER       MembershipRole = "OWNER"
	MembershipRoleADMIN       MembershipRole = "ADMIN"
	MembershipRoleMEMBER      MembershipRole = "MEMBER"
	MembershipRoleCONTRIBUTOR MembershipRole = "CONTRIBUTOR"
	MembershipRoleVIEWER      MembershipRole = "VIEWER"
	MembershipRoleGUEST       MembershipRole = "GUEST"
	MembershipRoleAUDITOR     MembershipRole = "AUDITOR"
)

func (*MembershipRole) Scan 

func (e *MembershipRole) Scan(src interface{}) error

type MembershipScope 

type MembershipScope string
const (
	MembershipScopeTENANT     MembershipScope = "TENANT"
	MembershipScopeHUB        MembershipScope = "HUB"
	MembershipScopeCOLLECTION MembershipScope = "COLLECTION"
	MembershipScopeITEM       MembershipScope = "ITEM"
)

func (*MembershipScope) Scan 

func (e *MembershipScope) Scan(src interface{}) error

type MembershipsAlongPathParams 

type MembershipsAlongPathParams struct {
	AccountID pgtype.UUID
	ScopeIds  []pgtype.UUID
}

type MembershipsAlongPathRow 

type MembershipsAlongPathRow struct {
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type MembershipsOfGroupRow 

type MembershipsOfGroupRow struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	GroupID   pgtype.UUID
	ScopeType MembershipScope
	ScopeID   pgtype.UUID
	Role      MembershipRole
}

type MilestonesOfRow 

type MilestonesOfRow struct {
	ContainerID pgtype.UUID
	ReachedAt   pgtype.Timestamptz
}

type MintAddressTokenParams 

type MintAddressTokenParams struct {
	TokenHash []byte
	ID        pgtype.UUID
	Now       pgtype.Timestamptz
}

type MintAddressTokenRow 

type MintAddressTokenRow struct {
	Address     string
	DisplayName string
	Locale      *string
}

type MoveItemsBetweenBucketsParams 

type MoveItemsBetweenBucketsParams struct {
	TargetBucketID pgtype.UUID
	UpdatedAt      pgtype.Timestamptz
	SourceBucketID pgtype.UUID
}

type MoveWorkItemSubtreeParams 

type MoveWorkItemSubtreeParams struct {
	CollectionID pgtype.UUID
	NewPrefix    string
	OldPrefix    string
	DepthDelta   int32
	UpdatedAt    pgtype.Timestamptz
	ItemID       pgtype.UUID
}

type NarrowSuggestionParams 

type NarrowSuggestionParams struct {
	Payload         []byte
	ID              pgtype.UUID
	ExpectedVersion int32
}

type Notification 

type Notification struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	RecipientID        pgtype.UUID
	Category           string
	Channel            string
	State              string
	Reason             *string
	EventID            pgtype.UUID
	ItemID             pgtype.UUID
	ActorID            pgtype.UUID
	CreatedAt          pgtype.Timestamptz
	SentAt             pgtype.Timestamptz
	Attempts           int32
	RuleID             pgtype.UUID
	SubscriptionID     pgtype.UUID
	PrivateHubAccessID pgtype.UUID
	MembershipID       pgtype.UUID
}

type NotificationPreference 

type NotificationPreference struct {
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Category     string
	Channel      string
	Enabled      bool
	IncludeTitle bool
	UpdatedAt    pgtype.Timestamptz
}

type NullAccountKind 

type NullAccountKind struct {
	AccountKind AccountKind
	Valid       bool // Valid is true if AccountKind is not NULL
}

func (*NullAccountKind) Scan 

func (ns *NullAccountKind) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullAccountKind) Value 

func (ns NullAccountKind) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullAccountStatus 

type NullAccountStatus struct {
	AccountStatus AccountStatus
	Valid         bool // Valid is true if AccountStatus is not NULL
}

func (*NullAccountStatus) Scan 

func (ns *NullAccountStatus) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullAccountStatus) Value 

func (ns NullAccountStatus) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullContainerType 

type NullContainerType struct {
	ContainerType ContainerType
	Valid         bool // Valid is true if ContainerType is not NULL
}

func (*NullContainerType) Scan 

func (ns *NullContainerType) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullContainerType) Value 

func (ns NullContainerType) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullItemType 

type NullItemType struct {
	ItemType ItemType
	Valid    bool // Valid is true if ItemType is not NULL
}

func (*NullItemType) Scan 

func (ns *NullItemType) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullItemType) Value 

func (ns NullItemType) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullMembershipRole 

type NullMembershipRole struct {
	MembershipRole MembershipRole
	Valid          bool // Valid is true if MembershipRole is not NULL
}

func (*NullMembershipRole) Scan 

func (ns *NullMembershipRole) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullMembershipRole) Value 

func (ns NullMembershipRole) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullMembershipScope 

type NullMembershipScope struct {
	MembershipScope MembershipScope
	Valid           bool // Valid is true if MembershipScope is not NULL
}

func (*NullMembershipScope) Scan 

func (ns *NullMembershipScope) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullMembershipScope) Value 

func (ns NullMembershipScope) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type NullTenantStatus 

type NullTenantStatus struct {
	TenantStatus TenantStatus
	Valid        bool // Valid is true if TenantStatus is not NULL
}

func (*NullTenantStatus) Scan 

func (ns *NullTenantStatus) Scan(value interface{}) error

Scan implements the Scanner interface.

func (NullTenantStatus) Value 

func (ns NullTenantStatus) Value() (driver.Value, error)

Value implements the driver Valuer interface.

type OauthClient 

type OauthClient struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Name         string
	Confidential bool
	SecretHash   []byte
	RedirectUris []string
	CreatedAt    pgtype.Timestamptz
	CreatedBy    pgtype.UUID
	Version      int32
}

type OauthCode 

type OauthCode struct {
	ID            pgtype.UUID
	TenantID      pgtype.UUID
	ClientID      pgtype.UUID
	AccountID     pgtype.UUID
	GrantID       pgtype.UUID
	CodeHash      []byte
	CodeChallenge string
	RedirectUri   string
	CreatedAt     pgtype.Timestamptz
	ExpiresAt     pgtype.Timestamptz
	ConsumedAt    pgtype.Timestamptz
}

type OauthGrant 

type OauthGrant struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	ClientID  pgtype.UUID
	Scopes    []string
	CreatedAt pgtype.Timestamptz
	RevokedAt pgtype.Timestamptz
}

type OidcFlow 

type OidcFlow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	StateHash        []byte
	CodeVerifier     string
	Nonce            string
	CreatedAt        pgtype.Timestamptz
	ExpiresAt        pgtype.Timestamptz
	ConsumedAt       pgtype.Timestamptz
	ProviderID       pgtype.UUID
	SessionID        pgtype.UUID
	InvitedAccountID pgtype.UUID
	PendingID        pgtype.UUID
	TermsUrl         *string
	TermsVersion     *string
	Connect          bool
}

type OidcFlowLiveParams 

type OidcFlowLiveParams struct {
	StateHash []byte
	Now       pgtype.Timestamptz
}

type OpenTenantPasswordParams 

type OpenTenantPasswordParams struct {
	Until     pgtype.Timestamptz
	Requester *string
	Reason    *string
	Now       pgtype.Timestamptz
}

type Operator 

type Operator struct {
	TenantID  pgtype.UUID
	AccountID pgtype.UUID
	AddedAt   pgtype.Timestamptz
	AddedBy   pgtype.UUID
}

type OperatorRegisterStateRow 

type OperatorRegisterStateRow struct {
	Workspaces int64
	Operators  int64
}

type OperatorRosterRow 

type OperatorRosterRow struct {
	TenantID      pgtype.UUID
	AccountID     pgtype.UUID
	AddedAt       pgtype.Timestamptz
	AddedBy       pgtype.UUID
	DisplayName   string
	Email         string
	SignInName    string
	Kind          string
	WorkspaceSlug string
	WorkspaceName string
	AddedByName   string
}

type OrderKeyNeighboursParams 

type OrderKeyNeighboursParams struct {
	CollectionID pgtype.UUID
	ParentID     pgtype.UUID
	MovingID     pgtype.UUID
	BeforeID     pgtype.UUID
}

type OrderKeyNeighboursRow 

type OrderKeyNeighboursRow struct {
	NextKey     string
	PreviousKey string
}

type OutboxEvent 

type OutboxEvent struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	EventType      string
	Subject        *string
	Payload        []byte
	ActorType      string
	ActorID        pgtype.UUID
	CorrelationID  pgtype.UUID
	CausationID    pgtype.UUID
	CausationDepth int32
	OccurredAt     pgtype.Timestamptz
	DispatchedAt   pgtype.Timestamptz
	Attempts       int32
	LockedUntil    pgtype.Timestamptz
	Replay         bool
	ReceivedAt     pgtype.Timestamptz
	PushID         pgtype.UUID
}

type OverdueRequestCountRow 

type OverdueRequestCountRow struct {
	Overdue   int64
	OpenCases int64
	NextDueAt interface{}
}

type PageInstanceJournalParams 

type PageInstanceJournalParams struct {
	BeforeAt     pgtype.Timestamptz
	BeforeID     pgtype.UUID
	ActionPrefix *string
	TenantSlug   *string
	Limit        int32
}

type PendingErasureKeptRow 

type PendingErasureKeptRow struct {
	RequestID pgtype.UUID
	HoldID    pgtype.UUID
}

type Plan 

type Plan struct {
	ID          pgtype.UUID
	Name        string
	DisplayName string
	Version     int32
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
	UpdatedBy   pgtype.UUID
	RemovedAt   pgtype.Timestamptz
}

type PlanOfWorkspaceRow 

type PlanOfWorkspaceRow struct {
	ID          pgtype.UUID
	Name        string
	DisplayName string
	Version     int32
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
}

type PlanSetting 

type PlanSetting struct {
	PlanID pgtype.UUID
	Key    string
	Value  []byte
	Locked bool
}

type PlanWorkspaceCountsRow 

type PlanWorkspaceCountsRow struct {
	PlanName   string
	Workspaces int64
}

type PlatformDeliveriesParams 

type PlatformDeliveriesParams struct {
	SubscriptionID pgtype.UUID
	Status         *string
	Before         pgtype.UUID
	PageSize       int32
}

type PlatformDelivery 

type PlatformDelivery struct {
	ID             pgtype.UUID
	SubscriptionID pgtype.UUID
	EventID        pgtype.UUID
	EventType      string
	Attempt        int32
	Status         string
	ResponseStatus *int32
	ErrorCode      *string
	NextAttemptAt  pgtype.Timestamptz
	CreatedAt      pgtype.Timestamptz
	UpdatedAt      pgtype.Timestamptz
}

type PlatformEvent 

type PlatformEvent struct {
	Number     int64
	ID         pgtype.UUID
	EventType  string
	TenantID   pgtype.UUID
	OccurredAt pgtype.Timestamptz
	ActorType  string
	ActorID    pgtype.UUID
	Payload    []byte
	DedupeKey  *string
}

type PlatformEventsAfterParams 

type PlatformEventsAfterParams struct {
	After    int64
	PageSize int32
}

type PlatformEventsAfterRow 

type PlatformEventsAfterRow struct {
	Number     int64
	ID         pgtype.UUID
	EventType  string
	TenantID   pgtype.UUID
	OccurredAt pgtype.Timestamptz
	ActorType  string
	ActorID    pgtype.UUID
	Payload    []byte
}

type PlatformSubscription 

type PlatformSubscription struct {
	ID             pgtype.UUID
	TargetUrl      string
	SecretEnc      []byte
	SecretKeyID    string
	State          string
	LastError      *string
	LastDeliveryAt pgtype.Timestamptz
	FromFile       bool
	CreatedAt      pgtype.Timestamptz
	CreatedBy      pgtype.UUID
	UpdatedAt      pgtype.Timestamptz
	Version        int32
}

type PollOutboxEventsParams 

type PollOutboxEventsParams struct {
	EventType       string
	Horizon         pgtype.Timestamptz
	AfterOccurredAt pgtype.Timestamptz
	AfterID         pgtype.UUID
	Batch           int32
}

type PollOutboxEventsRow 

type PollOutboxEventsRow struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	EventType      string
	Subject        *string
	Payload        []byte
	ActorType      string
	ActorID        pgtype.UUID
	CorrelationID  pgtype.UUID
	CausationID    pgtype.UUID
	CausationDepth int32
	OccurredAt     pgtype.Timestamptz
	Replay         bool
	ReceivedAt     pgtype.Timestamptz
	PushID         pgtype.UUID
}

type PrivacyIncident 

type PrivacyIncident struct {
	ID                pgtype.UUID
	TenantID          pgtype.UUID
	DetectedAt        pgtype.Timestamptz
	ReportedAt        pgtype.Timestamptz
	Severity          string
	DataCategories    []string
	AffectedCount     *int32
	Description       string
	Measures          *string
	AuthorityNotified bool
	SubjectsNotified  bool
	ClosedAt          pgtype.Timestamptz
}

type PrivateHubAccess 

type PrivateHubAccess struct {
	ID       pgtype.UUID
	TenantID pgtype.UUID
	HubID    pgtype.UUID
	OpenedBy pgtype.UUID
	Reason   string
	OpenedAt pgtype.Timestamptz
	EndsAt   pgtype.Timestamptz
}

type PurgeFinishedJobsParams 

type PurgeFinishedJobsParams struct {
	Before pgtype.Timestamptz
	Batch  int32
}

type PutAiRequestParams 

type PutAiRequestParams struct {
	ID        pgtype.UUID
	AskedBy   pgtype.UUID
	Text      string
	CreatedAt pgtype.Timestamptz
}

type PutInstanceSettingParams 

type PutInstanceSettingParams struct {
	Key        string
	Value      []byte
	LockOrigin string
	UpdatedBy  pgtype.UUID
	UpdatedAt  pgtype.Timestamptz
}

type PutPlanSettingParams 

type PutPlanSettingParams struct {
	PlanID pgtype.UUID
	Key    string
	Value  []byte
	Locked bool
}

type Queries 

type Queries struct {
	// contains filtered or unexported fields
}

func New 

func New(db DBTX) *Queries

func (*Queries) AcceptInvitation 

func (q *Queries) AcceptInvitation(ctx context.Context, arg AcceptInvitationParams) (int64, error)

The provider's half of redeeming an invitation: the invited account becomes ACTIVE and the invitation is spent, in one statement - unless it ran out, which the provider's word does not renew. No password is set: the person signs in through the provider.

func (*Queries) AccessTokensForAccount 

func (q *Queries) AccessTokensForAccount(ctx context.Context, accountID pgtype.UUID) ([]AccessTokensForAccountRow, error)

Newest first, which is the order somebody reads their own credentials in. Bounded by the account rather than by a page: a person holds a handful, and the index answers both the filter and the sort (access_token_account_idx).

func (*Queries) AccountGroupExists 

func (q *Queries) AccountGroupExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) AccountHasIdentity 

func (q *Queries) AccountHasIdentity(ctx context.Context, accountID pgtype.UUID) (bool, error)

Whether the account already signs in through some provider (ADR-0071's addendum): such an identity is a credential of its own, and an account holding one is not connected to another provider on that provider's word.

func (*Queries) AccountIdentities 

func (q *Queries) AccountIdentities(ctx context.Context, accountID pgtype.UUID) ([]AccountIdentitiesRow, error)

The provider identities an account is connected to, as the person reads them in their own settings: which provider and since when - never the subject. The workspace is named, not left to the policy alone.

func (*Queries) AccountIdentityProviders 

func (q *Queries) AccountIdentityProviders(ctx context.Context, accountID pgtype.UUID) ([]pgtype.UUID, error)

The providers an account is connected to (ADR-0075 §2): a step-up at the provider is offered only at one of these, and only where it is switched on for the workspace - which the caller decides.

func (*Queries) AccountsOfKind 

func (q *Queries) AccountsOfKind(ctx context.Context, kind AccountKind) ([]AccountsOfKindRow, error)

The workspace's service accounts, newest first by identifier - UUIDv7 is time-ordered, so the primary key is the creation order and needs no second column to sort on.

Bounded by the kind rather than by a page: an installation has a handful of integrations, and a cursor over a handful is machinery nobody reads.

func (*Queries) ActingAccountExists 

func (q *Queries) ActingAccountExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) ActivateFirstOwner 

func (q *Queries) ActivateFirstOwner(ctx context.Context, arg ActivateFirstOwnerParams) (int64, error)

The first start's setup (UC-INS-01): the owner it wrote a moment ago in the same transaction gets the password and becomes ACTIVE. No redemption token - the setup code was the proof - so it matches only an invited account that was never sent one.

func (*Queries) ActiveLegalHolds 

func (q *Queries) ActiveLegalHolds(ctx context.Context) ([]ActiveLegalHoldsRow, error)

The end of data's life: the instructions not to delete, and the record of what was deleted anyway (ADR-0020).

The tenant is never a parameter here either: it comes from the transaction's own context through current_tenant_id(), which is the value row level security compares against. That matters more here than anywhere else - a legal hold read across the wrong boundary would not be a wrong answer but somebody else's obligation ignored. Every hold in force for this tenant, released ones left out.

The whole set rather than a question per row: a purge run judges a batch of a thousand rows against holds that are few and change rarely, and a query per row would be a thousand round trips for the same answer. Served by legal_hold_active_idx, which is partial on exactly this predicate.

func (*Queries) ActivePlatformSubscriptionIDs 

func (q *Queries) ActivePlatformSubscriptionIDs(ctx context.Context) ([]pgtype.UUID, error)

func (*Queries) AddGroupMember 

func (q *Queries) AddGroupMember(ctx context.Context, arg AddGroupMemberParams) error

func (*Queries) AddItemLabel 

func (q *Queries) AddItemLabel(ctx context.Context, arg AddItemLabelParams) error

ON CONFLICT DO NOTHING rather than a check first: adding a label an item already carries is the state the caller asked for, and two requests arriving together would otherwise both pass a check and one of them fail on the primary key.

func (*Queries) AddItemMember 

func (q *Queries) AddItemMember(ctx context.Context, arg AddItemMemberParams) error

ON CONFLICT DO NOTHING rather than a check first, for the reason AddItemLabel gives: adding somebody the entry already carries is the state the caller asked for, and two requests arriving together would otherwise both pass a check and one of them fail on the primary key.

func (*Queries) AddUsage 

func (q *Queries) AddUsage(ctx context.Context, arg AddUsageParams) error

The billing ledger's writer: daily tallies for capacity planning and the dashboards, never the enforcement's source - a ledger row can lag, and a limit that lags is a limit that lies.

func (*Queries) AdjustMediaRefCount 

func (q *Queries) AdjustMediaRefCount(ctx context.Context, arg AdjustMediaRefCountParams) (int64, error)

The fast half of reference counting: the use case that adds or drops a reference moves the counter in its own transaction, so DeleteMedia can refuse a referenced object without a scan. The reconciliation job recomputes the counter from the actual references, because a purge's cascade drops attachment rows without passing through here - the counter is a cache, and the recount is what makes it honest (data-protection.md §5).

func (*Queries) AdminTenants 

func (q *Queries) AdminTenants(ctx context.Context) ([]AdminTenantsRow, error)

The control plane (multi-tenancy.md §5): provisioning, suspension, the deletion request and the hard delete after the grace.

Two departures from the query files around this one, both deliberate. The listing goes through the SECURITY DEFINER enumerator migration 0067 pins down - the one legitimate place tenants are enumerated (multi-tenancy.md §2.1). And the statements on the tenant row itself still say current_tenant_id(): the control plane opens an ordinary bounded transaction per tenant it touches, so even here no statement can reach a row its transaction was not opened for. The casts are for the generator: it cannot see into the function's OUT table.

func (*Queries) AdminUsage 

func (q *Queries) AdminUsage(ctx context.Context, arg AdminUsageParams) ([]AdminUsageRow, error)

The control plane's read of the use (migration 0183): a page of workspaces' counts, live and purged, through the one door that reads across them. The columns are named, since a function's table type is not a table the generator knows.

func (*Queries) AdministratorsAlongPath 

func (q *Queries) AdministratorsAlongPath(ctx context.Context, arg AdministratorsAlongPathParams) ([]pgtype.UUID, error)

Who administers anywhere on this path, for the retention advance warning (R-1).

The mirror image of MembershipsAlongPath: that one asks what one account holds, this one asks who holds something. The roles are named here rather than passed in, because "the people who can answer a warning about work that is about to be deleted" is a property of the role matrix and not a parameter a caller gets to choose - a caller that could name VIEWER would be a caller warning everybody.

Through a group as well as directly, on MembershipsAlongPath's reasoning: a right held through a group is not a lesser right, and an administrator who administers through one still administers. Distinct, because somebody who holds the role at two levels is one person.

func (*Queries) AdvanceInstanceLevelVersion 

func (q *Queries) AdvanceInstanceLevelVersion(ctx context.Context, arg AdvanceInstanceLevelVersionParams) (int64, error)

The level's version, moved by one - only from `expected`, when one is named (migration 0184).

The guard is this statement and not a read before it: the conflicting row is locked, so a second save made on the same version waits for the first and then compares against what the first committed, which matches nothing. No row back is the refusal. A NULL `expected` moves it whatever it is: the instance file is the source and wins. A row somebody removed by hand is inserted at 1, so the level never becomes unsaveable.

func (*Queries) AdvanceRecurrenceWatermark 

func (q *Queries) AdvanceRecurrenceWatermark(ctx context.Context, arg AdvanceRecurrenceWatermarkParams) (int64, error)

How far the series has been materialised, moved forward under a compare-and-set.

The predicate is the whole exactly-once argument for occurrences. Two passes that read the same watermark both create the same morning; the first to commit moves it, and the second matches no row, fails, and rolls back the entries it wrote with it - because the pass and its bookkeeping are one transaction. IS NOT DISTINCT FROM rather than =, because the first pass compares against NULL and NULL = NULL is not true.

No version and no stamp: this is the materialisation's own bookkeeping, not an edit somebody made, and a version spent here would answer a client's If-Match with a conflict about a field it does not own.

func (*Queries) AdvanceSyncEpoch 

func (q *Queries) AdvanceSyncEpoch(ctx context.Context) (int64, error)

A restore into the workspace succeeded: every cursor minted before is from an older epoch now, and the device holding one resynchronises from scratch.

func (*Queries) AiNoticedAt 

func (q *Queries) AiNoticedAt(ctx context.Context, accountID pgtype.UUID) (pgtype.Timestamptz, error)

When a person last acknowledged that their objection to AI stopped taking effect.

func (*Queries) AnonymiseAccount 

func (q *Queries) AnonymiseAccount(ctx context.Context, arg AnonymiseAccountParams) (int64, error)

===================== The erasure (Art. 17, QS-19) ========================= Every statement below serves one storage location from the data catalogue (data-protection.md §5). They are separate rather than one procedure because the two modes use different subsets of them, and because what each one removed has to be counted for the record. The mode that keeps the authorship: the row stays, and everything of the person's in it goes.

The display name becomes a marker rather than an empty string, because the audit trail and the item history both carry a denormalised label and a workspace reading " " where somebody used to be is worse than one reading "former user". `status` is what stops every automatic decision from then on (identity.AccountStatus.ProcessingAllowed).

func (*Queries) AnyPlanEver 

func (q *Queries) AnyPlanEver(ctx context.Context) (bool, error)

Whether any plan was ever created, removed ones included: what a seeding file asks, so that a plan an operator removed after the seed is not written again at the next start.

func (*Queries) AppendOutboxEvent 

func (q *Queries) AppendOutboxEvent(ctx context.Context, arg AppendOutboxEventParams) error

The transactional outbox (ADR-0007): the event is written in the same transaction as the change it describes, and the dispatcher delivers it afterwards.

Both halves are here, and both run under row level security: an event is written into the tenant of the transaction, and read out of it again. A dispatcher therefore works one tenant at a time (multi-tenancy.md §2.1) - which is also what stops one busy tenant from filling every batch.

func (*Queries) AppendPasswordHistory 

func (q *Queries) AppendPasswordHistory(ctx context.Context, arg AppendPasswordHistoryParams) error

func (*Queries) AppliedSchemaVersions 

func (q *Queries) AppliedSchemaVersions(ctx context.Context) ([]int64, error)

The migrations the database has applied, for the readiness probe (deployment.md §5). Through the function because the ledger is closed to the application role; it answers numbers only.

func (*Queries) ArchiveItemsForRetention 

func (q *Queries) ArchiveItemsForRetention(ctx context.Context, arg ArchiveItemsForRetentionParams) (int64, error)

The act of an ARCHIVE stage. Only what is not archived already, so a repeated pass writes the same rows rather than moving the date somebody will later count a second stage from.

func (*Queries) ArchiveTenantUsage 

func (q *Queries) ArchiveTenantUsage(ctx context.Context) (int64, error)

At the purge, in its own transaction and the workspace's scope: the counts move to the installation's ledger before the cascade takes them (multi-tenancy.md §4.3).

func (*Queries) AuditHashAt 

func (q *Queries) AuditHashAt(ctx context.Context, seq int64) ([]byte, error)

The stored hash at one sequence number, for an anchor outside the walked period to be compared against. `audit_seq_idx` keeps it a lookup.

func (*Queries) AuditPseudonyms 

func (q *Queries) AuditPseudonyms(ctx context.Context, actorIds []pgtype.UUID) ([]AuditPseudonymsRow, error)

The pseudonyms of a set of actors, for a page of the trail that has just been read.

Asked for the actors on the page rather than read whole: a workspace that has answered a hundred erasures has a hundred rows here, and a page has at most a few dozen distinct actors.

func (*Queries) AutomationRulesSealedNotUnder 

func (q *Queries) AutomationRulesSealedNotUnder(ctx context.Context, keyID string) ([]AutomationRulesSealedNotUnderRow, error)

The rows a re-seal visits (ADR-0045): a rule with an HTTP_REQUEST action - at any depth of a branch - whose sealed header secret names a key other than the current one. The path walks the document so that the query does not have to know the action tree's shape.

func (*Queries) AutomationsRunningAs 

func (q *Queries) AutomationsRunningAs(ctx context.Context, accountID pgtype.UUID) (int64, error)

What stands in the way of a full deletion, counted before it is attempted.

`automation_rule.run_as` is the one reference to an account this schema declares `ON DELETE RESTRICT`, and deliberately so (ADR-0024): a rule that acts as somebody must not quietly start acting as nobody. So an erasure that would leave such a rule behind is refused with a reason rather than attempted and failed on a foreign key - PG-2 found the second, which reached the caller as a dependency error and told them nothing.

func (*Queries) BackupTargetCredentialsNotUnder 

func (q *Queries) BackupTargetCredentialsNotUnder(ctx context.Context, keyID *string) ([]BackupTargetCredentialsNotUnderRow, error)

The rows a re-seal visits (ADR-0045). Like FindBackupTargetCredential it reads the credential and nothing that is on its way to a response.

func (*Queries) BlockErasureKept 

func (q *Queries) BlockErasureKept(ctx context.Context, arg BlockErasureKeptParams) (int64, error)

The remainder could not be carried out: every pending row of the case says why until it is.

func (*Queries) BlockItemsForRetention 

func (q *Queries) BlockItemsForRetention(ctx context.Context, arg BlockItemsForRetentionParams) (int64, error)

What a rule would do, and what is stopping it (§4, §6).

No `retention_pending_until`, deliberately: an entry that is held back has no due moment, and the absence of one is what keeps phase two off it rather than a flag somebody has to remember to check. Re-run on every pass, because a block is a fact about now - the hold may have been lifted since, and then the marking above takes over. A row that already says so is left alone: a pass reads past held rows on every run, and rewriting each unchanged one would be a row version per held entry per pass.

func (*Queries) BucketExists 

func (q *Queries) BucketExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) BucketOrderKeyNeighbours 

func (q *Queries) BucketOrderKeyNeighbours(ctx context.Context, arg BucketOrderKeyNeighboursParams) (BucketOrderKeyNeighboursRow, error)

The two ranks a position sits between on one board: the rank of the bucket to go before, and the greatest rank below it.

The counterpart of ContainerOrderKeyNeighbours, and the same shape for the same reasons: both bounds in one row so that they are consistent as of the moment they are asked, the empty string for "nothing there", and COLLATE "C" wherever two ranks are compared.

The moving bucket is excluded from its own board: a reorder would otherwise measure a position against the rank it is leaving.

"Exclude nothing" has to be expressible, because a create has no row to leave out: the parameter is nullable and the comparison is IS DISTINCT FROM. With `<>` a NULL there is a predicate that is NULL for every row, which empties this list and reports an anchor that is present as missing.

func (*Queries) BumpRuleFailure 

func (q *Queries) BumpRuleFailure(ctx context.Context, arg BumpRuleFailureParams) (int32, error)

One more consecutive failure, and the count afterwards.

Returned rather than read back, because the decision that follows it - has this rule failed often enough to be switched off - has to be made on the value this statement produced. A read after the write would be a second statement another run could commit between, and two runs failing together would each see the other's count and neither would reach the threshold.

func (*Queries) BurnRecoveryCode 

func (q *Queries) BurnRecoveryCode(ctx context.Context, arg BurnRecoveryCodeParams) (int64, error)

Only the first use writes; a code presented again matches nothing, which is what single-use means at this layer.

func (*Queries) CallJobsSealedNotUnder 

func (q *Queries) CallJobsSealedNotUnder(ctx context.Context, keyID string) ([]CallJobsSealedNotUnderRow, error)

The HTTP calls a re-seal visits (ADR-0045): a job that may still run whose header secret names a key other than the current one. Only the current workspace's - the table has no policy to say so.

func (*Queries) CancelJob 

func (q *Queries) CancelJob(ctx context.Context, arg CancelJobParams) (CancelJobRow, error)

Cancellation, and it is the state change alone: no lease is named, because the caller holds none. A pass that is under way is not interrupted - it finds at its next write that the row is no longer RUNNING under its lease, and rolls back rather than applying its work (test RT-3 is the same fence). The lease is cleared so that nothing waits for it to expire.

The state condition is what makes a terminal job a conflict rather than a silent overwrite: a job that succeeded a second ago must not read back as cancelled.

func (*Queries) CancelTenantDeletion 

func (q *Queries) CancelTenantDeletion(ctx context.Context, now pgtype.Timestamptz) (TenantStatus, error)

The edge back (§5): the status the request came from, or SUSPENDED where none was kept - nobody regains access the operator did not choose. Guarded on the purge's mark in the same statement: the grace job writes that mark in this row before it removes a byte, so the two writes wait for each other and exactly one condition holds afterwards. No row is a workspace not pending, or one whose purge has begun.

func (*Queries) CarryOverRetentionPolicy 

func (q *Queries) CarryOverRetentionPolicy(ctx context.Context, arg CarryOverRetentionPolicyParams) error

The old table's rows, written into the new one for a tenant that has no rule yet.

ON CONFLICT DO NOTHING, because this runs on every sweep and a tenant that has since written a rule of its own has decided something - a carry-over that overwrote it would be the upgrade quietly undoing the tenant's configuration. The scope is TENANT because that is what the old key could express, and the action is HARD_DELETE because that is what the old engine did.

func (*Queries) ChildCompletion 

func (q *Queries) ChildCompletion(ctx context.Context, parentID pgtype.UUID) (ChildCompletionRow, error)

How many children an item has, and how many of them are done. The two numbers the roll-up decides from (I-W5), as counts rather than as rows: the question is "is anything still open down there", and reading a subtree to answer one boolean is the shape this avoids.

Trashed children are excluded outright. They are deletions waiting out their retention period, and a work package whose last activity was deleted must not become done because of it. Archived children are counted as they stand - archiving is a decision to keep something quietly, not to disown it.

Served by wi_parent_idx (tenant_id, parent_id, order_key): the tenant comes from row level security, so the leading column is satisfied without appearing here.

func (*Queries) ClaimDueRuleOccurrences 

func (q *Queries) ClaimDueRuleOccurrences(ctx context.Context, arg ClaimDueRuleOccurrencesParams) ([]ClaimDueRuleOccurrencesRow, error)

Takes the moments that have come and removes them in the same statement.

Deleted rather than marked, because the row *is* the debt: once the run is queued the tenant no longer owes it, and a status column would be a second place for "already fired" to be recorded. The delete and the run's job commit together in the runner's transaction, so a process that dies halfway leaves both.

func (*Queries) ClaimDueSoonItems 

func (q *Queries) ClaimDueSoonItems(ctx context.Context, arg ClaimDueSoonItemsParams) ([]ClaimDueSoonItemsRow, error)

The entries whose deadline has come within the lead and have not been announced yet, claimed and stamped in one statement.

One statement rather than a select and an update, which is what makes the announcement exactly-once: the stamp is written by the same UPDATE that returns the row, so two passes over the same entry - another leader, a retried job - cannot both see it as unannounced. The same reasoning as the reminder's guarded transition, in the shape a scan needs.

Only open entries: something completed, trashed or archived is not approaching anything, which is also what the index this runs on is partial over.

func (*Queries) ClaimEventConsumption 

func (q *Queries) ClaimEventConsumption(ctx context.Context, arg ClaimEventConsumptionParams) (int64, error)

The claim is the question (ADR-0007): a consumer inserts before it reacts, and an insert that changes nothing is the answer "somebody already has". Asking first and inserting afterwards would let two dispatchers both be told no.

func (*Queries) ClaimImportRun 

func (q *Queries) ClaimImportRun(ctx context.Context, arg ClaimImportRunParams) (int64, error)

The claim: a job that died and is picked up again claims the same row a second time, so RUNNING is among the states it may claim from and started_at is kept rather than moved.

func (*Queries) ClaimJobs 

func (q *Queries) ClaimJobs(ctx context.Context, arg ClaimJobsParams) ([]ClaimJobsRow, error)

The claim. Two kinds of row are claimable: one that is due, and one whose lease has run out - the second is a job whose worker died, and picking it up again is the whole reason a lease has an end. Per-tenant round-robin at claim time (multi-tenancy.md §4): each workspace's due jobs are ranked among themselves, and the batch takes everybody's first before anybody's second - one tenant's storm cannot monopolise the workers, and both keep making progress. Priority and age still order within a rank, so nothing changes whenever only one tenant is due. NULL tenants (system jobs) rank as one workspace of their own.

The window function cannot share a query level with FOR UPDATE, which is why the lock happens in a second walk over the base table: the CTE ranks a snapshot, the locking read re-checks that each picked row is still due, and SKIP LOCKED keeps two workers on disjoint batches (ADR-0008). The aliases are not decoration: without them "run_at" would mean two different things in one statement.

func (*Queries) ClaimOverdueItems 

func (q *Queries) ClaimOverdueItems(ctx context.Context, arg ClaimOverdueItemsParams) ([]ClaimOverdueItemsRow, error)

The same scan for the deadline itself: entries whose date has passed with the work not done.

func (*Queries) ClaimPendingEvents 

func (q *Queries) ClaimPendingEvents(ctx context.Context, batchSize int32) ([]ClaimPendingEventsRow, error)

The dispatcher's claim. The rows are locked for the length of the transaction and rows another dispatcher holds are skipped rather than waited for, so two workers on one tenant divide the work instead of queueing.

func (*Queries) ClaimRestoreRun 

func (q *Queries) ClaimRestoreRun(ctx context.Context, arg ClaimRestoreRunParams) (int64, error)

The claim, and the lock against two restores in one tenant at once.

An UPDATE rather than an insert, because the row is written when the restore is accepted and claimed when the job picks it up - and a job that died and is picked up again has to be able to claim the same row a second time. That is BK-7's restore half: `status IN (...)` includes RUNNING so a resumed attempt continues its own run rather than being told the tenant is busy, and `started_at` is kept rather than moved, so the run still says when it actually began.

func (*Queries) ClaimRulesToMaterialize 

func (q *Queries) ClaimRulesToMaterialize(ctx context.Context, arg ClaimRulesToMaterializeParams) ([]ClaimRulesToMaterializeRow, error)

What the materialisation pass takes: this tenant's series whose rolling window may owe something, oldest bookkeeping first.

The predicate is the window itself: a rule whose watermark already reaches past the horizon owes nothing until time moves. A rule that has never materialised has no watermark and is always a candidate, which is what makes the first pass after a rule is written do the work.

FOR UPDATE SKIP LOCKED for the reason the job queue uses it (ADR-0008): two passes that overlap take disjoint sets instead of waiting for each other. The second lock is the watermark's own compare-and-set below, which is what makes a leader failover harmless even when they do meet.

func (*Queries) ClaimSetupCode 

func (q *Queries) ClaimSetupCode(ctx context.Context, arg ClaimSetupCodeParams) (string, error)

Inside the setup's transaction: ALREADY_DONE, WRONG, EXPIRED or CLAIMED (migration 0128).

func (*Queries) ClearAccount 

func (q *Queries) ClearAccount(ctx context.Context) (int64, error)

A replace keeps a restricted account, and one an erasure keeps a part of, for ImportAccount's reason: the archive's row then meets it and leaves it as it is.

func (*Queries) ClearAccountGroup 

func (q *Queries) ClearAccountGroup(ctx context.Context) (int64, error)

func (*Queries) ClearAccountGroupMember 

func (q *Queries) ClearAccountGroupMember(ctx context.Context) (int64, error)

func (*Queries) ClearActivityEntry 

func (q *Queries) ClearActivityEntry(ctx context.Context) (int64, error)

func (*Queries) ClearAssignmentsOn 

func (q *Queries) ClearAssignmentsOn(ctx context.Context, arg ClearAssignmentsOnParams) (int64, error)

The person's assignments a hold does not keep: the entry goes back to nobody.

func (*Queries) ClearAuthAttempt 

func (q *Queries) ClearAuthAttempt(ctx context.Context, subjectHash []byte) error

A successful sign-in wipes the slate: the ledger exists to slow guessing, not to remember it.

func (*Queries) ClearAutoAssignPolicy 

func (q *Queries) ClearAutoAssignPolicy(ctx context.Context) (int64, error)

func (*Queries) ClearAutomationRule 

func (q *Queries) ClearAutomationRule(ctx context.Context) (int64, error)

func (*Queries) ClearBucket 

func (q *Queries) ClearBucket(ctx context.Context) (int64, error)

func (*Queries) ClearCalendarFeed 

func (q *Queries) ClearCalendarFeed(ctx context.Context) (int64, error)

func (*Queries) ClearComment 

func (q *Queries) ClearComment(ctx context.Context) (int64, error)

func (*Queries) ClearCommentTexts 

func (q *Queries) ClearCommentTexts(ctx context.Context, ids []pgtype.UUID) (int64, error)

The kept text, gone once no hold covers it. Nothing else of the row changes and no version is spent: every reader already saw an empty body (FindComment), so nobody can tell the difference and nothing is announced. A living comment is never matched.

func (*Queries) ClearConsentRecord 

func (q *Queries) ClearConsentRecord(ctx context.Context) (int64, error)

func (*Queries) ClearContainer 

func (q *Queries) ClearContainer(ctx context.Context) (int64, error)

func (*Queries) ClearContainerMilestone 

func (q *Queries) ClearContainerMilestone(ctx context.Context) (int64, error)

func (*Queries) ClearCustomFieldDefinition 

func (q *Queries) ClearCustomFieldDefinition(ctx context.Context) (int64, error)

func (*Queries) ClearForeignSubtreeBuckets 

func (q *Queries) ClearForeignSubtreeBuckets(ctx context.Context, arg ClearForeignSubtreeBucketsParams) ([]ClearForeignSubtreeBucketsRow, error)

Every entry in a moved subtree that still points at a column of the collection it left, taken off that board and reported (invariant I-W6).

Only a task carries a bucket and only the moved item itself can be one, so this touches at most one row today - it is written over the subtree all the same, because which types carry a board is a capability profile rather than a rule this query gets to assume (ADR-0006).

The version is deliberately not moved here. This runs as part of a move, and the two statements that move the subtree bump every row in it - including this one. Bumping it twice would make one move look like two to a client that caches versions, and would leave the moved item's own row on a version the optimistic lock in SetWorkItemPlacement no longer matches.

func (*Queries) ClearForeignSubtreeLabels 

func (q *Queries) ClearForeignSubtreeLabels(ctx context.Context, arg ClearForeignSubtreeLabelsParams) ([]ClearForeignSubtreeLabelsRow, error)

Every label an entry in a moved subtree carries that its new collection does not define, removed and reported (invariant I-W6).

A move to another collection takes an entry away from the vocabulary it was tagged from, and a label from elsewhere would be a reference that resolves to a word nobody in the new collection chose. Deleting them in one statement rather than walking the subtree keeps the transaction's length independent of how many entries moved, and RETURNING is what lets the answer name what was lost - I-W6 asks for the losses to be reported, never silently dropped.

`LIKE prefix || '%'` rather than starts_with, for the reason MoveWorkItemSubtree gives: that is the form wi_path_idx serves as an index scan, and a path built from UUIDs and separators contains no LIKE metacharacter.

func (*Queries) ClearInstallationDefault 

func (q *Queries) ClearInstallationDefault(ctx context.Context, arg ClearInstallationDefaultParams) error

The former default stops being one and loses its locks, before another becomes the default.

func (*Queries) ClearItemAttachment 

func (q *Queries) ClearItemAttachment(ctx context.Context) (int64, error)

func (*Queries) ClearItemLabel 

func (q *Queries) ClearItemLabel(ctx context.Context) (int64, error)

func (*Queries) ClearItemMember 

func (q *Queries) ClearItemMember(ctx context.Context) (int64, error)

func (*Queries) ClearItemRetention 

func (q *Queries) ClearItemRetention(ctx context.Context, arg ClearItemRetentionParams) (int64, error)

`:retain`, and the end of a stage. The rule reference is cleared with it when a person takes the entry out - taking it out means the rule no longer owns it - and kept when a stage has acted, because the chain's next stage is what owns it then.

func (*Queries) ClearJumbleEntry 

func (q *Queries) ClearJumbleEntry(ctx context.Context) (int64, error)

func (*Queries) ClearLabel 

func (q *Queries) ClearLabel(ctx context.Context) (int64, error)

func (*Queries) ClearLegalHold 

func (q *Queries) ClearLegalHold(ctx context.Context) (int64, error)

func (*Queries) ClearMediaObject 

func (q *Queries) ClearMediaObject(ctx context.Context) (int64, error)

func (*Queries) ClearMembership 

func (q *Queries) ClearMembership(ctx context.Context) (int64, error)

func (*Queries) ClearNotificationPreference 

func (q *Queries) ClearNotificationPreference(ctx context.Context) (int64, error)

func (*Queries) ClearPasskeys 

func (q *Queries) ClearPasskeys(ctx context.Context) (int64, error)

func (*Queries) ClearPlanSettings 

func (q *Queries) ClearPlanSettings(ctx context.Context, planID pgtype.UUID) error

What the write did not decide stops being decided: `PUT` semantics, as the installation's level.

func (*Queries) ClearPrivateHubAccess 

func (q *Queries) ClearPrivateHubAccess(ctx context.Context) (int64, error)

func (*Queries) ClearQuotaReached 

func (q *Queries) ClearQuotaReached(ctx context.Context, quota string) error

func (*Queries) ClearRecurrenceRule 

func (q *Queries) ClearRecurrenceRule(ctx context.Context) (int64, error)

func (*Queries) ClearReminder 

func (q *Queries) ClearReminder(ctx context.Context) (int64, error)

func (*Queries) ClearRetentionCursor 

func (q *Queries) ClearRetentionCursor(ctx context.Context, arg ClearRetentionCursorParams) error

The read reached the end of its rows: the next pass starts at the beginning.

func (*Queries) ClearRetentionMarksOfRule 

func (q *Queries) ClearRetentionMarksOfRule(ctx context.Context, arg ClearRetentionMarksOfRuleParams) (int64, error)

What a withdrawn rule leaves behind. An entry counting down towards a rule nobody holds any more would be deleted by a rule that does not exist, so the marking goes with the rule - and only the marking: what the rule already did stands, because retention deletes and a deletion is not undone by withdrawing the instruction that caused it.

func (*Queries) ClearRetentionPolicy 

func (q *Queries) ClearRetentionPolicy(ctx context.Context) (int64, error)

func (*Queries) ClearRuleFailure 

func (q *Queries) ClearRuleFailure(ctx context.Context, arg ClearRuleFailureParams) error

A run that worked ends the streak. `consecutive` is what the counter means, so one success resets it rather than decrementing.

func (*Queries) ClearRuleFailures 

func (q *Queries) ClearRuleFailures(ctx context.Context, ids []pgtype.UUID) (int64, error)

The rules a pass evaluated cleanly stop showing a failure.

func (*Queries) ClearSavedView 

func (q *Queries) ClearSavedView(ctx context.Context) (int64, error)

func (*Queries) ClearSetElement 

func (q *Queries) ClearSetElement(ctx context.Context) (int64, error)

func (*Queries) ClearStructurePreset 

func (q *Queries) ClearStructurePreset(ctx context.Context) (int64, error)

func (*Queries) ClearTemplate 

func (q *Queries) ClearTemplate(ctx context.Context) (int64, error)

func (*Queries) ClearWebhookSubscription 

func (q *Queries) ClearWebhookSubscription(ctx context.Context) (int64, error)

func (*Queries) ClearWorkItem 

func (q *Queries) ClearWorkItem(ctx context.Context) (int64, error)

func (*Queries) CloseArchivedUsage 

func (q *Queries) CloseArchivedUsage(ctx context.Context) (int64, error)

The purge day closes each count kept as the day's highest at 0, so a read after it carries no count of a workspace that is gone; the day's highest stays what it was - its last closing count, or the day's own row where the purge day had one.

func (*Queries) CloseStarter 

func (q *Queries) CloseStarter(ctx context.Context, at pgtype.Timestamptz) error

func (*Queries) CloseTenantPassword 

func (q *Queries) CloseTenantPassword(ctx context.Context, arg CloseTenantPasswordParams) (int64, error)

Ends the opening: early by the operator (no `due`), or once its time has passed (`due` is the moment, and an opening extended in between is left standing). Zero rows is an opening that was not there, or not yet due - which the caller reads as "nothing to close" rather than as a fault.

func (*Queries) CollectionByHandle 

func (q *Queries) CollectionByHandle(ctx context.Context, handle *string) (pgtype.UUID, error)

A live collection in a live hub: a trashed or archived one takes no mail, and the message goes to the jumble saying so.

func (*Queries) CollectionEntryShapes 

func (q *Queries) CollectionEntryShapes(ctx context.Context, arg CollectionEntryShapesParams) ([]CollectionEntryShapesRow, error)

What a preview of a structure change counts (UC-WRK-24 check 2): every live entry of the collections, its type and path, and whether it holds a value of each capability - never the value. Bounded by the caller; ordered so that a bound cuts the same entries every time.

func (*Queries) CompleteIdempotencyRecord 

func (q *Queries) CompleteIdempotencyRecord(ctx context.Context, arg CompleteIdempotencyRecordParams) error

func (*Queries) CompleteJob 

func (q *Queries) CompleteJob(ctx context.Context, arg CompleteJobParams) (int64, error)

The outcome is the handler's message code, or NULL where its kind has none to say (rule 10: a code, never content).

func (*Queries) CompleteReappliedErasure 

func (q *Queries) CompleteReappliedErasure(ctx context.Context, arg CompleteReappliedErasureParams) (int64, error)

Completes a case whose erasure ran again, at the moment it was first completed - but only while it is open: the rewound job of the same case may run beside the operator's re-run, and the one that completes second must find it completed rather than complete it twice.

func (*Queries) ConfirmAccountAddress 

func (q *Queries) ConfirmAccountAddress(ctx context.Context, arg ConfirmAccountAddressParams) (int64, error)

The address becomes the account's, while it is still a managed one that can act: an erased account, or one that has an address by now, takes none (zero rows). An address another account holds meanwhile is refused by account_email_uq.

func (*Queries) ConfirmMfaEnrollment 

func (q *Queries) ConfirmMfaEnrollment(ctx context.Context, arg ConfirmMfaEnrollmentParams) (int64, error)

Arms the enrolment and records the confirming step in one statement, so the code that armed can never verify a second time.

func (*Queries) ConsumeConnectOidcFlow 

func (q *Queries) ConsumeConnectOidcFlow(ctx context.Context, arg ConsumeConnectOidcFlowParams) (ConsumeConnectOidcFlowRow, error)

A connection's (ADR-0078 §1): only a connection's flow bound to this very session.

func (*Queries) ConsumeOauthCode 

func (q *Queries) ConsumeOauthCode(ctx context.Context, arg ConsumeOauthCodeParams) (ConsumeOauthCodeRow, error)

Judged and burned in one statement: unexpired, unconsumed, or nothing - a replayed code matches no row, whoever races whom.

func (*Queries) ConsumeOidcFlow 

func (q *Queries) ConsumeOidcFlow(ctx context.Context, arg ConsumeOidcFlowParams) (ConsumeOidcFlowRow, error)

Judged and burned in one statement, ConsumeOauthCode's discipline: unexpired and unconsumed, or nothing at all - so a state presented twice matches no row whoever races whom. A sign-in's: a flow bound to a session is a step-up and finishes no sign-in.

func (*Queries) ConsumePasskeyChallenge 

func (q *Queries) ConsumePasskeyChallenge(ctx context.Context, arg ConsumePasskeyChallengeParams) (ConsumePasskeyChallengeRow, error)

One statement, so two completions of one challenge let exactly one through.

func (*Queries) ConsumePasskeyProofChallenge 

func (q *Queries) ConsumePasskeyProofChallenge(ctx context.Context, arg ConsumePasskeyProofChallengeParams) (ConsumePasskeyProofChallengeRow, error)

One statement, so two answers to one challenge let exactly one through; only under its purpose, for its account and - a fresh proof's - its session.

func (*Queries) ConsumePasskeySignInChallenge 

func (q *Queries) ConsumePasskeySignInChallenge(ctx context.Context, arg ConsumePasskeySignInChallengeParams) (int64, error)

One statement, so two completions of one challenge let exactly one through.

func (*Queries) ConsumePendingCredential 

func (q *Queries) ConsumePendingCredential(ctx context.Context, arg ConsumePendingCredentialParams) (int64, error)

Single use, atomically: only the first completion writes, and a lost race answers exactly as an unknown token does.

func (*Queries) ConsumeStepUp 

func (q *Queries) ConsumeStepUp(ctx context.Context, arg ConsumeStepUpParams) (int64, error)

The one statement the whole feature turns on: the proof is judged and burned atomically - fresh, unconsumed, on a live session of this account - so two privileged actions racing for one proof settle in the database, not in Go. Zero rows is "not proved", whatever the reason.

func (*Queries) ConsumeStepUpOidcFlow 

func (q *Queries) ConsumeStepUpOidcFlow(ctx context.Context, arg ConsumeStepUpOidcFlowParams) (ConsumeStepUpOidcFlowRow, error)

The step-up's: only a flow bound to this very session, judged and burned in the same statement. A connection's flow is bound to a session too, and is not a step-up.

func (*Queries) ContainerExists 

func (q *Queries) ContainerExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) ContainerOrderKeyNeighbours 

func (q *Queries) ContainerOrderKeyNeighbours(ctx context.Context, arg ContainerOrderKeyNeighboursParams) (ContainerOrderKeyNeighboursRow, error)

The two ranks a position sits between at one container level: the rank of the container to go before, and the greatest rank below it.

The counterpart of OrderKeyNeighbours for items, and the same shape for the same reasons: both bounds in one row so that they are consistent as of the moment they are asked, the empty string for "nothing there", and COLLATE "C" wherever two ranks are compared - a fractional index rests on byte order, and a database created en_US.utf8 on glibc would order it differently from the domain that produced it.

The level is the parent, compared with IS NOT DISTINCT FROM so that an absent one means the hubs rather than no filter at all. The moving container is excluded from its own level: a reorder would otherwise measure a position against the rank it is leaving.

func (*Queries) CountAccountsWithoutIdentityAt 

func (q *Queries) CountAccountsWithoutIdentityAt(ctx context.Context, providerIds []pgtype.UUID) (int64, error)

How many people of this workspace no provider in the list signs in (ADR-0078 §1): the number the password switch says before the password is switched off. Active people only - an invited account has not chosen a way in yet, and a service account signs in with a token - and a number, never a list (P-01's discipline inside the workspace too: the screen needs how many, not who). Row level security keeps both tables to this workspace.

func (*Queries) CountAgedSyncOps 

func (q *Queries) CountAgedSyncOps(ctx context.Context, arg CountAgedSyncOpsParams) (int64, error)

func (*Queries) CountAgedTombstones 

func (q *Queries) CountAgedTombstones(ctx context.Context, arg CountAgedTombstonesParams) (int64, error)

func (*Queries) CountAuthFailure 

func (q *Queries) CountAuthFailure(ctx context.Context, arg CountAuthFailureParams) (int32, error)

One more failure, added where the row is rather than computed from a read: the row is held until the transaction ends, so twenty guesses sent at once are twenty failures, not one written twenty times. The lock moment is the caller's to compute from the count this answers (UpsertAuthAttempt).

func (*Queries) CountBackupTargets 

func (q *Queries) CountBackupTargets(ctx context.Context) (CountBackupTargetsRow, error)

Whether this tenant backs up anywhere, and whether any target is unencrypted. Two counts rather than a list, because the health surface asks a question about the installation rather than about a target (backup-restore.md §10).

Configured counts only the enabled targets an enabled schedule writes to: a target nothing writes to backs nothing up, and counting it would silence config.backup_not_configured while nothing is backed up. Unencrypted counts every enabled target, because a run started by hand writes to one whether a schedule does or not.

func (*Queries) CountDispatchedEvents 

func (q *Queries) CountDispatchedEvents(ctx context.Context, arg CountDispatchedEventsParams) (int64, error)

How many rows are due, counted no higher than the ceiling: what the caller needs is "is there more after this batch" rather than a count of the table.

func (*Queries) CountExpiredIdempotencyKeys 

func (q *Queries) CountExpiredIdempotencyKeys(ctx context.Context, arg CountExpiredIdempotencyKeysParams) (int64, error)

What is due, bounded by the batch the pass would take plus one, CountExpiredSessions' reason.

func (*Queries) CountExpiredJumbleEntries 

func (q *Queries) CountExpiredJumbleEntries(ctx context.Context, arg CountExpiredJumbleEntriesParams) (int64, error)

What is due, so a pass can report a backlog it did not get to. Bounded by the batch it would have taken plus one, so a tenant with a million expired rows costs an index scan of a page rather than a count of the table.

func (*Queries) CountExpiredMailReceipts 

func (q *Queries) CountExpiredMailReceipts(ctx context.Context, arg CountExpiredMailReceiptsParams) (int64, error)

func (*Queries) CountExpiredNotifications 

func (q *Queries) CountExpiredNotifications(ctx context.Context, arg CountExpiredNotificationsParams) (int64, error)

What is due, so a pass can report a backlog it did not get to. Bounded by the batch it would have taken plus one, so a tenant with a million expired rows costs an index scan of a page rather than a count of the table.

func (*Queries) CountExpiredSessions 

func (q *Queries) CountExpiredSessions(ctx context.Context, arg CountExpiredSessionsParams) (int64, error)

What is due, so a pass can report a backlog it did not get to. Bounded by the batch it would have taken plus one, so a tenant with a million expired rows costs an index scan of a page rather than a count of the table.

func (*Queries) CountExpiredSuggestions 

func (q *Queries) CountExpiredSuggestions(ctx context.Context, arg CountExpiredSuggestionsParams) (int64, error)

Counted no higher than the ceiling, the notification history's shape: the number is for a run log and an operator, and counting a million rows to write "a lot" into a log is a scan nobody asked for.

func (*Queries) CountExpiredWebhookDeliveries 

func (q *Queries) CountExpiredWebhookDeliveries(ctx context.Context, arg CountExpiredWebhookDeliveriesParams) (int64, error)

What is due, bounded by the batch plus one, the jumble's reason.

func (*Queries) CountFigureDays 

func (q *Queries) CountFigureDays(ctx context.Context, arg CountFigureDaysParams) ([]CountFigureDaysRow, error)

RHYTHM: the reader's dates of this week on which a visible row of the collection was completed (`wi_figure_done_idx`); archived rows included, because putting away what is done must not take a day off the week. Whoever completed, a date counts once.

func (*Queries) CountFigureDue 

func (q *Queries) CountFigureDue(ctx context.Context, arg CountFigureDueParams) ([]CountFigureDueRow, error)

DUE: open, unarchived, visible rows of a level whose fields carry a due date, due by the end of the reader's day (`wi_due_idx`). A timed date is due when its instant is before the day's end; an all-day date is a calendar date in its own zone (UTC where none is stored), due when that date is on or before the reader's.

func (*Queries) CountFigureFlow 

func (q *Queries) CountFigureFlow(ctx context.Context, arg CountFigureFlowParams) ([]CountFigureFlowRow, error)

FLOW (UC-WRK-31 checks 3 and 4): per collection, the visible top-level entries completed since a moment - archived ones included, as the rhythm counts them (`wi_figure_done_idx`) - with the average time from first to last column of those whose moments are recorded: from when one first entered the first column to when it last entered a done column (migration 0194). One created into a later column, or completed without entering a done column, has no such time and counts only as completed. And the board's columns holding more open, unarchived, visible entries than their limit (`wi_board_idx`). A top-level entry has no ancestor, so the hidden predicate is its own type alone. Every collection asked is answered, with zeros where nothing counts, so that "nothing completed" and "not counted" stay two answers.

func (*Queries) CountFigureOpen 

func (q *Queries) CountFigureOpen(ctx context.Context, arg CountFigureOpenParams) ([]CountFigureOpenRow, error)

A collection's figure (UC-WRK-29, domain-model.md §2 "What counts"): one statement per kind, each over a page of collections at once and grouped by collection, so a level of the navigation costs one statement per kind on it rather than one per collection.

What each collection offers arrives as parameters the structure in force decided, never from a request (rule 9): `offered` and `dated` are comma-separated item types, one string per collection, beside the collection's identifier in the same position.

**Hidden entries count nowhere.** An entry is hidden when its type is not offered, or when an ancestor's is not (the shared predicate of domain-model.md §2, "Narrowing hides"). The ancestors are the identifiers of the entry's path, which holds the entry itself last; at most two of them.

No statement names a tenant: row level security binds each to the transaction's, so another workspace's collection counts nothing. OPEN and FIELD_SUM: the open, unarchived rows directly under each collection (`wi_figure_open_idx`), and the sum of one number field over them. A value counts only where its own definition is a live NUMBER (the visible-values rule of Work.sql); `live` says whether the collection has such a field at all, so that no rows sum to 0 and no field sums to null.

func (*Queries) CountFigureProgress 

func (q *Queries) CountFigureProgress(ctx context.Context, arg CountFigureProgressParams) ([]CountFigureProgressRow, error)

PROGRESS: the visible leaves of each collection - rows with no visible, untrashed child - and how many are completed. Archived leaves count as they stand, as the roll-up counts every child (I-W5): archiving what is done does not lower the share.

func (*Queries) CountIdentityProviders 

func (q *Queries) CountIdentityProviders(ctx context.Context) (int64, error)

What the bound is checked against before an insert. The workspace's own only: the installation's rows are not its to be limited by.

func (*Queries) CountInstallationPresets 

func (q *Queries) CountInstallationPresets(ctx context.Context) (int32, error)

func (*Queries) CountInstallationSealedValuesByStoreAndKey 

func (q *Queries) CountInstallationSealedValuesByStoreAndKey(ctx context.Context) ([]CountInstallationSealedValuesByStoreAndKeyRow, error)

The installation's own level, read once in the installation's scope: the sign-in providers it offers and the AI models it offers. These are the only stores that hold rows of no workspace - a backup target cannot, its policy admits none.

func (*Queries) CountIntakeOf 

func (q *Queries) CountIntakeOf(ctx context.Context, accountID pgtype.UUID) (int64, error)

How much of the intake carries the person's address or names them as its submitter: what a hold on the workspace keeps of it.

func (*Queries) CountLiveTenantExports 

func (q *Queries) CountLiveTenantExports(ctx context.Context) (int64, error)

The §4 concurrency quota's question. The job table has no policy, so the tenant is the transaction's own, written as an explicit predicate - DeleteTenantJobs' precedent.

func (*Queries) CountMailReceiptsFrom 

func (q *Queries) CountMailReceiptsFrom(ctx context.Context, arg CountMailReceiptsFromParams) (int64, error)

How many messages one sender sent since an instant: the intake's hourly bound per sender.

func (*Queries) CountMailboxes 

func (q *Queries) CountMailboxes(ctx context.Context) (int64, error)

func (*Queries) CountOpenItemsByAssignee 

func (q *Queries) CountOpenItemsByAssignee(ctx context.Context, accountIds []pgtype.UUID) ([]CountOpenItemsByAssigneeRow, error)

LEAST_LOADED's material: how many open entries each candidate carries, tenant-wide, because a person's load does not stop at a collection's edge. Open means not completed, not in the trash, and not archived by its own stamp - the inherited archive of an ancestor is not consulted, which overcounts a dormant subtree's entries rather than paying a recursive walk on every create. Candidates with no open entry are simply absent from the answer; the caller reads an absent key as zero.

func (*Queries) CountOpenOccurrences 

func (q *Queries) CountOpenOccurrences(ctx context.Context, recurrenceRuleID pgtype.UUID) (int64, error)

What an ON_COMPLETION series is waiting for: an entry of the series that is still open. The template counts, which is what makes the first follow-up wait for the template's own completion (arc42 §6.3). Trashed and archived entries do not: they are not going to be completed.

func (*Queries) CountPasskeys 

func (q *Queries) CountPasskeys(ctx context.Context, accountID pgtype.UUID) (int64, error)

func (*Queries) CountPendingEvents 

func (q *Queries) CountPendingEvents(ctx context.Context) (int64, error)

What is left for this tenant after a round: the dispatcher's decision between running again at once and going back to sleep.

func (*Queries) CountPeople 

func (q *Queries) CountPeople(ctx context.Context) (int64, error)

The people of the workspace: accounts of persons that are not anonymised and not deleted. What decides whether a client offers a private hub at all (UC-ID-16 check 8).

func (*Queries) CountPlatformDeadLetters 

func (q *Queries) CountPlatformDeadLetters(ctx context.Context) (int64, error)

The dead letters that can be redelivered: one whose event was swept is not counted, so A-21 resolves when the rest are redelivered.

func (*Queries) CountRecoveryCodes 

func (q *Queries) CountRecoveryCodes(ctx context.Context, accountID pgtype.UUID) (int64, error)

func (*Queries) CountRemindersOfItem 

func (q *Queries) CountRemindersOfItem(ctx context.Context, itemID pgtype.UUID) (int64, error)

The bound's other half, read in the same transaction as the insert so that two concurrent creations cannot both find room for the last one.

func (*Queries) CountRetainedDescendants 

func (q *Queries) CountRetainedDescendants(ctx context.Context, arg CountRetainedDescendantsParams) ([]CountRetainedDescendantsRow, error)

§4.6, the referential safeguard: a work package is not removed while something below it is kept for longer. Answered for a batch rather than per row, because a pass judges a thousand at a time.

"Below it" is the path prefix, and "kept for longer" is anything under that prefix which is not itself due in this pass - which the caller decides by handing in the identities it has already judged.

func (*Queries) CountRetentionCandidatesByArchivedAt 

func (q *Queries) CountRetentionCandidatesByArchivedAt(ctx context.Context, arg CountRetentionCandidatesByArchivedAtParams) (int64, error)

func (*Queries) CountRetentionCandidatesByCompletedAt 

func (q *Queries) CountRetentionCandidatesByCompletedAt(ctx context.Context, arg CountRetentionCandidatesByCompletedAtParams) (int64, error)

The numerator of the five-per-cent switch and of a preview, per anchor.

Exact rather than bounded, because §5's switch is about a proportion and a count that stopped at a batch would under-report exactly the runs the switch exists to catch. Within the rule's scope and ignoring narrower rules, which over-counts where one exists - and over-counting errs towards NOTIFY_ONLY, which is the side to err on.

func (*Queries) CountRetentionCandidatesByDeletedAt 

func (q *Queries) CountRetentionCandidatesByDeletedAt(ctx context.Context, arg CountRetentionCandidatesByDeletedAtParams) (int64, error)

func (*Queries) CountRetentionScope 

func (q *Queries) CountRetentionScope(ctx context.Context, arg CountRetentionScopeParams) (int64, error)

The denominator of the five-per-cent switch: how much the tenant holds, in the scope the rule covers. Live entries only - counting the trash would make a rule about completed work look narrower the fuller the trash was.

func (*Queries) CountRunsSince 

func (q *Queries) CountRunsSince(ctx context.Context, arg CountRunsSinceParams) (int64, error)

What the throttle asks: how often this rule has run in the window (automation.md §2).

Counted from the run log rather than from a counter on the rule, and that is the point. A counter would need resetting, and something has to decide when an hour has passed - which is a second piece of bookkeeping that can be wrong in a way nobody sees. The log already knows, and a count over an index is cheaper than a piece of state that can drift.

THROTTLED runs are not counted. A rule held back did not run, and counting the refusals would make the bound tighten on itself: once a rule hit its limit it would stay there for the whole window however quiet the workspace went.

func (*Queries) CountSchedulesForTarget 

func (q *Queries) CountSchedulesForTarget(ctx context.Context, targetID pgtype.UUID) (int64, error)

What stands between a target and its removal. Counted rather than listed for the caller that only asks whether any exist; the listing below is what the refusal names.

func (*Queries) CountSealedValuesByStoreAndKey 

func (q *Queries) CountSealedValuesByStoreAndKey(ctx context.Context) ([]CountSealedValuesByStoreAndKeyRow, error)

The census a rotation ends on (ADR-0045, security.md §8.1): how many stored values still name each master key, by the kind of value. Eight places hold a sealed value - the seventh an authenticator's replacement waiting to be confirmed, the eighth an HTTP call's header secret while its job may still run - and a rotation is only finished when none of them names the key that is about to leave the ring. Beside them, the backup archives this installation keeps name the key they were written under; nothing re-seals an archive, so that count falls only as the archives expire.

Per tenant, like everything else: row level security bounds every branch of the union to the transaction's workspace, and the control plane sums the answers over the tenants it may see. The two stores whose read policy also admits the installation's rows name the workspace explicitly: those rows are visible to every workspace and belong to none, so counting them here would count each once per workspace. The job table has no policy at all (Job.sql), so its branch names the workspace too.

func (*Queries) CountStaleDevices 

func (q *Queries) CountStaleDevices(ctx context.Context, arg CountStaleDevicesParams) (int64, error)

func (*Queries) CountStaleSearchDocuments 

func (q *Queries) CountStaleSearchDocuments(ctx context.Context) (int64, error)

The search's own bookkeeping (ADR-0034, ADR-0066): which rows were built by a recipe this installation has moved on from - because the configuration changed under it, or because the recipe did. The rows whose stored recipe differs from what hubtask_search_recipe() answers today, or that were written before it was recorded (NULL). Row level security narrows it to the workspace the transaction is bound to, which is the workspace the operation is asked for.

func (*Queries) CountStructurePresets 

func (q *Queries) CountStructurePresets(ctx context.Context, arg CountStructurePresetsParams) (int32, error)

How many presets of one origin there are - the workspace's, or one person's own.

func (*Queries) CountTenantFootprint 

func (q *Queries) CountTenantFootprint(ctx context.Context) (CountTenantFootprintRow, error)

====================== What the cascade cannot reach ====================== The stores the §5 table names, counted before the delete and again after: the difference is what the evidence entry records, the zeros afterwards are the acceptance proof. Search rides inside work_item (its vectors are columns of the row), so the item count is the search count.

func (*Queries) CountTenantItems 

func (q *Queries) CountTenantItems(ctx context.Context) (int64, error)

Trash included: a row occupies its place until the retention machinery lets it go, and a quota that emptied by trashing would be no wall at all.

func (*Queries) CountTenantPeople 

func (q *Queries) CountTenantPeople(ctx context.Context) (int64, error)

The people limit's count (multi-tenancy.md §4.2): active, restricted and managed accounts and the invitations still open. A service account is no person, and an invitation whose link ran out has freed its place until it is renewed.

func (*Queries) CountTenantRunsSince 

func (q *Queries) CountTenantRunsSince(ctx context.Context, since pgtype.Timestamptz) (int64, error)

CountRunsSince's reasoning, without its rule predicate: the tenant's whole hour, THROTTLED excluded - counting the refusals would make the bound tighten on itself.

func (*Queries) CountWebhookTargets 

func (q *Queries) CountWebhookTargets(ctx context.Context) (int64, error)

func (*Queries) CurrentSyncEpoch 

func (q *Queries) CurrentSyncEpoch(ctx context.Context) (int64, error)

The workspace's synchronisation epoch (backup-restore.md §12 B-5): what every cursor is minted under, and what a cursor is judged against.

func (*Queries) DeadLetterJob 

func (q *Queries) DeadLetterJob(ctx context.Context, arg DeadLetterJobParams) (int64, error)

The dead letter keeps the context an operator needs to act: which kind, which tenant, what it was given, how often it was tried, and the code of the last failure. Never a message - a message can carry what the job was working on (rule 10).

func (*Queries) DecideSuggestion 

func (q *Queries) DecideSuggestion(ctx context.Context, arg DecideSuggestionParams) (int64, error)

Guarded on the version it was read at: two people answering one proposal is a conflict, and the second must be told rather than silently overwriting the first.

func (*Queries) DefaultInstallationPreset 

func (q *Queries) DefaultInstallationPreset(ctx context.Context) (DefaultInstallationPresetRow, error)

The default, where there is one: what a hub starts from and what the installation locks.

func (*Queries) DeleteAccount 

func (q *Queries) DeleteAccount(ctx context.Context, id pgtype.UUID) (int64, error)

The mode that takes the person with them. The cascades of `0001_init` do the rest: memberships, group memberships, item memberships, tokens, calendar feeds, sync devices, consents and notifications all name the account with ON DELETE CASCADE, and assignments are set to NULL.

func (*Queries) DeleteAccountPending 

func (q *Queries) DeleteAccountPending(ctx context.Context, accountID pgtype.UUID) (int64, error)

An erasure takes the account's unfinished steps with it, an address waiting for its confirmation among them.

func (*Queries) DeleteAgedSyncOps 

func (q *Queries) DeleteAgedSyncOps(ctx context.Context, arg DeleteAgedSyncOpsParams) (int64, error)

The SYNC_LOG data kind's sweep of the operation log (data-retention.md §3): an operation past the offline window has answered every repeat it will ever see - a device silent longer than the window resynchronises from scratch. Batched through a subquery, oldest first, DeleteStaleDevices' shape; the primary key is what the subquery hands back.

func (*Queries) DeleteAgedTombstones 

func (q *Queries) DeleteAgedTombstones(ctx context.Context, arg DeleteAgedTombstonesParams) (int64, error)

A tombstone past the window has told every device that could still be told (offline-sync.md §7); its own purge date is the deletion plus the window as it stood, and the cutoff is the window as it stands, so the later of the two is what is honoured.

func (*Queries) DeleteAiDraftsOfAccount 

func (q *Queries) DeleteAiDraftsOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

What AI drafted for the person alone: a suggestion about their own account (a rule drafted from their sentence). Suggestions about entries stay - they are about the workspace's content, and the retention sweep ages them out.

func (*Queries) DeleteAiProvider 

func (q *Queries) DeleteAiProvider(ctx context.Context) (int64, error)

func (*Queries) DeleteAiRequest 

func (q *Queries) DeleteAiRequest(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteAiRequestsOfAccount 

func (q *Queries) DeleteAiRequestsOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

The words a person asked with that a job still holds.

func (*Queries) DeleteAutoAssignPolicy 

func (q *Queries) DeleteAutoAssignPolicy(ctx context.Context, arg DeleteAutoAssignPolicyParams) (int64, error)

Removing the key from the document removes the row. Idempotent at the caller: a document that never carried the key deletes nothing, and that is the state that was asked for.

func (*Queries) DeleteBackupSchedule 

func (q *Queries) DeleteBackupSchedule(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteBackupTarget 

func (q *Queries) DeleteBackupTarget(ctx context.Context, id pgtype.UUID) (int64, error)

The row and its sealed credential go; nothing at the target is touched. The caller has already established that no schedule names it - this statement has no way to check, because a schedule of another workspace is invisible to it and would not be counted.

func (*Queries) DeleteCommentsOf 

func (q *Queries) DeleteCommentsOf(ctx context.Context, arg DeleteCommentsOfParams) (int64, error)

The person's comments a hold does not keep, by identifier: the ones that were read, judged and given their journal entries - no others.

func (*Queries) DeleteCredentialsOfAccount 

func (q *Queries) DeleteCredentialsOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

Every credential the person holds, whichever mode is chosen. An anonymised account keeps its row and must not keep a token that still works.

func (*Queries) DeleteDevicesOfAccount 

func (q *Queries) DeleteDevicesOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

func (*Queries) DeleteDispatchedEvents 

func (q *Queries) DeleteDispatchedEvents(ctx context.Context, arg DeleteDispatchedEventsParams) (int64, error)

The retention sweep's batch (data-retention.md §3: anchor `occurred_at`, 7 days).

The guard is `dispatched_at IS NOT NULL`, and it is a correctness rule rather than a retention one: the dispatcher stamps that column only after every subscriber has had the event, so a NULL means somebody has not consumed it yet. Such a row is never due, whatever period a tenant configures - deleting it would lose the event silently, which is the one failure an outbox exists to rule out (ADR-0007).

Batched through a subquery, because DELETE takes no LIMIT: a pass that took every expired row would be a pass nobody can stop. Oldest first, so a backlog drains in the order it built up.

func (*Queries) DeleteExpiredAiRequests 

func (q *Queries) DeleteExpiredAiRequests(ctx context.Context, arg DeleteExpiredAiRequestsParams) (int64, error)

The safety net under the job's own deletion: a request an abandoned job left behind goes with the suggestions' own sweep, oldest first and in batches.

func (*Queries) DeleteExpiredConsumption 

func (q *Queries) DeleteExpiredConsumption(ctx context.Context, arg DeleteExpiredConsumptionParams) (int64, error)

The other half of the outbox's sweep: the record of who has already consumed what (core/port/eventbus.RetentionWindow).

The table is the outbox's twin - one row per event per consumer - so leaving it unswept would make the sweep of the events themselves a half measure; event_consumption_gc_idx is what the sweep reads.

The same period as the events, deliberately: a record whose event has been swept can say nothing about an event nobody can deliver again. Two periods that could drift apart would give one of them a value at which this stops being true.

func (*Queries) DeleteExpiredIdempotencyKeys 

func (q *Queries) DeleteExpiredIdempotencyKeys(ctx context.Context, arg DeleteExpiredIdempotencyKeysParams) (int64, error)

========================= The retention sweep ========================= The IDEMPOTENCY_KEY data kind's sweep (data-retention.md §3: anchor `created_at`, one day, never less): the stored answer of a request old enough that nobody may replay it any more. A reservation still waiting for its answer goes the same way - no request runs for a day.

Batched through a subquery, DeleteExpiredSessions' shape: DELETE takes no LIMIT, and a pass that took every expired row would be a pass nobody can stop. Oldest first, so a backlog drains in the order it built up. The tenant is the transaction's, through row level security.

func (*Queries) DeleteExpiredJumbleEntries 

func (q *Queries) DeleteExpiredJumbleEntries(ctx context.Context, arg DeleteExpiredJumbleEntriesParams) (int64, error)

The retention sweep's batch (data-retention.md §3: anchor `created_at`, 90 days, "inbox entries never converted").

Never converted is the predicate rather than "dismissed": an entry that became a work item is that item's provenance - `origin_jumble_id` points at this row - and removing it would leave the item claiming an origin nobody can read. What ages out is what was decided against and what was never decided about at all, which is exactly the message nobody ever wanted.

Batched through a subquery, because DELETE takes no LIMIT: a pass that took every expired row would be a pass nobody can stop. Oldest first, so a backlog drains in the order it built up.

func (*Queries) DeleteExpiredMailReceipts 

func (q *Queries) DeleteExpiredMailReceipts(ctx context.Context, arg DeleteExpiredMailReceiptsParams) (int64, error)

The retention run's batch: the oldest receipts past the period (ADR-0094, 30 days).

func (*Queries) DeleteExpiredMailboxAuthorizations 

func (q *Queries) DeleteExpiredMailboxAuthorizations(ctx context.Context, now pgtype.Timestamptz) (int64, error)

func (*Queries) DeleteExpiredNotifications 

func (q *Queries) DeleteExpiredNotifications(ctx context.Context, arg DeleteExpiredNotificationsParams) (int64, error)

The retention sweep's batch (data-retention.md §3: anchor `created_at`, 90 days).

Batched through a subquery, because DELETE takes no LIMIT: a pass that took every expired row would be a pass nobody can stop, and the sweep's whole shape is one batch per transaction. Oldest first, so a backlog drains in the order it built up.

func (*Queries) DeleteExpiredOauthCodes 

func (q *Queries) DeleteExpiredOauthCodes(ctx context.Context, arg DeleteExpiredOauthCodesParams) (int64, error)

Hygiene in the session sweep's pass, auth_pending's reasoning: a code lives minutes.

func (*Queries) DeleteExpiredOidcFlows 

func (q *Queries) DeleteExpiredOidcFlows(ctx context.Context, arg DeleteExpiredOidcFlowsParams) (int64, error)

Hygiene in the session sweep's pass, the expired authorization codes' reasoning: a flow lives minutes, and what is left of it after that is a row nobody will ever present again.

func (*Queries) DeleteExpiredPending 

func (q *Queries) DeleteExpiredPending(ctx context.Context, arg DeleteExpiredPendingParams) (int64, error)

Hygiene in the session sweep's pass: a pending row lives minutes, and one that outlived them is bookkeeping about a sign-in nobody finished.

func (*Queries) DeleteExpiredPlatformDeliveries 

func (q *Queries) DeleteExpiredPlatformDeliveries(ctx context.Context, arg DeleteExpiredPlatformDeliveriesParams) (int64, error)

func (*Queries) DeleteExpiredPlatformEvents 

func (q *Queries) DeleteExpiredPlatformEvents(ctx context.Context, arg DeleteExpiredPlatformEventsParams) (int64, error)

func (*Queries) DeleteExpiredSessions 

func (q *Queries) DeleteExpiredSessions(ctx context.Context, arg DeleteExpiredSessionsParams) (int64, error)

========================= The retention sweep ========================= The SESSION data kind's sweep (data-retention.md §3: anchor `last_seen_at`, 30 days). Only a session that is already over - run out or revoked - ages out: the anchor decides *when* the row goes, never whether a live sign-in ends, because ending sign-ins is revocation's job and the engine's job is forgetting. The refresh family goes with the row by cascade.

Batched through a subquery, because DELETE takes no LIMIT: a pass that took every expired row would be a pass nobody can stop. Oldest first, so a backlog drains in the order it built up.

func (*Queries) DeleteExpiredSuggestions 

func (q *Queries) DeleteExpiredSuggestions(ctx context.Context, arg DeleteExpiredSuggestionsParams) (int64, error)

Oldest first and in batches, so a long-neglected workspace catches up over several passes instead of holding one transaction over everything it owes.

func (*Queries) DeleteExpiredWebhookDeliveries 

func (q *Queries) DeleteExpiredWebhookDeliveries(ctx context.Context, arg DeleteExpiredWebhookDeliveriesParams) (int64, error)

The retention run's batch (data-retention.md §3: anchor `created_at`, 30 days). Every attempt past the period goes, except a PENDING one a living job still names - that job will read the row by its id. A pending row whose job is gone (dead-lettered and purged, or never run) is read by nobody and goes like the rest. Batched through a subquery, oldest first, the jumble's reason.

func (*Queries) DeleteFeedsOfAccount 

func (q *Queries) DeleteFeedsOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

func (*Queries) DeleteGroup 

func (q *Queries) DeleteGroup(ctx context.Context, id pgtype.UUID) (int64, error)

The memberships the group granted go with it, and so do its member links - both by cascade (db/migrations/0001_init.sql), which is one statement that cannot half-run rather than three that can.

func (*Queries) DeleteIdentityProvider 

func (q *Queries) DeleteIdentityProvider(ctx context.Context, arg DeleteIdentityProviderParams) (int64, error)

An installation's row that is still offered and that a workspace uses is not removed (ADR-0077 §2). The use case asked before spending the step-up proof; the statement asks again, because a withdrawal cancelled or a workspace switching it on in between would otherwise slip past. The same facts as the domain's `RemovableAt` - not offered (switched off, or its day reached) or used by none - and a workspace's own row is not this rule's.

func (*Queries) DeleteInstallationPreset 

func (q *Queries) DeleteInstallationPreset(ctx context.Context, arg DeleteInstallationPresetParams) (int64, error)

func (*Queries) DeleteInstanceSettingsExcept 

func (q *Queries) DeleteInstanceSettingsExcept(ctx context.Context, arg DeleteInstanceSettingsExceptParams) error

What the write did not decide stops being decided.

In the same transaction as the writes, which is what makes `PUT` mean what it says: a switch the operator cleared is gone rather than left standing at its old value. Bounded to the areas the caller wrote, so that a future area of settings is not emptied by a write to this one.

func (*Queries) DeleteItemAttachment 

func (q *Queries) DeleteItemAttachment(ctx context.Context, arg DeleteItemAttachmentParams) (int64, error)

func (*Queries) DeleteKudosOfAccount 

func (q *Queries) DeleteKudosOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

Kudos the person gave and received: an acknowledgement between two people, about both of them, and evidence of nothing.

func (*Queries) DeleteMailbox 

func (q *Queries) DeleteMailbox(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteMediaObject 

func (q *Queries) DeleteMediaObject(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteMediaObjectRow 

func (q *Queries) DeleteMediaObjectRow(ctx context.Context, arg DeleteMediaObjectRowParams) (int64, error)

The record's removal, by hand (DeleteMedia): only an unreferenced, live object matches. The bytes are the reconciliation job's to remove - a request has no business waiting on a bucket.

func (*Queries) DeleteNotificationsOfAccount 

func (q *Queries) DeleteNotificationsOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

What was sent to them, and what was about to be. A notification carries a person's name in the rendering rather than in the row, but the row says who was told what and when.

func (*Queries) DeleteOauthClient 

func (q *Queries) DeleteOauthClient(ctx context.Context, id pgtype.UUID) (int64, error)

The grants go by cascade, and the sessions those grants leashed go with them: a door is removed with every key that opened it.

func (*Queries) DeleteOfferedAiProvider 

func (q *Queries) DeleteOfferedAiProvider(ctx context.Context, id pgtype.UUID) (int64, error)

Every workspace that chose it keeps its choice pointing at nothing (ON DELETE SET NULL), and gets no answer until it chooses again.

func (*Queries) DeletePasskeysOfAccount 

func (q *Queries) DeletePasskeysOfAccount(ctx context.Context, accountID pgtype.UUID) (int64, error)

A passkey is a way in like a token: an anonymised account keeps its row and none of its credentials (identity.md §23.5).

func (*Queries) DeletePlatformSubscription 

func (q *Queries) DeletePlatformSubscription(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteRecoveryCodes 

func (q *Queries) DeleteRecoveryCodes(ctx context.Context, accountID pgtype.UUID) (int64, error)

func (*Queries) DeleteRecurrenceRule 

func (q *Queries) DeleteRecurrenceRule(ctx context.Context, arg DeleteRecurrenceRuleParams) (int64, error)

A hard delete of one row. The occurrences it produced are ordinary entries and are not touched: deleting somebody's next three weeks because they stopped a series would be a deletion nobody asked for.

func (*Queries) DeleteReminder 

func (q *Queries) DeleteReminder(ctx context.Context, arg DeleteReminderParams) (int64, error)

A hard delete of one row: a reminder is created and deleted whole, and what somebody deleted is gone rather than kept as a tombstone with a state. The change log carries the deletion to offline clients, which is where a tombstone belongs (offline-sync.md §7).

func (*Queries) DeleteRetentionRule 

func (q *Queries) DeleteRetentionRule(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) DeleteSavedView 

func (q *Queries) DeleteSavedView(ctx context.Context, arg DeleteSavedViewParams) (int64, error)

A hard delete: the table carries no deleted_at, and a view is a bookmark rather than content - nothing below it to keep, nothing to restore. A calendar feed that served it keeps its row and loses the reference, which is the composite foreign key's ON DELETE SET NULL (migration 0005).

func (*Queries) DeleteStaleDevices 

func (q *Queries) DeleteStaleDevices(ctx context.Context, arg DeleteStaleDevicesParams) (int64, error)

The DEVICE data kind's sweep (data-retention.md §3: anchor `last_seen_at`). Batched through a subquery, oldest first, DeleteExpiredSessions' shape.

func (*Queries) DeleteStructurePreset 

func (q *Queries) DeleteStructurePreset(ctx context.Context, arg DeleteStructurePresetParams) (int64, error)

func (*Queries) DeleteTenantAutomationRules 

func (q *Queries) DeleteTenantAutomationRules(ctx context.Context) (int64, error)

Before the cascade reaches the accounts its rules run as (the run_as RESTRICT edge).

func (*Queries) DeleteTenantCollections 

func (q *Queries) DeleteTenantCollections(ctx context.Context) (int64, error)

====================== The ordered fall of the structure ================== A bare DELETE FROM tenant would trip its own cascade: RESTRICT edges (a hub under its collections, a media object under its covers and attachments, an account under the rules that run as it, a backup target under its runs) are checked per row, in an order nobody controls. The purge therefore fells the structure explicitly, children first, all of it bounded by row level security to the tenant of the transaction - and only then lets the cascade take the rest.

func (*Queries) DeleteTenantHubs 

func (q *Queries) DeleteTenantHubs(ctx context.Context) (int64, error)

func (*Queries) DeleteTenantIdempotency 

func (q *Queries) DeleteTenantIdempotency(ctx context.Context) (int64, error)

Bounded by row level security; idempotency_key carries no foreign key, so the cascade never reaches it.

func (*Queries) DeleteTenantJobs 

func (q *Queries) DeleteTenantJobs(ctx context.Context, keepID pgtype.UUID) (int64, error)

The job table has no policy (multi-tenancy.md §2.1), so the tenant is an explicit predicate - CancelJob's precedent - taken from the transaction's own scope, like everywhere else. The job running this delete is its own row; it survives to report.

func (*Queries) DeleteTenantMediaRows 

func (q *Queries) DeleteTenantMediaRows(ctx context.Context) (int64, error)

After the collections: nothing references media once the items are gone. The bytes were deleted store-first before this statement, ReconcileMedia's order.

func (*Queries) DeleteTenantOutbox 

func (q *Queries) DeleteTenantOutbox(ctx context.Context, batch int32) (int64, error)

Bounded by row level security to the tenant of the transaction; outbox_event carries no foreign key, so the cascade never reaches it.

func (*Queries) DeleteTenantRestoreRuns 

func (q *Queries) DeleteTenantRestoreRuns(ctx context.Context) (int64, error)

Before the cascade reaches a tenant-scoped backup target (the target_id RESTRICT edge).

func (*Queries) DeleteTenantRetentionRules 

func (q *Queries) DeleteTenantRetentionRules(ctx context.Context) (int64, error)

func (*Queries) DeleteVoiceAliases 

func (q *Queries) DeleteVoiceAliases(ctx context.Context) error

Replacing the list is this and the inserts below in one transaction.

func (*Queries) DeleteWebhookSubscription 

func (q *Queries) DeleteWebhookSubscription(ctx context.Context, id pgtype.UUID) (int64, error)

The deliveries go with it, by cascade (0001_init): a delivery log for a subscription nobody can reach any more is a record of attempts against an address the workspace no longer knows.

func (*Queries) DeletedTemplates 

func (q *Queries) DeletedTemplates(ctx context.Context, arg DeletedTemplatesParams) ([]DeletedTemplatesRow, error)

The templates deleted under a legal hold, with what a hold is judged against: the scope and, for a collection, the hub above it. One page in identifier order; the retention pass walks every page, because a template still held stays in the set.

func (*Queries) DisableAllAutomationRules 

func (q *Queries) DisableAllAutomationRules(ctx context.Context, now pgtype.Timestamptz) (int64, error)

The deletion request switches the tenant's automations off in one stroke (§5), visibly: the rows keep existing with enabled = false, the way DisableFailingRule leaves them - and marked, so that a cancel switches back on exactly these and none somebody had switched off before.

func (*Queries) DisableBrokenRule 

func (q *Queries) DisableBrokenRule(ctx context.Context, arg DisableBrokenRuleParams) (int64, error)

Switching a rule off because the check found it cannot run (ADR-0060). DisableFailingRule's shape: nobody read this rule in order to switch it off, so the guard is on the state - it fires once, while the rule is still on.

func (*Queries) DisableFailingRule 

func (q *Queries) DisableFailingRule(ctx context.Context, arg DisableFailingRuleParams) (int64, error)

Switching a rule off because it kept failing.

Its own statement rather than SetAutomationRuleEnabled, and guarded on the count rather than on a version. Nobody read this rule in order to switch it off - a run did, after failing - so there is no version to have expected; what makes it safe is that it only fires while the count is still at or past the threshold, so two runs failing together disable the rule once.

func (*Queries) DisableMfa 

func (q *Queries) DisableMfa(ctx context.Context, accountID pgtype.UUID) (int64, error)

The enrolment goes whole. The recovery codes are the account's: they go by their own statement where nothing remains for them to back (DiscardUnbackedRecoveryCodes).

func (*Queries) DiscardIntakeOf 

func (q *Queries) DiscardIntakeOf(ctx context.Context, accountID pgtype.UUID) (int64, error)

What the person sent in by mail or captured themselves, and the address it came from.

`jumble_entry` is matched by address as well as by account, because an address is all an inbound mail carries; `created_by` names the account a capture came from. The catalogue's path for it is `RETENTION` - 90 days - and an erasure that left the person's own address and text sitting there for those 90 days would be an erasure in name (PG-2).

func (*Queries) DiscardUnbackedRecoveryCodes 

func (q *Queries) DiscardUnbackedRecoveryCodes(ctx context.Context, accountID pgtype.UUID) (int64, error)

The codes back whatever second factor the account holds (identity.md §9), so they go only where it holds none: no app, armed or begun, and no passkey. The condition sits in the statement, so a removal that raced an enrolment's start never takes the codes that enrolment just showed.

func (*Queries) DismissOperator 

func (q *Queries) DismissOperator(ctx context.Context, accountID pgtype.UUID) (string, error)

Removes one, never the last. Answers REMOVED, LAST or ABSENT.

func (*Queries) DropAgedAuditPartitions 

func (q *Queries) DropAgedAuditPartitions(ctx context.Context, defaultDays int32) ([]DropAgedAuditPartitionsRow, error)

The trail's retention (migration 0152): whole months of audit_log past the longest audit period, each workspace's count before a month goes, the months a hold keeps, and the default partition's aged rows. The casts are for the generator, as above.

func (*Queries) DropAgedStreamPartitions 

func (q *Queries) DropAgedStreamPartitions(ctx context.Context, arg DropAgedStreamPartitionsParams) ([]DropAgedStreamPartitionsRow, error)

The casts are for the generator: it cannot see into the function's OUT table.

func (*Queries) DueAutomationRules 

func (q *Queries) DueAutomationRules(ctx context.Context, arg DueAutomationRulesParams) ([]DueAutomationRulesRow, error)

The SCHEDULE trigger (automation.md §1.1). The same three statements `backup_schedule` has, and deliberately: this installation has one schedule engine, and a second shape for reading a due moment would be a second engine in everything but name. What one pass claims: this tenant's rules whose moment has come, oldest first.

The tenant is row level security's, not a parameter (ADR-0010). `FOR UPDATE SKIP LOCKED` is deliberately absent: the pass runs inside one tenant's own poller, of which there is one job, and the poller holds a row lock on that job before it reads - so two passes for one tenant cannot overlap, and a lock here would be a second answer to a question the queue has answered.

func (*Queries) DueBackupSchedules 

func (q *Queries) DueBackupSchedules(ctx context.Context, arg DueBackupSchedulesParams) ([]BackupSchedule, error)

What is due now, in the tenant the transaction is bound to.

`next_run_at` is a stored decision rather than a rule expanded on the spot: expanding an RRULE costs a library call per schedule, and a poller that did it on every wake-up would do it for every schedule that is not due. The value is written by the pass that last ran, which is the same shape the reminders use.

func (*Queries) ElevateSession 

func (q *Queries) ElevateSession(ctx context.Context, arg ElevateSessionParams) (int64, error)

Raises one live session of the account to the control plane's scope for a bounded while (ADR-0070 §4). Bounded to the owner in the same statement that writes, RevokeSession's discipline: a session that is not the caller's matches nothing rather than being refused after a read. A running hour matches nothing either: it is not replaced or extended (UC-INS-04 check 4), and two raises at once leave one hour.

func (*Queries) EmergencyNoticesFor 

func (q *Queries) EmergencyNoticesFor(ctx context.Context, arg EmergencyNoticesForParams) ([]PrivateHubAccess, error)

The emergency accesses a person was told of since a moment, from their own notification records, whatever the mail did: what the web app shows a person without a mailbox (ADR-0073 §4).

func (*Queries) EndInvitationOfAccount 

func (q *Queries) EndInvitationOfAccount(ctx context.Context, arg EndInvitationOfAccountParams) (int64, error)

An invitation is a way in like a token: an erasure ends one nobody accepted, so that an account a hold keeps as an invitation cannot be redeemed or accepted into one that may act (§4.1).

func (*Queries) EnlistOperator 

func (q *Queries) EnlistOperator(ctx context.Context, arg EnlistOperatorParams) (string, error)

Adds an active account, and the caller too where the register was empty - the caller was an operator only because it was. Answers ADDED, ADDED_WITH_CALLER, PRESENT, NOT_ACTIVE or UNKNOWN.

func (*Queries) EnqueueJob 

func (q *Queries) EnqueueJob(ctx context.Context, arg EnqueueJobParams) ([]pgtype.UUID, error)

The job queue (ADR-0008). Picked up with FOR UPDATE SKIP LOCKED, so several workers claim disjoint batches instead of queueing behind each other.

The job table is the one table without row level security (db/migrations/0001_init.sql): part of the queue belongs to no tenant, and a worker must be able to read it before it knows whose job the next one is. Every statement here therefore carries its own conditions - there is no policy underneath that would catch a forgotten one.

Every statement that finishes an attempt names the lease it is finishing. That is the fence: if the lease expired and somebody else claimed the job in the meantime, the update matches nothing, the caller's transaction rolls back, and the work of the process that fell behind is discarded rather than applied twice (test RT-3). Enqueue, or leave the job that is already scheduled alone. The dedupe key collapses "make sure this is being worked on" into one row; when the waiting job is due later than the new request, its wake-up is pulled forward rather than a second row being created. A job that is already running is not touched: its own reschedule decides when it runs next.

It answers the identifier of the job that is now scheduled, which is not always the one that was offered: when a dedupe key collapses the request into a job that is already there, the answer is that job's. A 202 has to name something a caller can poll, and naming a row that was never written would be a job resource that answers 404 for work that is happening.

Zero rows means the conflict met a job that is RUNNING, where the update's WHERE does not fire. The caller then looks the running job up by its key.

func (*Queries) EnsureAuditPartition 

func (q *Queries) EnsureAuditPartition(ctx context.Context, month pgtype.Date) (string, error)

Creates next month's partition if it is not there, and brings any partition that is missing its policy or its revokes back into line (db/migrations/0043_audit_partition_duty.sql).

The answer is the partition's name, or the empty string when entries for that month are already in the default partition - which PostgreSQL will not split out, and which is an operator's decision rather than a scheduled duty's. Coalesced here rather than answered as NULL, because "no partition was made" is a state the caller acts on rather than an absence it has to unwrap.

func (*Queries) EnsureRetentionPolicy 

func (q *Queries) EnsureRetentionPolicy(ctx context.Context, arg EnsureRetentionPolicyParams) error

The default period for one kind, written for a tenant that has none.

Seeded by the run rather than by a migration. A migration would cover the tenants that existed when it ran and no others, so the first tenant created afterwards would be one with no policy - and the defaults live in code either way, so a second copy of them in SQL would be a second place for them to drift from the document (data-retention.md §3).

DO NOTHING rather than an upsert: a tenant that has changed its period has decided something, and a sweep that reset it to the default every time it ran would be a sweep that quietly overrode the tenant it is running for.

func (*Queries) EnsureStreamPartition 

func (q *Queries) EnsureStreamPartition(ctx context.Context, arg EnsureStreamPartitionParams) (string, error)

The stream partitions' duty: the leader keeps this month and next existing for the three partitioned streams, and the retention engine drops what has wholly aged out. Both go through the SECURITY DEFINER functions migration 0068 pins down - the application role holds no DDL, and these two narrow acts are the whole exception.

func (*Queries) EntriesHiddenBelow 

func (q *Queries) EntriesHiddenBelow(ctx context.Context, ids []pgtype.UUID) ([]EntriesHiddenBelowRow, error)

What a collection hides under each shown entry among ids (UC-WRK-24 check 4): every live entry below one, grouped by the types met from just under it down to it. Which of those types the collection hides is the domain's question (domain-model.md §2), so the statement needs no structure: a type met anywhere on the way hides the entry with it. Live means neither trashed nor archived, as a list shows them.

func (*Queries) EqualMembership 

func (q *Queries) EqualMembership(ctx context.Context, arg EqualMembershipParams) (EqualMembershipRow, error)

The membership a grant met instead of writing. A statement of its own rather than part of the insert: under READ COMMITTED it sees a row a concurrent grant committed while the insert waited on it, which the insert's own snapshot does not. The tenant is the transaction's (ADR-0010).

func (*Queries) EraseErasureKept 

func (q *Queries) EraseErasureKept(ctx context.Context, arg EraseErasureKeptParams) (int64, error)

Every pending row of the case whose hold keeps nothing any more: its part has been erased.

func (*Queries) ErasureContributions 

func (q *Queries) ErasureContributions(ctx context.Context, accountID pgtype.UUID) ([]ErasureContributionsRow, error)

The person's rows that sit on an entry, with where the entry is: what a hold on the workspace, a hub, a collection, an entry or another person is judged against. Their comments, the entries assigned to them, the entries they created.

func (*Queries) ErasureKeepsAccount 

func (q *Queries) ErasureKeepsAccount(ctx context.Context, accountID pgtype.UUID) (bool, error)

Whether a case still keeps this account because of a hold. Its restriction stands until the rest of the erasure has run.

func (*Queries) ErasureKeptOf 

func (q *Queries) ErasureKeptOf(ctx context.Context, requestIds []pgtype.UUID) ([]ErasureKeptOfRow, error)

func (*Queries) ExclusiveLegalHolds 

func (q *Queries) ExclusiveLegalHolds(ctx context.Context) error

Taken first by placing and lifting a hold, for the rest of the transaction. See ShareLegalHolds.

func (*Queries) ExpireBackupRun 

func (q *Queries) ExpireBackupRun(ctx context.Context, id pgtype.UUID) error

func (*Queries) ExpiredTrashContainers 

func (q *Queries) ExpiredTrashContainers(ctx context.Context, arg ExpiredTrashContainersParams) ([]ExpiredTrashContainersRow, error)

The hubs and collections whose time in the trash is up, collections before the hubs that hold them.

The order is the same bottom-up rule and the same reason: `container.parent_id` is ON DELETE RESTRICT, so a hub whose collections are still there refuses to go - the database insists on the order, and this is where it is obeyed rather than discovered.

Rows deleted after `due` come last, and `skip` pages past held ones, for the reasons the entries' statement gives.

func (*Queries) ExpiredTrashItems 

func (q *Queries) ExpiredTrashItems(ctx context.Context, arg ExpiredTrashItemsParams) ([]ExpiredTrashItemsRow, error)

The entries whose time in the trash is up, deepest first.

Deepest first because a purge works a subtree from the bottom up (data-retention.md §4.6): a parent removed before its children would take them with it through the foreign key, and rows removed by a cascade nobody counted are exactly the orphans that leave no journal entry and no tombstone behind (ADR-0020 §6).

The cutoff is a parameter rather than a period, so that the caller reads the clock once for the whole run - two readings would let a long batch use two different definitions of "expired". A cutoff of now is what emptying a trash by hand passes.

`hub_id` travels because a legal hold placed on a hub has to reach an entry three levels below it, and the entry alone does not know which hub it is under. The join is a primary key lookup.

The limit is the batch: a retention run removes in batches so that a large deletion does not hold one transaction open across the whole of it (data-retention.md §5).

Rows deleted after `due` come last: past their period, still inside the offline window, and so read only to be counted as held back. Ahead of the depth order rather than inside it, because a batch-full of recently deleted deep entries would otherwise fill every pass and keep it from ever reaching a due row behind them. Among the due rows the order is unchanged, which is the order the removal needs; a due parent above a held child is kept back by the engine, not by this order.

`skip` pages past rows the caller read and could not remove - those a legal hold keeps, which this statement cannot judge - so that a batch-full of them does not hide a due row behind them. Stable within the caller's transaction, which removes nothing until it has read.

func (*Queries) ExportAccountGroupMembers 

func (q *Queries) ExportAccountGroupMembers(ctx context.Context, arg ExportAccountGroupMembersParams) ([]ExportAccountGroupMembersRow, error)

func (*Queries) ExportAccountGroups 

func (q *Queries) ExportAccountGroups(ctx context.Context, arg ExportAccountGroupsParams) ([]ExportAccountGroupsRow, error)

func (*Queries) ExportAccounts 

func (q *Queries) ExportAccounts(ctx context.Context, arg ExportAccountsParams) ([]ExportAccountsRow, error)

ai_consent is left out too: nothing reads or writes it, the person's AI objection is the consent record, and an archive carrying an always-false "consent" would state one nobody gave (tenant-export.md §11). The column itself goes in a later contract migration (rule 12).

func (*Queries) ExportActivityEntries 

func (q *Queries) ExportActivityEntries(ctx context.Context, arg ExportActivityEntriesParams) ([]ExportActivityEntriesRow, error)

func (*Queries) ExportAudit 

func (q *Queries) ExportAudit(ctx context.Context, arg ExportAuditParams) ([]ExportAuditRow, error)

func (*Queries) ExportAutoAssignPolicies 

func (q *Queries) ExportAutoAssignPolicies(ctx context.Context, arg ExportAutoAssignPoliciesParams) ([]ExportAutoAssignPoliciesRow, error)

func (*Queries) ExportAutomationRules 

func (q *Queries) ExportAutomationRules(ctx context.Context, arg ExportAutomationRulesParams) ([]ExportAutomationRulesRow, error)

func (*Queries) ExportBuckets 

func (q *Queries) ExportBuckets(ctx context.Context, arg ExportBucketsParams) ([]ExportBucketsRow, error)

func (*Queries) ExportCalendarFeeds 

func (q *Queries) ExportCalendarFeeds(ctx context.Context, arg ExportCalendarFeedsParams) ([]ExportCalendarFeedsRow, error)

func (*Queries) ExportComments 

func (q *Queries) ExportComments(ctx context.Context, arg ExportCommentsParams) ([]ExportCommentsRow, error)

func (*Queries) ExportConsentRecords 

func (q *Queries) ExportConsentRecords(ctx context.Context, arg ExportConsentRecordsParams) ([]ExportConsentRecordsRow, error)

func (*Queries) ExportContainerMilestones 

func (q *Queries) ExportContainerMilestones(ctx context.Context, arg ExportContainerMilestonesParams) ([]ExportContainerMilestonesRow, error)

Exported whole: a milestone goes with its container and leaves no deletion marker of its own.

func (*Queries) ExportContainers 

func (q *Queries) ExportContainers(ctx context.Context, arg ExportContainersParams) ([]ExportContainersRow, error)

func (*Queries) ExportCustomFieldDefinitions 

func (q *Queries) ExportCustomFieldDefinitions(ctx context.Context, arg ExportCustomFieldDefinitionsParams) ([]ExportCustomFieldDefinitionsRow, error)

func (*Queries) ExportItemAttachments 

func (q *Queries) ExportItemAttachments(ctx context.Context, arg ExportItemAttachmentsParams) ([]ExportItemAttachmentsRow, error)

func (*Queries) ExportItemLabels 

func (q *Queries) ExportItemLabels(ctx context.Context, arg ExportItemLabelsParams) ([]ExportItemLabelsRow, error)

func (*Queries) ExportItemMembers 

func (q *Queries) ExportItemMembers(ctx context.Context, arg ExportItemMembersParams) ([]ExportItemMembersRow, error)

func (*Queries) ExportJumbleEntries 

func (q *Queries) ExportJumbleEntries(ctx context.Context, arg ExportJumbleEntriesParams) ([]ExportJumbleEntriesRow, error)

func (*Queries) ExportLabels 

func (q *Queries) ExportLabels(ctx context.Context, arg ExportLabelsParams) ([]ExportLabelsRow, error)

func (*Queries) ExportLegalHolds 

func (q *Queries) ExportLegalHolds(ctx context.Context, arg ExportLegalHoldsParams) ([]ExportLegalHoldsRow, error)

func (*Queries) ExportMediaObjects 

func (q *Queries) ExportMediaObjects(ctx context.Context, arg ExportMediaObjectsParams) ([]ExportMediaObjectsRow, error)

func (*Queries) ExportMemberships 

func (q *Queries) ExportMemberships(ctx context.Context, arg ExportMembershipsParams) ([]ExportMembershipsRow, error)

func (*Queries) ExportNotificationPreferences 

func (q *Queries) ExportNotificationPreferences(ctx context.Context, arg ExportNotificationPreferencesParams) ([]ExportNotificationPreferencesRow, error)

func (*Queries) ExportPasskeys 

func (q *Queries) ExportPasskeys(ctx context.Context, arg ExportPasskeysParams) ([]ExportPasskeysRow, error)

Exported whole: a passkey changes only by its counter and its last use, and no column says when.

func (*Queries) ExportPrivateHubAccesses 

func (q *Queries) ExportPrivateHubAccesses(ctx context.Context, arg ExportPrivateHubAccessesParams) ([]ExportPrivateHubAccessesRow, error)

Exported whole: an access is written once and never changes.

func (*Queries) ExportRecurrenceRules 

func (q *Queries) ExportRecurrenceRules(ctx context.Context, arg ExportRecurrenceRulesParams) ([]ExportRecurrenceRulesRow, error)

func (*Queries) ExportReminders 

func (q *Queries) ExportReminders(ctx context.Context, arg ExportRemindersParams) ([]ExportRemindersRow, error)

func (*Queries) ExportRetentionPolicies 

func (q *Queries) ExportRetentionPolicies(ctx context.Context, arg ExportRetentionPoliciesParams) ([]ExportRetentionPoliciesRow, error)

func (*Queries) ExportSavedViews 

func (q *Queries) ExportSavedViews(ctx context.Context, arg ExportSavedViewsParams) ([]ExportSavedViewsRow, error)

func (*Queries) ExportSetElements 

func (q *Queries) ExportSetElements(ctx context.Context, arg ExportSetElementsParams) ([]ExportSetElementsRow, error)

func (*Queries) ExportStructurePresets 

func (q *Queries) ExportStructurePresets(ctx context.Context, arg ExportStructurePresetsParams) ([]ExportStructurePresetsRow, error)

Exported whole: a withdrawn preset leaves no deletion marker of its own.

func (*Queries) ExportTemplates 

func (q *Queries) ExportTemplates(ctx context.Context, arg ExportTemplatesParams) ([]ExportTemplatesRow, error)

func (*Queries) ExportTenants 

func (q *Queries) ExportTenants(ctx context.Context, arg ExportTenantsParams) ([]ExportTenantsRow, error)

The export the archive writer reads a tenant through (backup-restore.md §3, §5).

One statement per entity, and they are as alike as the schema lets them be: an identity, when the row last changed, and the row itself as JSON with `tenant_id` taken out - a restore into another tenant must not carry the old one's identifier back in with it. Row level security supplies the tenant condition none of these statements writes (ADR-0010).

Every statement pages on its own key rather than on OFFSET, so a run that is resumed after process death continues where it stopped instead of counting rows again - and so that a page never repeats or skips a row while the snapshot is open.

**An entity is exported as a delta only if the schema lets it say when a row changed.** The ones that cannot - the join tables, and the configuration rows that carry a creation stamp and no change stamp - are exported whole in every archive, and a restore replaces their set rather than merging it. Deriving "unchanged" from a column that does not move is how an incremental chain silently loses an edit, and there is no column here to add that would not be a lie until every writer maintained it.

func (*Queries) ExportTombstones 

func (q *Queries) ExportTombstones(ctx context.Context, arg ExportTombstonesParams) ([]ExportTombstonesRow, error)

One entity at a time, because each entity's deletions belong in its own data file - and because the primary key starts (tenant_id, entity), so asking for one entity is an index range rather than a scan. Paged on (deleted_at, entity_id) for the reason every statement above is: a page that repeated or skipped a row would put a tombstone in one archive and nowhere else.

func (*Queries) ExportWebhookSubscriptions 

func (q *Queries) ExportWebhookSubscriptions(ctx context.Context, arg ExportWebhookSubscriptionsParams) ([]ExportWebhookSubscriptionsRow, error)

func (*Queries) ExportWorkItems 

func (q *Queries) ExportWorkItems(ctx context.Context, arg ExportWorkItemsParams) ([]ExportWorkItemsRow, error)

func (*Queries) ExtendDataSubjectRequest 

func (q *Queries) ExtendDataSubjectRequest(ctx context.Context, arg ExtendDataSubjectRequestParams) (int64, error)

Extends the deadline once (Art. 12(3), data-protection.md §4.1).

Its own statement rather than a field of UpdateDataSubjectRequest, so that no write but this one can move a deadline. The conditions are the domain's, checked again where the write happens: two extensions of one case, or an extension racing a completion, leave exactly one winner, and the loser's zero rows are read back to say which condition failed. `now` is the caller's clock rather than the database's (rule 4). The original deadline is the stored one, taken in the same statement.

func (*Queries) ExtendSession 

func (q *Queries) ExtendSession(ctx context.Context, arg ExtendSessionParams) error

Rotation slides the horizon: the session lives as long as its newest refresh token could.

func (*Queries) FieldClocksOf 

func (q *Queries) FieldClocksOf(ctx context.Context, arg FieldClocksOfParams) ([]FieldClocksOfRow, error)

Every field of one entity that has a reading, for the merge to compare against.

func (*Queries) FindAccessToken 

func (q *Queries) FindAccessToken(ctx context.Context, id pgtype.UUID) (FindAccessTokenRow, error)

func (*Queries) FindAccessTokenByHash 

func (q *Queries) FindAccessTokenByHash(ctx context.Context, tokenHash []byte) (FindAccessTokenByHashRow, error)

func (*Queries) FindAccount 

func (q *Queries) FindAccount(ctx context.Context, id pgtype.UUID) (FindAccountRow, error)

============================== Accounts ============================== The tenant is never a parameter in this file: row level security bounds every statement to the tenant of the running transaction, which is what makes an account of another tenant not found rather than forbidden (ADR-0010, multi-tenancy.md §2).

func (*Queries) FindAccountByEmail 

func (q *Queries) FindAccountByEmail(ctx context.Context, email string) (FindAccountByEmailRow, error)

Compared lower case, the way the uniqueness index does - two spellings of one address are two accounts for one person otherwise (account_email_uq).

func (*Queries) FindAccountByEmailForPassword 

func (q *Queries) FindAccountByEmailForPassword(ctx context.Context, email string) (FindAccountByEmailForPasswordRow, error)

The same, by address, for the reset that must answer identically whether or not it found one.

func (*Queries) FindAccountByProviderSubject 

func (q *Queries) FindAccountByProviderSubject(ctx context.Context, arg FindAccountByProviderSubjectParams) (FindAccountByProviderSubjectRow, error)

The subject the provider vouched for, under the unique index that makes it one account per provider per workspace (migration 0103). Deleted accounts are excluded: an arriving subject whose account was deleted is a first arrival, not a resurrection.

func (*Queries) FindAccountByRedemptionHash 

func (q *Queries) FindAccountByRedemptionHash(ctx context.Context, tokenHash []byte) (FindAccountByRedemptionHashRow, error)

func (*Queries) FindAccountBySignInName 

func (q *Queries) FindAccountBySignInName(ctx context.Context, signInName *string) (FindAccountBySignInNameRow, error)

Compared folded, the form it is stored in (account_sign_in_name_uq); the caller folds it.

func (*Queries) FindAccountForPassword 

func (q *Queries) FindAccountForPassword(ctx context.Context, id pgtype.UUID) (FindAccountForPasswordRow, error)

What setting or judging a password needs of the account (ADR-0068 §5).

func (*Queries) FindAccountForSignIn 

func (q *Queries) FindAccountForSignIn(ctx context.Context, arg FindAccountForSignInParams) (FindAccountForSignInRow, error)

============================== Sign-in ============================== The credential check's read: the stored hash beside everything the session will need, in one round trip. An identifier is an address or a sign-in name by its shape, so exactly one of the two arguments is set: the address compared lower case, as account_email_uq does; the name folded by the caller, as account_sign_in_name_uq stores it. One statement for both, so a name and an address cost the same round trip (T-02).

func (*Queries) FindAddressRequestByHash 

func (q *Queries) FindAddressRequestByHash(ctx context.Context, tokenHash []byte) (FindAddressRequestByHashRow, error)

The confirmation's read: the request, its account's state and the workspace's.

func (*Queries) FindAiProvider 

func (q *Queries) FindAiProvider(ctx context.Context) (FindAiProviderRow, error)

What a reader is allowed to see: never the sealed key, only whether there is one. The single caller that needs the plaintext asks for it by name below, so a read cannot spill it by accident.

func (*Queries) FindAiProviderKey 

func (q *Queries) FindAiProviderKey(ctx context.Context) (FindAiProviderKeyRow, error)

The adapter's own read, separate from the one above so that opening the envelope is a deliberate call and not a field that happens to be in a struct somebody logged.

func (*Queries) FindAiRequest 

func (q *Queries) FindAiRequest(ctx context.Context, id pgtype.UUID) (FindAiRequestRow, error)

func (*Queries) FindAiSource 

func (q *Queries) FindAiSource(ctx context.Context) (AiSource, error)

The workspace's choice of AI source (ADR-0072 §2, §3). One row per workspace at most; no row is the workspace's own model, which is what every workspace did before anything was offered.

func (*Queries) FindArrivalPendingByHash 

func (q *Queries) FindArrivalPendingByHash(ctx context.Context, tokenHash []byte) (FindArrivalPendingByHashRow, error)

A TERMS step that carries a provider's newcomer rather than an account (migration 0142): the row and the workspace, nothing to join an account from. Read only by the agreement, and only under its purpose: a passkey sign-in's challenge has no account either (migration 0174).

func (*Queries) FindAuthAttempt 

func (q *Queries) FindAuthAttempt(ctx context.Context, subjectHash []byte) (FindAuthAttemptRow, error)

========================= The attempt ledger (T-02) =========================

func (*Queries) FindAutoAssignPolicy 

func (q *Queries) FindAutoAssignPolicy(ctx context.Context, arg FindAutoAssignPolicyParams) (AutoAssignPolicy, error)

How what is created here gets handed out: the assignment policy per scope.

One row per scope, which migration 0011's unique index insists on: the row is the storage of the `autoAssign` key of the container's policies document, and a document key cannot be two rows. `state` is ROUND_ROBIN's cursor, kept in the row rather than in the document so that the transaction advancing it can lock exactly what it advances (domain-model.md §3.6).

func (*Queries) FindAutomationRule 

func (q *Queries) FindAutomationRule(ctx context.Context, id pgtype.UUID) (FindAutomationRuleRow, error)

func (*Queries) FindAutomationRuleByInboundToken 

func (q *Queries) FindAutomationRuleByInboundToken(ctx context.Context, tokenHash []byte) (FindAutomationRuleByInboundTokenRow, error)

What the unauthenticated route asks. The tenant is the transaction's, set from the tenant the token names inside itself - the only honest source of one on a route with no authentication (multi-tenancy.md §2.2). The hash is unique across the installation, so a token rewritten to quote another tenant matches nothing.

func (*Queries) FindBackupRun 

func (q *Queries) FindBackupRun(ctx context.Context, id pgtype.UUID) (FindBackupRunRow, error)

func (*Queries) FindBackupSchedule 

func (q *Queries) FindBackupSchedule(ctx context.Context, id pgtype.UUID) (BackupSchedule, error)

func (*Queries) FindBackupTarget 

func (q *Queries) FindBackupTarget(ctx context.Context, id pgtype.UUID) (FindBackupTargetRow, error)

func (*Queries) FindBackupTargetCredential 

func (q *Queries) FindBackupTargetCredential(ctx context.Context, id pgtype.UUID) (FindBackupTargetCredentialRow, error)

The one statement that reads the sealed credential, and it reads nothing else. A separate statement rather than a column on the two above: what a credential must never do is travel with something that is on its way to a response, and the way to make that structural is for the rows that go to a response never to contain one.

func (*Queries) FindBucket 

func (q *Queries) FindBucket(ctx context.Context, id pgtype.UUID) (Bucket, error)

The structure of a collection: the buckets its items are arranged in, and the labels they are tagged with.

The tenant is never a parameter here, exactly as in Work.sql: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against. A row can therefore not be written into the wrong tenant even by a caller that wanted to. Deleted buckets are returned rather than filtered out. What the state means is the domain's decision; a query that hid a deleted bucket would turn "it has been deleted" into "it never existed", and a client repeating a delete would get the wrong answer to the wrong question.

func (*Queries) FindCalendarFeed 

func (q *Queries) FindCalendarFeed(ctx context.Context, id pgtype.UUID) (FindCalendarFeedRow, error)

func (*Queries) FindCalendarFeedByHash 

func (q *Queries) FindCalendarFeedByHash(ctx context.Context, tokenHash []byte) (FindCalendarFeedByHashRow, error)

The public route's whole lookup: one index seek on the unique hash.

A revoked feed is returned rather than filtered out. Whether a token still works is the domain's question, and the answer a fetch gets is the same either way - what changes is that the application layer can tell the two apart in its own reasoning without the query deciding for it.

func (*Queries) FindComment 

func (q *Queries) FindComment(ctx context.Context, id pgtype.UUID) (FindCommentRow, error)

Tombstones are returned rather than filtered out: whether a deleted comment may be edited is the domain's question, and a query that hid one would turn "it was deleted" into "it never existed" - which is not what a thread full of replies to it says.

A tombstone's body is answered empty whatever is stored: the text a legal hold keeps (SetCommentDeleted) is the hold's, never a reader's, and masking it here is what keeps every door from serving it.

func (*Queries) FindContainer 

func (q *Queries) FindContainer(ctx context.Context, id pgtype.UUID) (FindContainerRow, error)

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against. A row can therefore not be written into the wrong tenant even by a caller that wanted to, and a read cannot reach one belonging to somebody else. Trashed and archived containers are returned rather than filtered out. The repository reports what is stored and judges none of it: whether a container may take children is a question the domain answers, and a query that hid a trashed parent would turn "it is in the trash" into "it does not exist" (I-C2, I-C3).

One key of `policies` is read out, not the column: the completion policy has a reader and the keys without a use case do not, and selecting a value nothing consumes is a promise nothing keeps. `->>` yields NULL for a collection that has never been configured, and coalesce turns that into the empty string - which the domain reads as the default. Coalescing here rather than mapping a nil pointer in the adapter keeps the generated field a plain string, and "unset" one concept instead of two.

The auto_assign key of the same document lives in its own row (see Assignment.sql), and the second LEFT JOIN is how it travels with the container: NULL columns for a container without a policy, which the adapter reads as the key being absent. The join lands on migration 0011's unique index, so it costs an index lookup - the same price as the parent join beside it.

The hub's own archive stamp travels with the row as `parent_archived_at`, which is invariant I-C3's second half: a collection in an archived hub is read-only without being archived itself. Read here rather than stored on the collection, so that archiving a hub writes one row and unarchiving it restores exactly what it covered - a collection archived in its own right stays archived. The join is a primary key lookup, and it is NULL for a hub, which sits under nothing.

func (*Queries) FindCustomField 

func (q *Queries) FindCustomField(ctx context.Context, id pgtype.UUID) (FindCustomFieldRow, error)

func (*Queries) FindCustomFieldInScope 

func (q *Queries) FindCustomFieldInScope(ctx context.Context, arg FindCustomFieldInScopeParams) (FindCustomFieldInScopeRow, error)

The definition one entry's collection sees under a key: its collection's own, or the workspace-wide one. The collection's own wins, which is what makes a workspace-wide default overridable by a team that needs something narrower - `ORDER BY` puts the specific one first and the row limit takes it.

func (*Queries) FindDataSubjectRequest 

func (q *Queries) FindDataSubjectRequest(ctx context.Context, id pgtype.UUID) (FindDataSubjectRequestRow, error)

func (*Queries) FindDevice 

func (q *Queries) FindDevice(ctx context.Context, id pgtype.UUID) (FindDeviceRow, error)

func (*Queries) FindGroup 

func (q *Queries) FindGroup(ctx context.Context, id pgtype.UUID) (FindGroupRow, error)

=============================== Groups =============================== The workspace travels with the row: a rename's or a deletion's trail entry is written under it.

func (*Queries) FindIdempotencyRecord 

func (q *Queries) FindIdempotencyRecord(ctx context.Context, arg FindIdempotencyRecordParams) (FindIdempotencyRecordRow, error)

func (*Queries) FindIdentityProviderByID 

func (q *Queries) FindIdentityProviderByID(ctx context.Context, id pgtype.UUID) (FindIdentityProviderByIDRow, error)

What a reader is allowed to see: never the sealed secret. The one caller that needs it asks for it by name below, so a read cannot spill it by accident.

func (*Queries) FindIdentityProviderSecret 

func (q *Queries) FindIdentityProviderSecret(ctx context.Context, id pgtype.UUID) (FindIdentityProviderSecretRow, error)

The token exchange's own read, separate from the one above so that opening the envelope is a deliberate call and not a field that happens to be in a struct somebody logged.

func (*Queries) FindImportRun 

func (q *Queries) FindImportRun(ctx context.Context, id pgtype.UUID) (ImportRun, error)

The columns in the table's order, collection_id last as migration 0200 added it, so that the row is the table's model.

func (*Queries) FindInstallationPreset 

func (q *Queries) FindInstallationPreset(ctx context.Context, id pgtype.UUID) (FindInstallationPresetRow, error)

func (*Queries) FindItemRetention 

func (q *Queries) FindItemRetention(ctx context.Context, id pgtype.UUID) (FindItemRetentionRow, error)

What one entry's marking says, which is what `:retain` reads and what the object carries.

func (*Queries) FindJob 

func (q *Queries) FindJob(ctx context.Context, arg FindJobParams) (FindJobRow, error)

What a caller polls, and the only two statements here that are asked on somebody's behalf rather than by a worker. They therefore carry the tenant condition themselves - the job table has no row level security, so there is no policy underneath that would catch a forgotten one, and a NULL tenant_id (the queue's own housekeeping) matches no caller's tenant by construction.

The columns are the resource's, not the row's: no payload, no attempt count, no lease, no dedupe key. Selecting them and dropping them later is how one of them eventually reaches a response by accident.

func (*Queries) FindJobAsker 

func (q *Queries) FindJobAsker(ctx context.Context, arg FindJobAskerParams) (FindJobAskerRow, error)

Who asked a job, and about what: the kind and the three references a question to AI carries in its payload. The tenant is named in the statement, as in every statement here, because the table has no policy underneath. Empty strings where a payload names none.

func (*Queries) FindJobByDedupeKey 

func (q *Queries) FindJobByDedupeKey(ctx context.Context, arg FindJobByDedupeKeyParams) (pgtype.UUID, error)

The job a dedupe key already names, for the one case the insert above cannot answer for itself.

func (*Queries) FindJumbleEntry 

func (q *Queries) FindJumbleEntry(ctx context.Context, id pgtype.UUID) (FindJumbleEntryRow, error)

tenant_id for ListJumbleEntries' reason, said in full there: the projection carries it because the events a settlement announces are built from the projection. arrival_job_id as there.

func (*Queries) FindJumbleIntake 

func (q *Queries) FindJumbleIntake(ctx context.Context) (pgtype.Timestamptz, error)

What a listing may show: that an address exists and when it was minted. Never the hash.

func (*Queries) FindJumbleIntakeByToken 

func (q *Queries) FindJumbleIntakeByToken(ctx context.Context, tokenHash []byte) (FindJumbleIntakeByTokenRow, error)

The unauthenticated route's lookup, under the tenant context the token itself names (multi-tenancy.md §2.2): row level security needs one before the row is visible at all, and the hash covers the whole presented string, so a rewritten tenant half matches nothing.

func (*Queries) FindLabel 

func (q *Queries) FindLabel(ctx context.Context, id pgtype.UUID) (Label, error)

Deleted labels are returned rather than filtered out, for the reason FindBucket returns deleted buckets: what the state means is the domain's decision.

func (*Queries) FindLegalHold 

func (q *Queries) FindLegalHold(ctx context.Context, id pgtype.UUID) (FindLegalHoldRow, error)

func (*Queries) FindMailSetting 

func (q *Queries) FindMailSetting(ctx context.Context) (FindMailSettingRow, error)

The mail intake (ADR-0094). The tenant is never a parameter except where no tenant is known yet: row level security bounds every other statement to the tenant of the running transaction.

func (*Queries) FindMailbox 

func (q *Queries) FindMailbox(ctx context.Context, id pgtype.UUID) (FindMailboxRow, error)

func (*Queries) FindMediaObject 

func (q *Queries) FindMediaObject(ctx context.Context, id pgtype.UUID) (FindMediaObjectRow, error)

func (*Queries) FindMediaStorageKey 

func (q *Queries) FindMediaStorageKey(ctx context.Context, checksum string) (FindMediaStorageKeyRow, error)

Where the bytes of one medium lie, by the checksum the archive addresses it with.

READY only, and a checksum that is actually there: a PENDING upload is one whose bytes were never read back and judged (migration 0013), and an object with no recorded checksum has no content address at all. Neither is carried into an archive, and the row itself still is - so a restore keeps the metadata and knows the bytes are gone.

func (*Queries) FindMembership 

func (q *Queries) FindMembership(ctx context.Context, id pgtype.UUID) (FindMembershipRow, error)

The tenant is selected although row level security already bounds the statement to it: the grant this answers is what the revocation writes its audit entry from, and an entry without a tenant is refused by the port (audit.md §3).

func (*Queries) FindMfaEnrollment 

func (q *Queries) FindMfaEnrollment(ctx context.Context, accountID pgtype.UUID) (FindMfaEnrollmentRow, error)

func (*Queries) FindNotification 

func (q *Queries) FindNotification(ctx context.Context, id pgtype.UUID) (Notification, error)

func (*Queries) FindNotificationPreference 

func (q *Queries) FindNotificationPreference(ctx context.Context, arg FindNotificationPreferenceParams) (NotificationPreference, error)

func (*Queries) FindOauthClient 

func (q *Queries) FindOauthClient(ctx context.Context, id pgtype.UUID) (FindOauthClientRow, error)

The exchange's read: everything judging a token request needs, the stored hash included - compared in the adapter, never answered upwards.

func (*Queries) FindOauthGrant 

func (q *Queries) FindOauthGrant(ctx context.Context, id pgtype.UUID) (FindOauthGrantRow, error)

func (*Queries) FindOfferedAiProvider 

func (q *Queries) FindOfferedAiProvider(ctx context.Context, id pgtype.UUID) (FindOfferedAiProviderRow, error)

func (*Queries) FindOfferedAiProviderKey 

func (q *Queries) FindOfferedAiProviderKey(ctx context.Context, id pgtype.UUID) (FindOfferedAiProviderKeyRow, error)

The adapter's read of an offered model a workspace chose, inside that workspace's transaction: the read policy admits the row, and the key is opened only by the caller that makes the call.

func (*Queries) FindOutboxEvent 

func (q *Queries) FindOutboxEvent(ctx context.Context, id pgtype.UUID) (FindOutboxEventRow, error)

One event, as it was written. The webhook deliverer renders the body from this rather than from a copy in the job payload, so a retry two days later sends what the first attempt would have - and a job row does not become a second place a workspace's content lives.

func (*Queries) FindPasskeyHolder 

func (q *Queries) FindPasskeyHolder(ctx context.Context, credentialID []byte) (FindPasskeyHolderRow, error)

The credential a browser named and everything the session will need of its holder, in one round trip - the password door's read, keyed on the credential instead of an identifier.

func (*Queries) FindPasswordHash 

func (q *Queries) FindPasswordHash(ctx context.Context, id pgtype.UUID) (*string, error)

For the operations that demand the password afresh of somebody already signed in: disabling the second factor is the attack a stolen session would try, and a live session is deliberately not enough there.

func (*Queries) FindPendingByHash 

func (q *Queries) FindPendingByHash(ctx context.Context, tokenHash []byte) (FindPendingByHashRow, error)

The second step's read: the pending row, its account, and the locale chain in one round trip, FindSessionForAuth's shape.

func (*Queries) FindPendingByID 

func (q *Queries) FindPendingByID(ctx context.Context, id pgtype.UUID) (FindPendingByIDRow, error)

FindPendingByHash for a credential the server itself remembered rather than one a caller presented: the CONNECT link a provider flow carries (ADR-0078 §1). The flow kept the credential's identifier, never its token. Row level security keeps it to the workspace the transaction is bound to.

func (*Queries) FindPendingDeliveryOfPush 

func (q *Queries) FindPendingDeliveryOfPush(ctx context.Context, arg FindPendingDeliveryOfPushParams) (WebhookDelivery, error)

The delivery of one push the fan-out collapses onto (offline-sync.md §8): the same subscription, push, subject and type, still pending, and still owed a job - a pending row whose job ended without sending (webhooks a plan left out, multi-tenancy.md §4.2) is sent by nothing, and an event folded onto it would be lost. FOR UPDATE, because two events of the push dispatched in one round both ask, and both must land on the one row.

func (*Queries) FindPlanByName 

func (q *Queries) FindPlanByName(ctx context.Context, name string) (FindPlanByNameRow, error)

One plan by its short name, not removed.

func (*Queries) FindPlatformDelivery 

func (q *Queries) FindPlatformDelivery(ctx context.Context, id pgtype.UUID) (PlatformDelivery, error)

func (*Queries) FindPlatformEvent 

func (q *Queries) FindPlatformEvent(ctx context.Context, id pgtype.UUID) (FindPlatformEventRow, error)

func (*Queries) FindPlatformSubscription 

func (q *Queries) FindPlatformSubscription(ctx context.Context, id pgtype.UUID) (FindPlatformSubscriptionRow, error)

func (*Queries) FindPrivateHubAccess 

func (q *Queries) FindPrivateHubAccess(ctx context.Context, id pgtype.UUID) (FindPrivateHubAccessRow, error)

One emergency access with its hub's name: what the members' mail says at delivery.

func (*Queries) FindRecurrenceRuleForItem 

func (q *Queries) FindRecurrenceRuleForItem(ctx context.Context, sourceItemID pgtype.UUID) (FindRecurrenceRuleForItemRow, error)

Every use case starts from the entry - the route is the entry's - so this is the only read the rule needs. Served by recurrence_rule_source_idx, which is also what keeps it single.

func (*Queries) FindRefreshTokenByHash 

func (q *Queries) FindRefreshTokenByHash(ctx context.Context, tokenHash []byte) (FindRefreshTokenByHashRow, error)

The exchange's read: the presented token, its session, the account and the locale chain in one round trip. The rotated ones are found on purpose - a rotated hash presented again is the reuse signal T-01 exists for, and the caller has to be able to tell it from an unknown token.

func (*Queries) FindReminder 

func (q *Queries) FindReminder(ctx context.Context, id pgtype.UUID) (FindReminderRow, error)

func (*Queries) FindRestoreRun 

func (q *Queries) FindRestoreRun(ctx context.Context, id pgtype.UUID) (FindRestoreRunRow, error)

func (*Queries) FindRetentionCursor 

func (q *Queries) FindRetentionCursor(ctx context.Context, arg FindRetentionCursorParams) (FindRetentionCursorRow, error)

Where a read of the rule sweep stopped (data-retention.md §5). A reader is named by its phase and, for phase one, its kind, or for a chain, its rule; the other column stays NULL, and `IS NOT DISTINCT FROM` matches the NULL the unique index treats as one value.

func (*Queries) FindRetentionPolicy 

func (q *Queries) FindRetentionPolicy(ctx context.Context, dataKind string) (FindRetentionPolicyRow, error)

The period in force for one kind.

func (*Queries) FindRetentionRule 

func (q *Queries) FindRetentionRule(ctx context.Context, id pgtype.UUID) (RetentionRule, error)

func (*Queries) FindRuleRun 

func (q *Queries) FindRuleRun(ctx context.Context, id pgtype.UUID) (FindRuleRunRow, error)

func (*Queries) FindSavedView 

func (q *Queries) FindSavedView(ctx context.Context, id pgtype.UUID) (SavedView, error)

func (*Queries) FindSessionForAuth 

func (q *Queries) FindSessionForAuth(ctx context.Context, id pgtype.UUID) (FindSessionForAuthRow, error)

What authenticating a session access token needs: the row the signature named, its account, and the locale chain - one round trip, the FindAccessTokenByHash shape.

func (*Queries) FindStepUpMethod 

func (q *Queries) FindStepUpMethod(ctx context.Context, arg FindStepUpMethodParams) (*string, error)

What proved it, for the audit entry - never the credential.

func (*Queries) FindStructurePreset 

func (q *Queries) FindStructurePreset(ctx context.Context, id pgtype.UUID) (FindStructurePresetRow, error)

func (*Queries) FindSuggestion 

func (q *Queries) FindSuggestion(ctx context.Context, id pgtype.UUID) (FindSuggestionRow, error)

func (*Queries) FindSyncOp 

func (q *Queries) FindSyncOp(ctx context.Context, opID pgtype.UUID) (FindSyncOpRow, error)

The operation log (offline-sync.md §3.2): what a push did with each op_id, kept for the offline window so that a repeated push takes effect exactly once.

func (*Queries) FindTemplate 

func (q *Queries) FindTemplate(ctx context.Context, id pgtype.UUID) (FindTemplateRow, error)

A deleted template is returned rather than filtered out: whether it may still be changed is the domain's question, and a query that hid one would turn "it was deleted" into "it never existed" - which is not what a client holding its identifier is asking.

func (*Queries) FindTenantForAdmin 

func (q *Queries) FindTenantForAdmin(ctx context.Context) (FindTenantForAdminRow, error)

The plan's short name through a join: `plan` carries no policy, so it reads inside the tenant's own transaction (migration 0164).

func (*Queries) FindTermsAgreement 

func (q *Queries) FindTermsAgreement(ctx context.Context, id pgtype.UUID) (FindTermsAgreementRow, error)

The account's latest agreement to the terms of use (UC-ID-19). Row level security keeps it to the workspace the transaction is bound to.

func (*Queries) FindVoiceSetting 

func (q *Queries) FindVoiceSetting(ctx context.Context) (FindVoiceSettingRow, error)

Voice assistants (ADR-0093). The tenant is never a parameter: row level security bounds every statement to the tenant of the running transaction.

func (*Queries) FindWebhookDelivery 

func (q *Queries) FindWebhookDelivery(ctx context.Context, id pgtype.UUID) (WebhookDelivery, error)

The tenant is selected rather than left to row level security to imply, because the aggregate carries it: a retry and a replay both build the next attempt from the row that was read, and a delivery read back without its tenant is one neither of them can construct.

func (*Queries) FindWebhookSubscription 

func (q *Queries) FindWebhookSubscription(ctx context.Context, id pgtype.UUID) (FindWebhookSubscriptionRow, error)

The tenant travels with the aggregate rather than being left to row level security to imply: an audit entry is written under the subscription's tenant, and a subscription read back without one is a subscription no auditable operation can be performed on.

func (*Queries) FindWorkItem 

func (q *Queries) FindWorkItem(ctx context.Context, id pgtype.UUID) (FindWorkItemRow, error)

Trashed and archived items are returned rather than filtered out, for the reason FindContainer returns them: the repository reports what is stored and judges none of it (I-W4).

func (*Queries) FindWorkItemByCalendarUID 

func (q *Queries) FindWorkItemByCalendarUID(ctx context.Context, calendarUid string) (FindWorkItemByCalendarUIDRow, error)

The entry a calendar client's UID names. The same columns as FindWorkItem, so the adapter maps both through one function; the same rule about the trash, for the same reason. The tenant is the transaction's, through row level security and through the partial unique index the lookup uses - one UID is one entry per workspace and nothing across two.

func (*Queries) FindWorkItems 

func (q *Queries) FindWorkItems(ctx context.Context, ids []pgtype.UUID) ([]FindWorkItemsRow, error)

FindWorkItem for many entries in one statement: the retention sweep reads a page's entries at once when a rule's condition names `item`, rather than one statement per candidate. The same columns and the same hiding of a deleted definition's values, so a condition sees what Find would have shown it. An identifier of another tenant is simply absent (row level security).

func (*Queries) FindWorkspace 

func (q *Queries) FindWorkspace(ctx context.Context) (FindWorkspaceRow, error)

The tenant's own row, read from inside the tenant. No tenant parameter: row level security has already bound the transaction to exactly one, which is what makes another workspace invisible rather than forbidden (ADR-0010). The operator's opening of the password rides along: it is read wherever the ways in are, and honoured against the clock by the reader.

func (*Queries) FindWorkspaceName 

func (q *Queries) FindWorkspaceName(ctx context.Context) (string, error)

What §8.3 step 3 asks to have typed. Bounded by row level security to the tenant of the running transaction, so this cannot be used to learn another workspace's name.

func (*Queries) FindWorkspaceStructure 

func (q *Queries) FindWorkspaceStructure(ctx context.Context) (FindWorkspaceStructureRow, error)

The workspace's layer and the row's version.

func (*Queries) FindWorkspaceStructureForShare 

func (q *Queries) FindWorkspaceStructureForShare(ctx context.Context) (FindWorkspaceStructureForShareRow, error)

The same, held while a hub's or a collection's structure is resolved and written from it, so that a workspace write waits for that one and the next reads it.

func (*Queries) FindWorkspaceStructureForUpdate 

func (q *Queries) FindWorkspaceStructureForUpdate(ctx context.Context) (FindWorkspaceStructureForUpdateRow, error)

The same, held by the workspace's own write until it has fanned out.

func (*Queries) FinishBackupRun 

func (q *Queries) FinishBackupRun(ctx context.Context, arg FinishBackupRunParams) (int64, error)

What the run wrote, once it has written it. The manifest is kept as a copy so that a listing can answer without reaching the target, and the target stays the source of truth (§8.1).

func (*Queries) FinishImportRun 

func (q *Queries) FinishImportRun(ctx context.Context, arg FinishImportRunParams) (int64, error)

Refused for a run that is no longer going. COALESCE on the report, so that a failure with nothing to report does not erase what the attempt before it got through.

func (*Queries) FinishRestoreRun 

func (q *Queries) FinishRestoreRun(ctx context.Context, arg FinishRestoreRunParams) (int64, error)

Refused for a run that is no longer going, which is what makes a cancelled restore stay cancelled.

func (*Queries) FinishRetentionRun 

func (q *Queries) FinishRetentionRun(ctx context.Context, arg FinishRetentionRunParams) (int64, error)

What the run did, written when it is over.

`blocked_reasons` is an object keyed by reason rather than a total, because "twelve were kept" is not something an operator can act on and "twelve were kept by a legal hold" is.

func (*Queries) FinishRuleRun 

func (q *Queries) FinishRuleRun(ctx context.Context, arg FinishRuleRunParams) error

The one statement that ends a run, whichever way it ended - and the one that parks it on a WAIT, where finished_at stays NULL because the run is not over.

func (*Queries) FirstBucket 

func (q *Queries) FirstBucket(ctx context.Context, arg FirstBucketParams) (Bucket, error)

The collection's leftmost live bucket, ignoring one: the bucket a deleted column's items fall back to.

Derived rather than stored. `default_bucket_id` is a documented key of the policies document and no use case writes it, so a stored default would be a value nothing keeps up to date - a column deleted while the key still named it would send items into a bucket that is no longer on the board. The leftmost column cannot drift out of step with the columns that exist.

func (*Queries) FlattenWorkItem 

func (q *Queries) FlattenWorkItem(ctx context.Context, arg FlattenWorkItemParams) (int64, error)

Makes an entry a top-level entry of another type (UC-WRK-24 check 6): the one statement that changes an entry's type, which a move never does. The parent goes, the path and the depth are the top level's, the rank is the caller's; under the optimistic lock every write to the row takes. Whatever still lies under it - only trashed entries, since a flatten moves the deepest first - follows through MoveWorkItemSubtree.

func (*Queries) ForgetDevice 

func (q *Queries) ForgetDevice(ctx context.Context, arg ForgetDeviceParams) (ForgetDeviceRow, error)

The mark, and the row as it was: what the caller revokes is the credential the row held.

func (*Queries) ForgetOtherQuotaPeriods 

func (q *Queries) ForgetOtherQuotaPeriods(ctx context.Context, arg ForgetOtherQuotaPeriodsParams) error

A mark is for one limit value or one day: marking another forgets the rest of the quota's, so a changed limit or a new day is a new crossing.

func (*Queries) ForgetPlatformEventReference 

func (q *Queries) ForgetPlatformEventReference(ctx context.Context) (int64, error)

The purge removes the platform's reference from the workspace's kept events, as it removes it from the workspace (multi-tenancy.md §4.3). The workspace is the transaction's, never a parameter.

func (*Queries) ForgetRuleOccurrence 

func (q *Queries) ForgetRuleOccurrence(ctx context.Context, arg ForgetRuleOccurrenceParams) error

The anchor was cleared: this rule owes this entry nothing.

func (*Queries) ForgetRuleOccurrencesOfItem 

func (q *Queries) ForgetRuleOccurrencesOfItem(ctx context.Context, itemID pgtype.UUID) error

The entry went. Every rule's moment for it goes with it - the foreign key would do this on a purge, and this is the same statement for the softer endings a purge never reaches.

func (*Queries) GiveKudos 

func (q *Queries) GiveKudos(ctx context.Context, arg GiveKudosParams) (int64, error)

One person's acknowledgement of another's completion (UC-WRK-29 checks 5 and 6).

Every statement names the reader's own side: whether they gave kudos, or what they received. No statement counts kudos per person, and none answers who gave kudos to somebody else. Idempotent: kudos already given keep their moment.

func (*Queries) GrantMembership 

func (q *Queries) GrantMembership(ctx context.Context, arg GrantMembershipParams) (int64, error)

============================ Memberships ============================= Writes nothing when the subject already holds the role at the scope: `membership_grant_uq` (0149) keeps one row per tenant, subject, scope and role. No row affected means the grant is there already, and EqualMembership answers it.

func (*Queries) GroupHoldsRoleUnderHub 

func (q *Queries) GroupHoldsRoleUnderHub(ctx context.Context, hubID pgtype.UUID) (bool, error)

Whether a group holds a role on the hub, a collection in it, or an entry in one.

func (*Queries) GroupMembers 

func (q *Queries) GroupMembers(ctx context.Context, groupID pgtype.UUID) ([]pgtype.UUID, error)

func (*Queries) HardDeleteTenant 

func (q *Queries) HardDeleteTenant(ctx context.Context, now pgtype.Timestamptz) (int64, error)

The final row. The cascade takes every table with a foreign key; what carries none is removed explicitly around this statement, and the guard re-reads the two facts the grace could have changed - a resumed tenant or a moved deadline makes this delete nothing.

func (*Queries) HasManagedAccounts 

func (q *Queries) HasManagedAccounts(ctx context.Context) (bool, error)

Whether the sign-in card asks for "address or sign-in name": a managed account that can still sign in. An anonymised one has lost its name already; a disabled one may be enabled again.

func (*Queries) HoldJob 

func (q *Queries) HoldJob(ctx context.Context, arg HoldJobParams) (pgtype.UUID, error)

The row lock a pass takes on its own job, held until the caller's transaction ends.

SELECT ... FOR UPDATE rather than an UPDATE: nothing about the row changes, and what is wanted is only that a concurrent Enqueue on this dedupe key waits for the pass rather than finding the row RUNNING and doing nothing. The lease is in the predicate for the reason every other statement here carries it: a worker that fell behind and lost the job locks nothing.

func (*Queries) HoldPlanByName 

func (q *Queries) HoldPlanByName(ctx context.Context, name string) (pgtype.UUID, error)

The plan a workspace is moving onto, held against a removal until the move commits: a removal waits on this lock, then counts the workspace (remove_plan).

func (*Queries) HoldsAccount 

func (q *Queries) HoldsAccount(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsAccountGroup 

func (q *Queries) HoldsAccountGroup(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsAccountGroupMember 

func (q *Queries) HoldsAccountGroupMember(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsActivityEntry 

func (q *Queries) HoldsActivityEntry(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsAnyMembership 

func (q *Queries) HoldsAnyMembership(ctx context.Context, accountID pgtype.UUID) (bool, error)

Whether the account holds a role anywhere in the tenant, directly or through a group.

func (*Queries) HoldsAutoAssignPolicy 

func (q *Queries) HoldsAutoAssignPolicy(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsAutomationRule 

func (q *Queries) HoldsAutomationRule(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsBucket 

func (q *Queries) HoldsBucket(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsCalendarFeed 

func (q *Queries) HoldsCalendarFeed(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsComment 

func (q *Queries) HoldsComment(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsConsentRecord 

func (q *Queries) HoldsConsentRecord(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsContainer 

func (q *Queries) HoldsContainer(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsContainerMilestone 

func (q *Queries) HoldsContainerMilestone(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsCustomFieldDefinition 

func (q *Queries) HoldsCustomFieldDefinition(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsItemAttachment 

func (q *Queries) HoldsItemAttachment(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsItemLabel 

func (q *Queries) HoldsItemLabel(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsItemMember 

func (q *Queries) HoldsItemMember(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsJumbleEntry 

func (q *Queries) HoldsJumbleEntry(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsLabel 

func (q *Queries) HoldsLabel(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsLegalHold 

func (q *Queries) HoldsLegalHold(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsMediaObject 

func (q *Queries) HoldsMediaObject(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsMembership 

func (q *Queries) HoldsMembership(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsNotificationPreference 

func (q *Queries) HoldsNotificationPreference(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsPasskey 

func (q *Queries) HoldsPasskey(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsPrivateHubAccess 

func (q *Queries) HoldsPrivateHubAccess(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsRecurrenceRule 

func (q *Queries) HoldsRecurrenceRule(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsReminder 

func (q *Queries) HoldsReminder(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsRetentionPolicy 

func (q *Queries) HoldsRetentionPolicy(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsSavedView 

func (q *Queries) HoldsSavedView(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsSetElement 

func (q *Queries) HoldsSetElement(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsStructurePreset 

func (q *Queries) HoldsStructurePreset(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsTemplate 

func (q *Queries) HoldsTemplate(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsTenant 

func (q *Queries) HoldsTenant(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsTombstone 

func (q *Queries) HoldsTombstone(ctx context.Context, arg HoldsTombstoneParams) (bool, error)

Whether an entity has been purged (offline-sync.md §7). The trash is not a tombstone: a trashed entry can still be restored, and the use case that receives a mutation about it says so itself.

func (*Queries) HoldsWebhookSubscription 

func (q *Queries) HoldsWebhookSubscription(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HoldsWorkItem 

func (q *Queries) HoldsWorkItem(ctx context.Context, payload []byte) (bool, error)

func (*Queries) HubsOf 

func (q *Queries) HubsOf(ctx context.Context, ids []pgtype.UUID) ([]HubsOfRow, error)

The hub each named container or entry sits under, for the authoriser (domain-model.md §3.2).

One statement for both kinds, because a path names containers and entries alike and the caller should not have to know which identifier is which. Trashed and archived rows answer as they are stored: a role on the hub applies to what lies in its trash as much as to the rest, and a private hub's trash is as private as the hub (ADR-0073 §1).

An entry also answers its collection, so that a path naming only the entry is completed with both levels above it; a container answers none.

func (*Queries) HubsOpenedFor 

func (q *Queries) HubsOpenedFor(ctx context.Context, arg HubsOpenedForParams) ([]pgtype.UUID, error)

Of the named hubs, those the account holds a running emergency access to: what the authoriser asks once a private hub is on a path (identity.md §22).

func (*Queries) ImportAccount 

func (q *Queries) ImportAccount(ctx context.Context, arg ImportAccountParams) (int64, error)

ai_consent is neither written nor updated: an archive from before tenant-export.md §11 still carries it, jsonb_populate_record accepts the key, and the column keeps what it holds. A restricted account is neither deleted nor changed (data-retention.md §4 item 2): the archive's version of it would lift a restriction of processing - one a legal hold may be keeping - by going back in time, which only a deliberate act may do (Art. 18). The same for an account an erasure keeps a part of under a hold, which carries its restriction in the kept record, not its status.

func (*Queries) ImportAccountGroup 

func (q *Queries) ImportAccountGroup(ctx context.Context, arg ImportAccountGroupParams) (int64, error)

func (*Queries) ImportAccountGroupMember 

func (q *Queries) ImportAccountGroupMember(ctx context.Context, arg ImportAccountGroupMemberParams) (int64, error)

func (*Queries) ImportActivityEntry 

func (q *Queries) ImportActivityEntry(ctx context.Context, arg ImportActivityEntryParams) (int64, error)

The conflict target is the partitioned key: a partitioned table cannot hold a unique index on id alone, and occurred_at is immutable on an activity entry, so the pair names the same row the old target did. tenant_id and occurred_at leave the update list - they are the key now.

func (*Queries) ImportAutoAssignPolicy 

func (q *Queries) ImportAutoAssignPolicy(ctx context.Context, arg ImportAutoAssignPolicyParams) (int64, error)

func (*Queries) ImportAutomationRule 

func (q *Queries) ImportAutomationRule(ctx context.Context, arg ImportAutomationRuleParams) (int64, error)

func (*Queries) ImportBucket 

func (q *Queries) ImportBucket(ctx context.Context, arg ImportBucketParams) (int64, error)

func (*Queries) ImportCalendarFeed 

func (q *Queries) ImportCalendarFeed(ctx context.Context, arg ImportCalendarFeedParams) (int64, error)

func (*Queries) ImportComment 

func (q *Queries) ImportComment(ctx context.Context, arg ImportCommentParams) (int64, error)

func (*Queries) ImportConsentRecord 

func (q *Queries) ImportConsentRecord(ctx context.Context, arg ImportConsentRecordParams) (int64, error)

func (*Queries) ImportContainer 

func (q *Queries) ImportContainer(ctx context.Context, arg ImportContainerParams) (int64, error)

func (*Queries) ImportContainerMilestone 

func (q *Queries) ImportContainerMilestone(ctx context.Context, arg ImportContainerMilestoneParams) (int64, error)

With its moment and its container's identity, as a person saw it. A milestone whose container the restore did not bring back marks nothing, and is skipped rather than refused by the foreign key.

func (*Queries) ImportCustomFieldDefinition 

func (q *Queries) ImportCustomFieldDefinition(ctx context.Context, arg ImportCustomFieldDefinitionParams) (int64, error)

func (*Queries) ImportItemAttachment 

func (q *Queries) ImportItemAttachment(ctx context.Context, arg ImportItemAttachmentParams) (int64, error)

func (*Queries) ImportItemLabel 

func (q *Queries) ImportItemLabel(ctx context.Context, arg ImportItemLabelParams) (int64, error)

func (*Queries) ImportItemMember 

func (q *Queries) ImportItemMember(ctx context.Context, arg ImportItemMemberParams) (int64, error)

func (*Queries) ImportJumbleEntry 

func (q *Queries) ImportJumbleEntry(ctx context.Context, arg ImportJumbleEntryParams) (int64, error)

func (*Queries) ImportLabel 

func (q *Queries) ImportLabel(ctx context.Context, arg ImportLabelParams) (int64, error)

func (*Queries) ImportLegalHold 

func (q *Queries) ImportLegalHold(ctx context.Context, arg ImportLegalHoldParams) (int64, error)

func (*Queries) ImportMediaObject 

func (q *Queries) ImportMediaObject(ctx context.Context, arg ImportMediaObjectParams) (int64, error)

func (*Queries) ImportMembership 

func (q *Queries) ImportMembership(ctx context.Context, arg ImportMembershipParams) (int64, error)

A row equal to a membership the tenant holds under another identifier is neither inserted nor, under OVERWRITE, written over the row of its own identifier: a subject holds a role at a scope once (0149), and the index is no arbiter of the upsert. An archive from before 0149 can carry equal rows, and MERGE can meet a role granted again since; the row is reported as skipped rather than failing the restore. The export orders memberships by identifier, so the oldest arrives first and is the one kept, as 0149 keeps it.

func (*Queries) ImportNotificationPreference 

func (q *Queries) ImportNotificationPreference(ctx context.Context, arg ImportNotificationPreferenceParams) (int64, error)

func (*Queries) ImportPasskey 

func (q *Queries) ImportPasskey(ctx context.Context, arg ImportPasskeyParams) (int64, error)

Skipped rather than refused: a passkey whose account the restore did not bring back, one whose identifier another row of the workspace holds, one past the account's ten, and one from an export, which carries no identifier or key (tenant-export.md §9) and so is no credential.

func (*Queries) ImportPrivateHubAccess 

func (q *Queries) ImportPrivateHubAccess(ctx context.Context, arg ImportPrivateHubAccessParams) (int64, error)

An access whose hub the restore did not bring back has nothing to describe, and is skipped rather than refused by the foreign key.

func (*Queries) ImportRecurrenceRule 

func (q *Queries) ImportRecurrenceRule(ctx context.Context, arg ImportRecurrenceRuleParams) (int64, error)

func (*Queries) ImportReminder 

func (q *Queries) ImportReminder(ctx context.Context, arg ImportReminderParams) (int64, error)

func (*Queries) ImportRetentionPolicy 

func (q *Queries) ImportRetentionPolicy(ctx context.Context, arg ImportRetentionPolicyParams) (int64, error)

func (*Queries) ImportSavedView 

func (q *Queries) ImportSavedView(ctx context.Context, arg ImportSavedViewParams) (int64, error)

func (*Queries) ImportSetElement 

func (q *Queries) ImportSetElement(ctx context.Context, arg ImportSetElementParams) (int64, error)

func (*Queries) ImportStructurePreset 

func (q *Queries) ImportStructurePreset(ctx context.Context, arg ImportStructurePresetParams) (int64, error)

A person's own preset whose account the restore did not bring back belongs to nobody, and is skipped rather than refused by the foreign key.

func (*Queries) ImportTemplate 

func (q *Queries) ImportTemplate(ctx context.Context, arg ImportTemplateParams) (int64, error)

func (*Queries) ImportTenant 

func (q *Queries) ImportTenant(ctx context.Context, arg ImportTenantParams) (int64, error)

The statements a restore writes a tenant through (backup-restore.md §8).

One trio per entity: does the tenant already hold this row, write it, and - for REPLACE_TENANT - empty the table. They are as alike as the schema lets them be, and they are hand-written for the reason the export's are: what differs between them is a decision per entity - which columns identify a row, and which of them a generated column may not be written into - and a generator would have to be told all of that anyway.

**The row arrives as one jsonb value and is unpacked by the database.** `jsonb_populate_record` against the table's own row type is what makes the import a statement rather than a string with thirty-eight parameters in it, and rule 9 is the reason that matters: no byte of an archive ever becomes SQL text. A field the archive carries and the table does not have is dropped by the unpacking; a column the archive does not carry arrives NULL.

`tenant_id` is not taken from the archive. It is `current_tenant_id()`, the same value row level security compares against, so a restore cannot write into another tenant even deliberately - which is BK-10 at the layer where it cannot be forgotten (ADR-0010).

The upsert's `WHERE @overwrite` is the conflict rule, in the statement rather than in a branch above it: SKIP is the same statement with the flag false, and a row that was neither inserted nor updated returns nothing at all, which is how the caller tells the three outcomes apart.

func (*Queries) ImportWebhookSubscription 

func (q *Queries) ImportWebhookSubscription(ctx context.Context, arg ImportWebhookSubscriptionParams) (int64, error)

func (*Queries) ImportWorkItem 

func (q *Queries) ImportWorkItem(ctx context.Context, arg ImportWorkItemParams) (int64, error)

`search_vector` is generated by the database and is therefore not written back: the archive carries what the column held, and PostgreSQL refuses an insert into one.

func (*Queries) InsertAccessToken 

func (q *Queries) InsertAccessToken(ctx context.Context, arg InsertAccessTokenParams) error

========================== Personal access tokens ========================== The tenant is never a parameter here either: row level security bounds every statement to the tenant of the running transaction, which is what makes a token of another workspace invisible rather than forbidden (ADR-0010). The hash is computed in the adapter, because the pepper is a secret of that layer and the application must never hold a value it could store by mistake (security.md §8).

func (*Queries) InsertAccount 

func (q *Queries) InsertAccount(ctx context.Context, arg InsertAccountParams) error

func (*Queries) InsertAddressRequest 

func (q *Queries) InsertAddressRequest(ctx context.Context, arg InsertAddressRequestParams) error

No token yet: it is minted when the mail goes out, so the plaintext exists only in the message.

func (*Queries) InsertAuditEntry 

func (q *Queries) InsertAuditEntry(ctx context.Context, arg InsertAuditEntryParams) error

func (*Queries) InsertAuditPseudonym 

func (q *Queries) InsertAuditPseudonym(ctx context.Context, arg InsertAuditPseudonymParams) error

The substitution the audit trail reads at the boundary (audit.md §6). Idempotent on the actor: an erasure that is retried records the same pseudonym rather than a second one.

func (*Queries) InsertAutomationRule 

func (q *Queries) InsertAutomationRule(ctx context.Context, arg InsertAutomationRuleParams) error

The automation rules (automation.md §1). The table has carried the whole model since 0001_init; these are the statements that finally write to it.

The tenant is never a parameter: row level security bounds every statement to the tenant of the running transaction, which is what makes another workspace's rule invisible rather than forbidden (ADR-0010, multi-tenancy.md §2).

`deleted_at IS NULL` is on every read. The deletion is soft so that the runs a rule produced stay readable - a run log whose rule vanished would be a record of actions nobody can account for - and a deleted rule is nevertheless gone from every question anybody asks about rules. A rule is written switched off, which is why `enabled` is a parameter rather than the column's default: writing what a rule would do and letting it loose are two decisions, and the default says the opposite.

func (*Queries) InsertBackupRun 

func (q *Queries) InsertBackupRun(ctx context.Context, arg InsertBackupRunParams) (int64, error)

The runs.

The insert is the lock §5 asks for: one run at a time per target, enforced by the statement rather than by a check the caller ran a moment earlier - a check followed by an insert has a gap between them wide enough for exactly the thing it prevents.

`other.id <> id` is what makes a resumption possible. A worker that died left its own row RUNNING; the attempt that takes the job over is the same run, and it has to be able to carry on rather than be locked out by itself (BK-7). ON CONFLICT DO NOTHING is the other half of that: the second attempt writes nothing and reads the row it already has.

func (*Queries) InsertBackupSchedule 

func (q *Queries) InsertBackupSchedule(ctx context.Context, arg InsertBackupScheduleParams) error

─────────────────────────── The schedules and the runs ───────────────────────────

backup_schedule and backup_run are both behind row level security, so no statement here carries a tenant condition - with one exception that is named where it appears: the instance-wide schedules belong to no tenant, and the leader reads them under a scope that has none.

func (*Queries) InsertBackupTarget 

func (q *Queries) InsertBackupTarget(ctx context.Context, arg InsertBackupTargetParams) error

The backup targets (backup-restore.md §2).

backup_target is behind row level security like every other tenant table, so no statement here carries a tenant condition: the policy applies one no query can forget (ADR-0010). What it means for a target with tenant_id IS NULL - the instance-wide shape 0001_init has always allowed - is that nothing here can see one, because the policy compares against a tenant and an instance-wide row has none. That is deliberate rather than an oversight: the targets a tenant creates are the tenant's.

The credential is read by exactly one statement, and it is named for it. Every other statement selects the columns a caller may see, so a credential cannot reach a response because somebody added a field to a mapper.

func (*Queries) InsertBucket 

func (q *Queries) InsertBucket(ctx context.Context, arg InsertBucketParams) error

The name arrives in Unicode normal form C, for the reason a container's does (InsertContainer): the constructor brings it there, and normalize() stays on the insert and the update as the row's own guarantee for a writer that reaches it without the constructor. "Prüfung" typed with a combining diaeresis and the same word composed are one name to a person, and the unique index has to see them as one name too.

func (*Queries) InsertCalendarFeed 

func (q *Queries) InsertCalendarFeed(ctx context.Context, arg InsertCalendarFeedParams) error

The calendar feeds (api-guidelines.md §7).

The tenant is never a parameter: it comes from the transaction's own context through current_tenant_id(), which is the value row level security compares against (ADR-0010). That holds for the public route as well - the token names its tenant, the caller opens the transaction as that tenant, and the lookup below is then an ordinary tenant-scoped query.

The token itself never appears here. What is stored is a hash the adapter computes with the installation's pepper, under this token's own purpose label, so a stolen dump cannot be turned back into a working feed URL and a hash from here cannot be replayed as a cursor or a personal access token (security.md §5, §8).

func (*Queries) InsertComment 

func (q *Queries) InsertComment(ctx context.Context, arg InsertCommentParams) error

The discussion beside the entries (domain-model.md §3.5).

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against (ADR-0010).

The body arrives in Unicode normal form C, for the reason a container's name does (InsertContainer): the constructor brings it there, and normalize() stays on the insert and the edit as the row's own guarantee for a writer that reaches it without the constructor.

func (*Queries) InsertConsentRecord 

func (q *Queries) InsertConsentRecord(ctx context.Context, arg InsertConsentRecordParams) error

A consent record is never updated in place: what an operator has to be able to show is not "is this allowed now" but "was it allowed then", so a change is a new row and the old one keeps the period it covered.

func (*Queries) InsertContainer 

func (q *Queries) InsertContainer(ctx context.Context, arg InsertContainerParams) (*string, error)

The name arrives in Unicode normal form C - the constructor brings it there, behind the Normalizer port, and the description with it (i18n-l10n.md §5): "Übersicht" typed with a combining diaeresis and the same word composed are one name to a person, and the unique index has to see them as one name too. normalize() stays here and on the update as the row's own guarantee for a writer that reaches it without the constructor; it is idempotent, so the two cannot disagree. The handle the store gave a collection (migration 0204), so the create answers it.

func (*Queries) InsertCustomField 

func (q *Queries) InsertCustomField(ctx context.Context, arg InsertCustomFieldParams) error

Custom field definitions.

The values are not here: they live in `work_item.custom_fields`, a jsonb document on the entry, and are written by the statement beside the entry's own attributes (Work.sql, SetWorkItemCustomFields). What these statements maintain is the vocabulary - which keys exist in which scope, what they may hold, and which item types carry them. The unique index cfd_key_uq decides whether the key is free, rather than a check followed by an insert: two requests arriving in the gap between the two would both pass the check.

func (*Queries) InsertDataSubjectRequest 

func (q *Queries) InsertDataSubjectRequest(ctx context.Context, arg InsertDataSubjectRequestParams) error

Data subject rights (data-protection.md §4). The tables have stood since `0001_init`; these are the first statements over them.

The tenant is never a parameter. It comes from the transaction's own context through current_tenant_id(), which is the value row level security compares against (ADR-0010) - and that holds for the installation-wide case as well: it opens one transaction per tenant rather than one query across tenants.

func (*Queries) InsertGroup 

func (q *Queries) InsertGroup(ctx context.Context, arg InsertGroupParams) error

func (*Queries) InsertIdentityProvider 

func (q *Queries) InsertIdentityProvider(ctx context.Context, arg InsertIdentityProviderParams) (InsertIdentityProviderRow, error)

`current_tenant_id()` rather than an argument, and it is what makes one statement serve both levels: a workspace's transaction writes its own row, and the installation's scope - where the setting is the empty string and the function therefore NULL - writes the row that belongs to nobody. A caller cannot choose which, because there is nothing to pass.

func (*Queries) InsertImportRun 

func (q *Queries) InsertImportRun(ctx context.Context, arg InsertImportRunParams) error

The import from another system (backup-restore.md §9). Every statement is bounded by the transaction's tenant (SET LOCAL app.tenant_id) and the row level security on import_run. The run row, written in the transaction that accepts the import. PENDING: the job has not started, and a caller polling `result_url` sees that rather than a 404.

func (*Queries) InsertInstallationPreset 

func (q *Queries) InsertInstallationPreset(ctx context.Context, arg InsertInstallationPresetParams) (int64, error)

A new preset. A name taken is no row written, which the adapter answers as `presets.name_taken`.

func (*Queries) InsertInstanceEvent 

func (q *Queries) InsertInstanceEvent(ctx context.Context, arg InsertInstanceEventParams) error

====================== The instance's own journal =========================

func (*Queries) InsertItemAttachment 

func (q *Queries) InsertItemAttachment(ctx context.Context, arg InsertItemAttachmentParams) (int64, error)

ON CONFLICT DO NOTHING, for the reason AddItemMember gives: attaching what is already attached is the state the caller asked for, and zero rows is how the caller knows not to raise the reference count twice.

func (*Queries) InsertJumbleEntry 

func (q *Queries) InsertJumbleEntry(ctx context.Context, arg InsertJumbleEntryParams) error

The jumble (domain-model.md §2): entries arrive, are decided about exactly once, and the dismissed ones age out by retention rule.

The tenant is never a parameter: row level security bounds every statement to the tenant of the running transaction (ADR-0010, multi-tenancy.md §2).

func (*Queries) InsertLabel 

func (q *Queries) InsertLabel(ctx context.Context, arg InsertLabelParams) error

func (*Queries) InsertLegalHold 

func (q *Queries) InsertLegalHold(ctx context.Context, arg InsertLegalHoldParams) error

A hold, placed. `placed_by` is not optional: §4.1 makes lifting one auditable, and an obligation with no author is one nobody can be asked about.

func (*Queries) InsertMailReceipt 

func (q *Queries) InsertMailReceipt(ctx context.Context, arg InsertMailReceiptParams) (int64, error)

A message received twice at once keeps the first receipt; the second inserts nothing.

func (*Queries) InsertMailbox 

func (q *Queries) InsertMailbox(ctx context.Context, arg InsertMailboxParams) error

func (*Queries) InsertMailboxAuthorization 

func (q *Queries) InsertMailboxAuthorization(ctx context.Context, arg InsertMailboxAuthorizationParams) error

func (*Queries) InsertManagedAccount 

func (q *Queries) InsertManagedAccount(ctx context.Context, arg InsertManagedAccountParams) error

A managed account (ADR-0074): a sign-in name instead of an address, active at once, holding the start password Hubtask drew - its hash, the moment it was set, and the mark that it is a start password (start_password_at), which the first sign-in's change step clears.

func (*Queries) InsertMediaObject 

func (q *Queries) InsertMediaObject(ctx context.Context, arg InsertMediaObjectParams) error

The media objects and what references them (domain-model.md §3.5).

The tenant is never a parameter: it comes from the transaction's own context through current_tenant_id(), the same value row level security compares against (ADR-0010).

func (*Queries) InsertNotification 

func (q *Queries) InsertNotification(ctx context.Context, arg InsertNotificationParams) (int64, error)

The notification record and what people have said about being told (arc42 §5.2).

The tenant is never a parameter: it comes from the transaction's own context through current_tenant_id(), the same value row level security compares against (ADR-0010). The consumer's write, idempotent by the unique index rather than by a read first.

The outbox delivers at-least-once (ADR-0007), so a consumer may see the same event twice - and asking whether a record exists before writing one is a race two dispatchers both win. The conflict is the answer: zero rows means somebody already wrote it, and the caller does not enqueue a second delivery.

func (*Queries) InsertOauthClient 

func (q *Queries) InsertOauthClient(ctx context.Context, arg InsertOauthClientParams) error

The OAuth2 provider. The tenant is never a parameter: row level security bounds every statement to the tenant of the running transaction (ADR-0010). The secret's hash is computed in the adapter, the pepper's home (security.md §8); NULL for a public client, whose whole authentication is PKCE.

func (*Queries) InsertOauthCode 

func (q *Queries) InsertOauthCode(ctx context.Context, arg InsertOauthCodeParams) error

func (*Queries) InsertOfferedAiProvider 

func (q *Queries) InsertOfferedAiProvider(ctx context.Context, arg InsertOfferedAiProviderParams) (InsertOfferedAiProviderRow, error)

Written only in the installation's own scope, where `current_tenant_id()` is NULL and the installation_write policy is the one that admits it.

func (*Queries) InsertOidcFlow 

func (q *Queries) InsertOidcFlow(ctx context.Context, arg InsertOidcFlowParams) error

A NULL session is a sign-in flow; a session is the step-up at the provider it belongs to (ADR-0075 §2). An invited account is the invitation a sign-in started from (ADR-0078 §1) - and the foreign key on (tenant, account) is what keeps it this workspace's. A pending credential is the CONNECT link a sign-in started from (ADR-0078 §1), kept this workspace's the same way.

func (*Queries) InsertPasskey 

func (q *Queries) InsertPasskey(ctx context.Context, arg InsertPasskeyParams) (int64, error)

A credential identifier already held in this workspace writes nothing.

func (*Queries) InsertPasskeyChallenge 

func (q *Queries) InsertPasskeyChallenge(ctx context.Context, arg InsertPasskeyChallengeParams) error

func (*Queries) InsertPasskeyProofChallenge 

func (q *Queries) InsertPasskeyProofChallenge(ctx context.Context, arg InsertPasskeyProofChallengeParams) error

A challenge a known account answers: the second factor's, a setup's or a fresh proof's (migration 0176). The check constraints hold the session and the handle to their purposes.

func (*Queries) InsertPasskeySignInChallenge 

func (q *Queries) InsertPasskeySignInChallenge(ctx context.Context, arg InsertPasskeySignInChallengeParams) error

A sign-in's challenge names nobody yet (migration 0174).

func (*Queries) InsertPendingCredential 

func (q *Queries) InsertPendingCredential(ctx context.Context, arg InsertPendingCredentialParams) error

====================== The pending credential ======================

func (*Queries) InsertPlan 

func (q *Queries) InsertPlan(ctx context.Context, arg InsertPlanParams) (int64, error)

A new plan. A short name taken - also by a removed plan - is a unique violation the adapter answers as `admin.plan_name_taken`.

func (*Queries) InsertPlatformDelivery 

func (q *Queries) InsertPlatformDelivery(ctx context.Context, arg InsertPlatformDeliveryParams) (int64, error)

A fan-out repeated for one event writes its delivery once.

func (*Queries) InsertPlatformEvent 

func (q *Queries) InsertPlatformEvent(ctx context.Context, arg InsertPlatformEventParams) (int64, error)

A writer that may run twice names a dedupe key, and the second run inserts nothing.

func (*Queries) InsertPlatformSubscription 

func (q *Queries) InsertPlatformSubscription(ctx context.Context, arg InsertPlatformSubscriptionParams) error

The installation's subscriptions for a purchase platform and their deliveries (migration 0182). No tenant: read and written by the control plane under the installation's or the system's scope.

func (*Queries) InsertPrivateHubAccess 

func (q *Queries) InsertPrivateHubAccess(ctx context.Context, arg InsertPrivateHubAccessParams) error

The workspace owner's emergency access to a private hub (ADR-0073 §4): who, why, and the hour.

func (*Queries) InsertRecoveredErasureCase 

func (q *Queries) InsertRecoveredErasureCase(ctx context.Context, arg InsertRecoveredErasureCaseParams) (int64, error)

An erasure case a point-in-time recovery rewound away, written again as it stood at the end of the archive (backup-restore.md §8.5 step 5): its own identifier, moments, deadline and extension, open until the erasure has run again. Nothing when the workspace holds the case already - the caller then compares what it holds.

func (*Queries) InsertRecoveryCode 

func (q *Queries) InsertRecoveryCode(ctx context.Context, arg InsertRecoveryCodeParams) error

The hash is computed in the adapter, the pepper's home (security.md §8).

func (*Queries) InsertRecurrenceRule 

func (q *Queries) InsertRecurrenceRule(ctx context.Context, arg InsertRecurrenceRuleParams) error

The series beside the entries (domain-model.md §3.5).

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against (ADR-0010).

Nothing in this file expands anything. What a rule means is a library's answer behind a port (ADR-0008), and what is stored is the text somebody wrote plus the fields that qualify it.

func (*Queries) InsertRefreshToken 

func (q *Queries) InsertRefreshToken(ctx context.Context, arg InsertRefreshTokenParams) error

============================ Refresh tokens ============================ The hash is computed in the adapter, because the pepper is a secret of that layer and the application must never hold a value it could store by mistake (security.md §8).

func (*Queries) InsertReminder 

func (q *Queries) InsertReminder(ctx context.Context, arg InsertReminderParams) error

The reminders beside the entries (domain-model.md §3.5).

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against (ADR-0010).

Nothing in this file computes a moment. fire_at arrives already decided, because deciding it is reading an offset spec against a due date in an IANA zone - domain arithmetic (rule 4), and the one place it may live is the one that can be tested without a database.

func (*Queries) InsertRestoreRun 

func (q *Queries) InsertRestoreRun(ctx context.Context, arg InsertRestoreRunParams) error

The run row, written in the transaction that accepts the restore (§8.3 step 1). PENDING: the job has not started, and a caller polling `result_url` sees that rather than a 404.

func (*Queries) InsertRetentionRule 

func (q *Queries) InsertRetentionRule(ctx context.Context, arg InsertRetentionRuleParams) error

The rule model of data-retention.md §2 and the two phases that execute it.

Row level security supplies the tenant condition none of these statements writes (ADR-0010).

The anchor a period runs from is a column, and a column is not something a caller may name: rule 9 admits no byte of a request into SQL text. So there is one candidate statement per anchor rather than one statement with the column as a parameter, and the catalogue in the domain says which of them a kind uses. Three anchors are enough for what this build sweeps; a fourth kind brings a fourth statement, which is the honest cost of the rule.

func (*Queries) InsertRuleRun 

func (q *Queries) InsertRuleRun(ctx context.Context, arg InsertRuleRunParams) error

The run log (automation.md §2). What a rule did, why it did not, and what each action answered - the record §2 promises is retrievable and filterable. Written when the run starts, in the RUNNING state, before any condition is evaluated.

Before rather than after, because a row written when a run ends loses exactly the runs somebody needs to see: a process that dies mid-run leaves RUNNING behind, and that is the only thing that distinguishes a crash from a run nobody attempted.

func (*Queries) InsertSavedView 

func (q *Queries) InsertSavedView(ctx context.Context, arg InsertSavedViewParams) error

Saved views.

The query column is stored exactly as the client sent it, validated by the application against the same grammar the query endpoint applies. Nothing here interprets it - or the layout, or the visible fields: this table is a bookmark shelf, and what a bookmark opens into is decided by whoever opens it, under their own authorisation.

func (*Queries) InsertSession 

func (q *Queries) InsertSession(ctx context.Context, arg InsertSessionParams) error

============================== Sessions ============================== grant_id and scopes are the OAuth grant's leash: set for a session an OAuth exchange issued, NULL for a person's own.

func (*Queries) InsertStructurePreset 

func (q *Queries) InsertStructurePreset(ctx context.Context, arg InsertStructurePresetParams) error

Saved presets (UC-WRK-30): the workspace's and each person's own.

The tenant is never a parameter: it comes from the transaction's context through current_tenant_id(), the value row level security compares against. Which person may read which own preset is the application's decision (rule 2); the queries only narrow by what they are given.

func (*Queries) InsertTemplate 

func (q *Queries) InsertTemplate(ctx context.Context, arg InsertTemplateParams) error

The templates (domain-model.md §3.5).

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against (ADR-0010).

The tree is stored as the document it is. Nothing here interprets it: which type may sit under which is the hierarchy's answer and is decided before a row is written, and what a relative date means is decided when the template is stamped out.

func (*Queries) InsertTenant 

func (q *Queries) InsertTenant(ctx context.Context, arg InsertTenantParams) error

Runs inside the new tenant's own scope: the tenant_self policy's WITH CHECK compares the row against current_tenant_id(), so the first write a tenant ever sees is already bounded to it.

func (*Queries) InsertTenantHost 

func (q *Queries) InsertTenantHost(ctx context.Context, arg InsertTenantHostParams) error

A host a workspace answers at. `current_tenant_id()` rather than an argument, as every tenant-scoped insert here: the workspace is the transaction's, not the caller's to name.

func (*Queries) InsertVoiceAlias 

func (q *Queries) InsertVoiceAlias(ctx context.Context, arg InsertVoiceAliasParams) error

func (*Queries) InsertWebhookDelivery 

func (q *Queries) InsertWebhookDelivery(ctx context.Context, arg InsertWebhookDeliveryParams) error

============================== Deliveries ==============================

func (*Queries) InsertWebhookSubscription 

func (q *Queries) InsertWebhookSubscription(ctx context.Context, arg InsertWebhookSubscriptionParams) error

Webhook subscriptions and their deliveries (automation.md §3.1).

The tenant is never a parameter: row level security bounds every statement to the tenant of the running transaction, which is what makes another workspace's subscription invisible rather than forbidden (ADR-0010, multi-tenancy.md §2).

The sealed secrets travel as a ciphertext and a key identifier together. A sealed value is a pair - the envelope opens under whichever master key sealed it - and an installation that has rotated its keyring holds several.

func (*Queries) InsertWorkItem 

func (q *Queries) InsertWorkItem(ctx context.Context, arg InsertWorkItemParams) (*int64, error)

The title arrives in Unicode normal form C: the constructor brings it there, behind the Normalizer port, so that what the domain answers, the change set records and the row holds are one string (i18n-l10n.md §5). normalize() stays on the insert as the row's own guarantee for a writer that reaches it without the constructor - a restore, a copy of a row written before the form was applied. It is idempotent, so the two cannot disagree.

The fields this use case does not own are absent rather than defaulted: labels, members, assignee, due date, cover, custom fields and the recurrence rule are written by the use cases that own them, and their columns carry NULL until then. The due date a create declares reaches the row through that writer in the same transaction, exactly as an assignee does; the start is the create's own, a plain attribute beside the notes.

The calendar UID is the create's own too, and only the create's: it is the address a calendar client chose for the entry, set once here and by no other statement. The number the store drew in the collection (migration 0204), so the create answers it.

func (*Queries) InsertWorkItemCopy 

func (q *Queries) InsertWorkItemCopy(ctx context.Context, arg InsertWorkItemCopyParams) error

A copy of an entry: a new row that carries the description of another one.

Its own statement rather than more columns on InsertWorkItem, because the two write different things. A create writes what its use case owns and leaves every other column NULL, deliberately, so that a field arrives through the use case that owns it; a copy writes the fields another row already carries, all at once, because there is nothing to decide about them a second time and writing them through five more statements would spend five versions on an entry that was born a moment ago.

What is not here is what a copy does not carry: the completion, which names a person and a moment and would be a false record on an entry that person never touched, the deletion stamps, and the trash batch. The archive stamp is here, because an entry that was put away below the copied one stays put away in the copy rather than being silently brought back.

The custom field document and its definition references arrive together and already resolved against the destination: which definition a value belongs to is decided where the losses are reported (I-W6), not here.

The jumble provenance is absent because no use case writes it yet: it is NULL on every row this installation has, so carrying it would be copying a value nothing can have set. A change that gives it a writer gives it a line here - a copy that silently lost somebody's due date would be worse than the one it lost. The schedule has writers, which is why its four columns are here.

recurrence_rule_id has a writer and is deliberately *not* carried. It says which series an entry belongs to, and a copy belongs to no series: duplicating a recurring task gives somebody a task like it, not a second template producing the same occurrences. The materialisation writes the pointer itself, through the statement that owns it, precisely because an occurrence is the one copy that does belong to a series.

recurrence_source_id is absent for the same reason and one more: it says which entry this one was copied from *as an occurrence*, and somebody duplicating an occurrence gets a task like it rather than a second occurrence of a series they did not touch.

func (*Queries) InstallationUnset 

func (q *Queries) InstallationUnset(ctx context.Context) (bool, error)

No workspace and nobody in the register: the state in which a setup code is issued and the setup card is offered (migration 0128).

func (*Queries) InstanceCensus 

func (q *Queries) InstanceCensus(ctx context.Context) (InstanceCensusRow, error)

The installation at a glance: counts, states and limits, never rows. Through the function rather than against the tables: `account` is behind row level security and FORCE, so the application role cannot count across workspaces at all - and narrow by construction is what makes that exception acceptable (migration 0105). The casts are for the generator: it cannot see into the function's OUT table (`AdminTenants`' own note).

func (*Queries) InstanceQuotaDefaults 

func (q *Queries) InstanceQuotaDefaults(ctx context.Context) ([]InstanceQuotaDefaultsRow, error)

What the installation set as the default ceiling for each quota, which every workspace that set nothing of its own falls back to (ADR-0070 §2, the concept's §6.7).

`instance_setting` carries no row level security — that is its documented exception — so this read works inside a tenant's own transaction, where the quota guard runs.

func (*Queries) InvitationIsOpen 

func (q *Queries) InvitationIsOpen(ctx context.Context, id pgtype.UUID) (bool, error)

Whether the people count holds this invitation: the same condition CountTenantPeople reads.

func (*Queries) IsOperator 

func (q *Queries) IsOperator(ctx context.Context, accountID pgtype.UUID) (bool, error)

The register's check, asked when `admin:tenants` is minted and when it is exercised (ADR-0070 §1). Through the function rather than against the table: `operator` carries no policy and no grant, so the four narrow doors are the only way to it.

func (*Queries) IsRegisteredServiceAccount 

func (q *Queries) IsRegisteredServiceAccount(ctx context.Context, accountID pgtype.UUID) (bool, error)

Whether the register holds the account's own row, and holds it as a service account's - not the empty register's owner, whom `is_operator` admits as well: a purchase platform's service account requests a deletion without a step-up only when it is registered (UC-INS-08 check 7). Through the roster's function, the register's narrow door, so no new grant is needed.

func (*Queries) IssueSetupCode 

func (q *Queries) IssueSetupCode(ctx context.Context, arg IssueSetupCodeParams) (bool, error)

Lands only on an empty installation; false otherwise.

func (*Queries) IssueStartPassword 

func (q *Queries) IssueStartPassword(ctx context.Context, arg IssueStartPasswordParams) (int64, error)

A new start password for a managed account (ADR-0074 §4): the hash, the moment, and the mark that sends the next sign-in into choosing a password. "Managed" is checked here, in the writing statement, so an address confirmed a moment earlier wins and nothing is renewed (zero rows).

func (*Queries) ItemByKey 

func (q *Queries) ItemByKey(ctx context.Context, arg ItemByKeyParams) (pgtype.UUID, error)

func (*Queries) ItemContributors 

func (q *Queries) ItemContributors(ctx context.Context, ids []pgtype.UUID) ([]ItemContributorsRow, error)

Whose own data goes with each of these entries: who created it, who commented on it, who uploaded a file attached to it. A hold on one of those accounts covers the entry, because the comments and the attachments fall with it (data-protection.md §4.1). Asked only while such a hold is in force.

func (*Queries) ItemKey 

func (q *Queries) ItemKey(ctx context.Context, id pgtype.UUID) (ItemKeyRow, error)

An entry's ticket key, for the Reply-To of a notification about it.

func (*Queries) JobQueueDepth 

func (q *Queries) JobQueueDepth(ctx context.Context, now pgtype.Timestamptz) ([]JobQueueDepthRow, error)

The backlog: what is due and waiting, not what is running. Counting work in flight would make a busy queue look like a stuck one, and the alert hangs off this number rising (alert A-06).

func (*Queries) JournalledDeletions 

func (q *Queries) JournalledDeletions(ctx context.Context, arg JournalledDeletionsParams) ([]JournalledDeletionsRow, error)

The statements a restore reads and records itself through (backup-restore.md §7, §8).

Row level security supplies the tenant condition none of these statements writes (ADR-0010), which is BK-10 at the layer where it cannot be forgotten: a restore into another tenant's archive is refused by the use case, and a statement that reached across anyway would find nothing. The deletion journal, read for the first time in production (§7).

Paged on (deleted_at, entity, entity_id) rather than on OFFSET, for the reason the export is: a page over a set another statement may reorder can repeat a row or drop one, and dropping one here means an object comes back that somebody asked to have deleted.

func (*Queries) KeptCommentTexts 

func (q *Queries) KeptCommentTexts(ctx context.Context, arg KeptCommentTextsParams) ([]KeptCommentTextsRow, error)

The tombstones whose text a legal hold kept, with where their entry is: what a hold is judged against (lifecycle.Target) - the entry's path, its collection and the collection's hub. One page in identifier order; the pass walks every page, because a text still held stays in the set. Served by comment_kept_text_idx, which is partial on exactly this predicate.

func (*Queries) KudosGiven 

func (q *Queries) KudosGiven(ctx context.Context, arg KudosGivenParams) (bool, error)

Whether the reader gave kudos to this person's completion of the entry.

func (*Queries) KudosOfAccount 

func (q *Queries) KudosOfAccount(ctx context.Context, arg KudosOfAccountParams) ([]KudosOfAccountRow, error)

The kudos the person gave and received, for their own copy of their data, a page at a time in the key's order. Never kudos between two other people.

func (*Queries) KudosReceived 

func (q *Queries) KudosReceived(ctx context.Context, arg KudosReceivedParams) ([]KudosReceivedRow, error)

The kudos the reader received on the entry, oldest first. Bounded: an entry has as many givers as it has readers, and the answer is one person's.

func (*Queries) LabelExists 

func (q *Queries) LabelExists(ctx context.Context, id pgtype.UUID) (bool, error)

The check's resolver (ADR-0060): does something a rule names still exist. One statement per kind rather than one over a table name, because a table name cannot be a parameter and a statement assembled from one would be the thing rule 9 forbids. Each answers under the tenant context, so another workspace's object is "no" rather than a leak; "exists" means what the kind's own reads mean by it - not deleted, and for an account, able to act.

func (*Queries) LastAuditAnchor 

func (q *Queries) LastAuditAnchor(ctx context.Context) (LastAuditAnchorRow, error)

The last chain end this tenant exported to an append-only target outside the database.

Written by the anchoring job (audit.md §3): `:verify` proves the chain is intact *inside* the database, and only an anchor proves anything against somebody who can rewrite the whole of it. `sealed_until` is null where a workspace has never anchored - null being the honest answer rather than a date that would claim more than the system does.

func (*Queries) LastAuditEntry 

func (q *Queries) LastAuditEntry(ctx context.Context) (LastAuditEntryRow, error)

The tail of this tenant's chain: the sequence number to continue from and the hash to chain to. No row means this is the first entry.

Ordered by `seq`, and only by `seq`. It used to read `occurred_at DESC, seq DESC`, and that is a chain that breaks under concurrency: each caller takes its own `Clock.Now()` *before* it queues for the advisory lock, so the entry with the newest timestamp is not always the one with the highest sequence number. A transaction that read such a tail continued from a sequence number that was already taken - the unique index cannot stop it, because a partitioned table's unique index has to carry the partition key and `(tenant_id, occurred_at, seq)` lets one `seq` appear twice under two timestamps. The result was duplicated sequence numbers, a chain that no longer verified, and a `audit.chain_broken` entry reporting tampering that never happened. Eight concurrent writes show it; AT-2 writes its thousand entries one after another and cannot.

`audit_seq_idx` is what keeps this a lookup rather than a scan of every partition.

func (*Queries) LastBucketOrderKey 

func (q *Queries) LastBucketOrderKey(ctx context.Context, collectionID pgtype.UUID) (string, error)

The highest rank among a collection's buckets, or no row when it has none.

Deleted buckets count. Their rank is still occupied - a restore has to land where it was, and reusing the key would put two columns in the same place.

func (*Queries) LastContainerOrderKey 

func (q *Queries) LastContainerOrderKey(ctx context.Context, parentID pgtype.UUID) (string, error)

The highest rank directly under a parent, or no row when the level is empty. A NULL parent is the hub level, which is why the comparison is IS NOT DISTINCT FROM rather than `=`: `NULL = NULL` is unknown, and the hubs would come back as no rows at all.

Trashed containers count. Their rank is still occupied - a restore has to land where it was.

COLLATE "C" for the reason migration 0007 gives: a rank key is a fractional index that rests on byte order, and under a linguistic collation "Zz" would sort above "a0".

func (*Queries) LastSuccessfulBackupPerTarget 

func (q *Queries) LastSuccessfulBackupPerTarget(ctx context.Context) ([]LastSuccessfulBackupPerTargetRow, error)

The number alert A-12 watches: when each target last had a backup that worked (observability-reliability.md §10). One row per target, and a target that has never had one is absent rather than zero - a gauge of zero reads as "1970" on every dashboard.

func (*Queries) LastWorkItemOrderKey 

func (q *Queries) LastWorkItemOrderKey(ctx context.Context, arg LastWorkItemOrderKeyParams) (string, error)

The highest rank among the siblings of a new item: same collection, same parent. A NULL parent is the level directly under the collection, which is why the comparison is IS NOT DISTINCT FROM rather than `=` - `NULL = NULL` is unknown, and the tasks would come back as no rows at all.

Trashed items count. Their rank is still occupied; a restore has to land where it was.

COLLATE "C" for the reason migration 0007 gives: a rank key is a fractional index that rests on byte order, and under a linguistic collation "Zz" would sort above "a0".

func (*Queries) LatestAddressRequest 

func (q *Queries) LatestAddressRequest(ctx context.Context, accountID pgtype.UUID) (pgtype.Timestamptz, error)

When the newest request for this account was written, spent or not: the floor counts mails.

func (*Queries) LatestChangeSeq 

func (q *Queries) LatestChangeSeq(ctx context.Context) (int64, error)

Where the log stands now, which is where a client with no cursor starts.

Zero for a tenant that has never changed anything, and that is the right answer rather than a missing one: a stream opened on an untouched workspace resumes from the beginning of a sequence that has not started, and the first change it is told about is the first change there is.

func (*Queries) LatestConsent 

func (q *Queries) LatestConsent(ctx context.Context, arg LatestConsentParams) (LatestConsentRow, error)

func (*Queries) LatestOccurrenceCompletion 

func (q *Queries) LatestOccurrenceCompletion(ctx context.Context, recurrenceRuleID pgtype.UUID) (pgtype.Timestamptz, error)

When the series was last done, which is where an ON_COMPLETION series counts its next occurrence from: "again, two weeks after I last did it". NULL for a series nobody has completed yet.

func (*Queries) LatestRuleRuns 

func (q *Queries) LatestRuleRuns(ctx context.Context, ruleIds []pgtype.UUID) ([]LatestRuleRunsRow, error)

The most recent run of each named rule: what the list says under the rule's word without a page of runs per card. One statement for a page of rules, on the rule index; DISTINCT ON with the index's own order keeps the first row per rule the newest.

func (*Queries) LatestSuccessfulBackupRun 

func (q *Queries) LatestSuccessfulBackupRun(ctx context.Context, targetID pgtype.UUID) (LatestSuccessfulBackupRunRow, error)

The archive an incremental continues: the newest run at this target that finished and left something behind. A run that failed is not a parent - there is no archive at the other end of it.

func (*Queries) LeftOutOfWorkspace 

func (q *Queries) LeftOutOfWorkspace(ctx context.Context) ([]LeftOutOfWorkspaceRow, error)

What the transaction's own workspace's plan leaves out, in one statement: the engine, the fan-out and the registry ask it for every run, event and write of the three features.

func (*Queries) LegalHoldTargetExists 

func (q *Queries) LegalHoldTargetExists(ctx context.Context, arg LegalHoldTargetExistsParams) (bool, error)

Whether what a hold names is in this workspace: a hub or collection, an entry, an account. In the trash or not - a hold on something already trashed is exactly the hold that stops its purge. The tenant comes from the transaction, so another workspace's identifier answers false like one that names nothing (SG-3).

func (*Queries) LinkAccountIdentity 

func (q *Queries) LinkAccountIdentity(ctx context.Context, arg LinkAccountIdentityParams) (int64, error)

Writes the link, and races safely: the unique index on (tenant, provider, subject) is what refuses a subject already spoken for, and `DO NOTHING` is what makes a second sign-in that got there first leave nothing for this one to overwrite. An account already bound to another subject at this provider is never quietly re-pointed, because the primary key refuses that too.

func (*Queries) ListActivity 

func (q *Queries) ListActivity(ctx context.Context, arg ListActivityParams) ([]ListActivityRow, error)

One page of an item's history, newest first.

Keyset rather than an offset, like every other list in this schema (api-guidelines.md §4): an offset re-reads everything it skips and shifts under a concurrent write, and a history is written to precisely while somebody is reading it. The boundary is the pair (occurred_at, id), because two steps of one act share a timestamp - a cursor on the time alone would either skip the second or return the first again forever.

Served by activity_page_idx, whose columns are this ORDER BY.

func (*Queries) ListAuditEntries 

func (q *Queries) ListAuditEntries(ctx context.Context, arg ListAuditEntriesParams) ([]AuditLog, error)

One page of the trail, newest first, with every filter audit.md §5 names.

The filters are parameters rather than a query assembled from strings, which is rule 9 with no exception for "it is only a filter": every one of them is a `narg` that is either NULL - meaning the condition is not there - or a value the driver binds. A `WHERE` built by hand for the three or four filters a caller happened to send is exactly the shape T-06 is about.

`starts_with` rather than LIKE for the action, because a caller's `%` would otherwise be a wildcard: `action` is a dotted code and a prefix filter on `auth.` is the whole point, so the prefix is compared as text rather than as a pattern. `action_also` is the other names of a renamed action, matched whole: the stored entry keeps the name it was written with.

The boundary is the pair (occurred_at, id): entries written in the same transaction share a timestamp, so a cursor on the time alone would either skip one or return one forever. The pair is audit_id_uq's columns, which is the index this reads through.

`tenant_id` is selected rather than taken from the transaction, unlike every other read in this schema. The hash covers the value stored in the row, so a verifier that took the tenant from its own context would be recomputing the digest over what it expected rather than over what is written down (audit.md §3).

func (*Queries) ListAutomationRules 

func (q *Queries) ListAutomationRules(ctx context.Context, arg ListAutomationRulesParams) ([]ListAutomationRulesRow, error)

Newest first by identifier: UUIDv7 is time-ordered, so the primary key is the creation order.

The `enabled` filter is a nullable argument rather than two queries: NULL means "either", which is what an absent query parameter means, and a second statement differing in one predicate is a second place for the `deleted_at` guard to be forgotten.

func (*Queries) ListBackupSchedules 

func (q *Queries) ListBackupSchedules(ctx context.Context) ([]BackupSchedule, error)

func (*Queries) ListBackupTargets 

func (q *Queries) ListBackupTargets(ctx context.Context) ([]ListBackupTargetsRow, error)

The list a client reads back. Ordered by name rather than by creation, because an operator looking for "the Hetzner one" is looking alphabetically.

func (*Queries) ListBuckets 

func (q *Queries) ListBuckets(ctx context.Context, collectionID pgtype.UUID) ([]Bucket, error)

A collection's board, left to right. Not paged: a board has as many columns as fit on a screen, and the contract returns a plain array rather than a page (api-guidelines.md §2). A collection that grows thousands of them has a different problem than pagination solves.

Deleted buckets are never here. Unlike Find, this answers "what is on the board", where a deleted column is not - the same distinction ListWorkItems keeps against FindWorkItem.

COLLATE "C" for the reason migration 0007 gives: a rank key is a fractional index whose scheme rests on byte order, and a database created en_US.utf8 on glibc would order it differently from the domain that produced it. Stated in the query rather than served by an index of its own - a board is a handful of rows, and a sort over it is cheaper than a second index to keep.

`id` closes the order so that two columns sharing a rank still come back in one stable sequence.

func (*Queries) ListCalendarFeedsForAccount 

func (q *Queries) ListCalendarFeedsForAccount(ctx context.Context, accountID pgtype.UUID) ([]ListCalendarFeedsForAccountRow, error)

One person's own feeds, newest first. The account is a parameter rather than implied, because the row level security policy on this table is the tenant's and the "only mine" half is the application layer's rule - stated here as the condition it is, and enforced there as well.

func (*Queries) ListCapabilityProfiles 

func (q *Queries) ListCapabilityProfiles(ctx context.Context) ([]ListCapabilityProfilesRow, error)

The profile that applies, one row per item type: a tenant's own override when it has one, the system default otherwise. DISTINCT ON does the choosing in the database, so the application never has to merge two lists and never has to decide which wins.

No tenant condition: row level security shows the system rows plus this tenant's, and nothing else (db/schema.sql, item_capability_profile).

func (*Queries) ListCollectionsInOrder 

func (q *Queries) ListCollectionsInOrder(ctx context.Context, arg ListCollectionsInOrderParams) ([]ListCollectionsInOrderRow, error)

Every collection a conversion could land in, across the hubs, in the order a person reads the tree: the hubs' manual order, then each hub's collections in theirs. Trashed and archived ones are never here, and neither is a collection under an archived hub - it is archived too (I-C3), and a create there is refused. A private hub's collections only when the caller asks for them: the shared set a model chooses from leaves them out, a person's own picker keeps them and has them narrowed to what that person may create in.

The keyset is the whole sort, (hub's rank, hub, rank, id), in byte order for the reason ListContainers gives. It is a filter, not a permission: who may create where is the application layer's to decide.

func (*Queries) ListComments 

func (q *Queries) ListComments(ctx context.Context, arg ListCommentsParams) ([]ListCommentsRow, error)

One page of one entry's discussion, oldest first: a conversation reads top down, and a page boundary in the middle of it must not reorder what was already read. Tombstones are in it - that is the point of a soft deletion (§3.5) - and the caller serves them without their body, which is answered empty here whatever a hold keeps (FindComment).

Keyset rather than an offset, like every list in this schema (api-guidelines.md §4). The boundary is the pair (created_at, id): two comments written in the same millisecond are one timestamp, and a cursor on the time alone would skip the second or return the first forever. Served by comment_item_idx, whose leading columns are this ORDER BY.

func (*Queries) ListContainers 

func (q *Queries) ListContainers(ctx context.Context, arg ListContainersParams) ([]ListContainersRow, error)

One level of the container tree, in its manual order: the hubs when no parent is named, that hub's collections when one is. IS NOT DISTINCT FROM is what makes the absent parent mean the hub level rather than "no filter" - `parent_id = NULL` is unknown, and the hubs would come back as no rows at all.

The type filter composes with it rather than replacing it, which means the two impossible combinations return an empty page: a collection always has a parent, and a hub never does. That is the filters agreeing, not a special case worth coding.

Trashed rows are never here - the trash is its own view. Archived ones are, when the caller asks: an archived collection is still a collection, and hiding it would make it unreachable. The filter reads the row's own stamp rather than the effective one on purpose - a collection is not hidden from the level because the hub above it was archived, since the client asking for that hub's collections has just been told the hub is archived.

The keyset is (order_key, id) rather than an offset, so a page boundary survives a concurrent insert (api-guidelines.md §4). `id` is the tiebreak the guidelines require, and it is what makes the boundary unambiguous should two siblings ever share a rank.

COLLATE "C" on both the comparison and the order, for the reason migration 0007 gives: a rank key is a fractional index whose scheme rests on byte order, and a database created en_US.utf8 on glibc would order it differently from the domain that produced it.

One row more than the page size is read, and the caller reports has_more from it: asking whether there is a next page is otherwise a second query, and a COUNT over the level is the expensive thing this endpoint exists to avoid.

func (*Queries) ListCustomFieldsInScope 

func (q *Queries) ListCustomFieldsInScope(ctx context.Context, collectionID pgtype.UUID) ([]ListCustomFieldsInScopeRow, error)

Every definition in force for one collection: its own and the workspace-wide ones above it. A NULL collection answers the workspace-wide ones alone, which is what a client configuring the workspace asks for. Ordered by scope and then by key, so the answer is stable and the specific definitions sit beside the general ones they narrow.

func (*Queries) ListDataSubjectRequests 

func (q *Queries) ListDataSubjectRequests(ctx context.Context, arg ListDataSubjectRequestsParams) ([]ListDataSubjectRequestsRow, error)

One page of the cases, the soonest deadline first.

By deadline rather than by receipt, because that is the order the work has to be done in: a case recorded yesterday with a week to run is more urgent than one recorded last month with three. The open ones alone unless the caller asks for the closed ones too - "what do we owe" is what this list answers.

Served by dsr_open_idx (tenant_id, status, due_at) for the open half, which is the half that is read.

func (*Queries) ListDevicesOfAccount 

func (q *Queries) ListDevicesOfAccount(ctx context.Context, accountID pgtype.UUID) ([]ListDevicesOfAccountRow, error)

func (*Queries) ListDueReminders 

func (q *Queries) ListDueReminders(ctx context.Context, arg ListDueRemindersParams) ([]ListDueRemindersRow, error)

What the firing pass takes: this tenant's reminders whose moment has come, oldest first.

FOR UPDATE SKIP LOCKED for the reason the job queue uses it (ADR-0008): two passes that overlap take disjoint sets instead of waiting for each other, and neither sees a row the other is already firing. It is the second lock on the same duty, and the cheaper one - the first is the guarded PENDING -> SENT transition, which is what actually makes a leader failover harmless.

A reminder with no moment is not due: a relative one whose entry lost its due date has nothing to count from, and NULL <= now is unknown rather than true - the condition is written out so that a reader does not have to know that.

func (*Queries) ListGroups 

func (q *Queries) ListGroups(ctx context.Context, arg ListGroupsParams) ([]ListGroupsRow, error)

The workspace's groups by name. The keyset is (lower(name), id) rather than an offset, so that a page boundary survives a concurrent insert (api-guidelines.md §4); `id` is the tiebreak the guidelines require, and lower() is the order the unique index already keeps. One row more than the page size is read, and the caller reports has_more from it. The keyset comparison and the order under one collation, or the page boundary and the page disagree about where a name sorts (migration 0080).

func (*Queries) ListIdentityProviderSecrets 

func (q *Queries) ListIdentityProviderSecrets(ctx context.Context) ([]ListIdentityProviderSecretsRow, error)

The re-seal's read (ADR-0045): every row of *this level* that holds a wrapping, so a rotation can move each one under the key it named when it was read.

`IS NOT DISTINCT FROM` rather than `=`, and that is the whole difference: in a workspace's scope it is the workspace's own rows, and in the installation's - where `current_tenant_id()` is NULL - it is the rows that belong to no workspace. Which is what makes the installation's provider re-sealable at all, by a pass that runs in that scope.

func (*Queries) ListIdentityProviders 

func (q *Queries) ListIdentityProviders(ctx context.Context) ([]ListIdentityProvidersRow, error)

The relying-party surface: the providers a workspace signs in through, and the flows of one sign-in.

Every statement here runs inside the transaction wrapper that sets `app.tenant_id`, so the policy underneath answers "which level" - `current_tenant_id()` is written on insert rather than passed in, and in the installation's own scope it is NULL, which is exactly the row that belongs to no workspace. One insert statement therefore serves both levels, and nothing has to decide which one it is in. The ways in that are in force here: this workspace's own rows and the installation's, which the read policy admits together (migration 0103). The workspace's come first - its own choices sit above the default it inherited - and the sealed secret is in none of it.

func (*Queries) ListInstallationPresets 

func (q *Queries) ListInstallationPresets(ctx context.Context) ([]ListInstallationPresetsRow, error)

The installation's presets (UC-INS-18). No tenant predicate: the table carries no policy, and every workspace reads it; writing it is the control plane's, in a transaction without a tenant. Every preset by name; `id` closes the order.

func (*Queries) ListInstanceEvents 

func (q *Queries) ListInstanceEvents(ctx context.Context, tenantID pgtype.UUID) ([]InstanceEvent, error)

func (*Queries) ListItemAttachmentIDs 

func (q *Queries) ListItemAttachmentIDs(ctx context.Context, itemID pgtype.UUID) ([]pgtype.UUID, error)

The identifiers alone, ordered stably: what the attach and detach answers carry.

func (*Queries) ListItemAttachments 

func (q *Queries) ListItemAttachments(ctx context.Context, arg ListItemAttachmentsParams) ([]ListItemAttachmentsRow, error)

One page of an entry's attachments as media objects, oldest upload first. The keyset is (created_at, id) over the media object, for the reason every list here pages that way (api-guidelines.md §4).

func (*Queries) ListItemLabels 

func (q *Queries) ListItemLabels(ctx context.Context, itemID pgtype.UUID) ([]pgtype.UUID, error)

The labels one item carries, deleted ones left out: the label is gone from the collection's vocabulary, so it is gone from the chips a client renders, without anything having had to rewrite the item.

func (*Queries) ListItemMembers 

func (q *Queries) ListItemMembers(ctx context.Context, itemID pgtype.UUID) ([]pgtype.UUID, error)

Who an entry is on: its member list.

The assignee is a column of `work_item` and is written in Work.sql, where every statement about that row lives. The members are their own table, because a set is not a field: they are joined rather than stored as an array, which is what makes them filterable (domain-model.md §6).

The merge tags both sets share are in Structure.sql. `RecordSetElementAdded` and `RecordSetElementRemoved` already take `set_name` as a parameter for exactly this second caller, so an addition here writes the same shape of tag a label does and the OR-set merge is one implementation rather than two (offline-sync.md §4.2, §10).

The tenant is never a parameter here, exactly as in Work.sql: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against. The accounts one entry carries.

Ordered by identifier rather than by name. A name is display text and this layer has none to sort by (ADR-0011); the order still has to be stable, because a client comparing two reads of the same entry should not see the list rearrange itself.

No join against `account`. An account is not soft deleted the way a label is - it is disabled or it is gone, and a gone one takes its rows with it through the tenant-scoped foreign key - so there is no second table whose stamp could hide a row here.

func (*Queries) ListJumbleEntries 

func (q *Queries) ListJumbleEntries(ctx context.Context, arg ListJumbleEntriesParams) ([]ListJumbleEntriesRow, error)

Newest first by identifier: UUIDv7 is time-ordered, so the primary key is the arrival order. The two filters are nullable arguments rather than four statements, for the run log's reason: a second statement differing in one predicate is a second place for a predicate to be forgotten. tenant_id is selected although row level security has already bounded the statement to one, and that is not redundancy: the projection carries it, and the *events* a settlement announces are built from the projection. Without it every conversion refused as `events.envelope_incomplete` - an entry with no tenant cannot be the subject of an event - which meant converting a jumble entry never worked at all, through a rule or through the API.

arrival_job_id is the proposal the workspace is preparing about an undecided entry (UC-JUM-07 check 10): the newest such job still pending or running, or failed - a spent budget a card says once. A succeeded one is not named: what it proposed is under the suggestions. Read through the job table's two existing indexes (the pending and running dedupe key, the state of the pickup), and named in the workspace's own scope: the table has no row level security.

func (*Queries) ListLabels 

func (q *Queries) ListLabels(ctx context.Context, collectionID pgtype.UUID) ([]Label, error)

A collection's vocabulary, in the order a person reads it: by name. Not by a rank, because a label has none - it is a chip in a set rather than a column in a sequence, and inventing an order for it would be a field nothing means.

The order is hubtask_name deliberately, unlike the boards: this one is read by people and "Ä" belongs beside "A" for them, which is exactly what a byte order would not do - and beside it on every installation, which is what the database's own collation would not promise (migration 0080, i18n-l10n.md §5).

func (*Queries) ListLabelsOfItems 

func (q *Queries) ListLabelsOfItems(ctx context.Context, itemIds []pgtype.UUID) ([]ListLabelsOfItemsRow, error)

The labels a page of entries carries, in one statement: what `expand=labels` needs.

One query for the whole page rather than one per entry. A list of fifty entries is fifty round trips the other way round, which is the cost that makes a relation nobody asked for expensive - and it is why the relation is asked for rather than always included.

Deleted labels are left out, as they are on one entry: the label is gone from the collection's vocabulary, so it is gone from the chips a client renders.

func (*Queries) ListLabelsWithDeleted 

func (q *Queries) ListLabelsWithDeleted(ctx context.Context, collectionID pgtype.UUID) ([]Label, error)

The vocabulary and what was taken out of it, for a client that offers to bring a label back. Same order as ListLabels; a deleted label sorts among the others by its name.

func (*Queries) ListLegalHolds 

func (q *Queries) ListLegalHolds(ctx context.Context, includeReleased bool) ([]ListLegalHoldsRow, error)

Every hold, or only the ones in force. Newest first, because a list of holds is read to answer "what is frozen now" and the answer starts with the most recent decision.

func (*Queries) ListMailboxes 

func (q *Queries) ListMailboxes(ctx context.Context) ([]ListMailboxesRow, error)

func (*Queries) ListMediaReferencingItems 

func (q *Queries) ListMediaReferencingItems(ctx context.Context, mediaID pgtype.UUID) ([]ListMediaReferencingItemsRow, error)

The items an object serves, for GetMedia's authorisation: whoever may read one of them may read the object's record. Bounded - the question is "may this actor see it", and fifty items answer it or nothing will.

func (*Queries) ListMembershipsAtScope 

func (q *Queries) ListMembershipsAtScope(ctx context.Context, arg ListMembershipsAtScopeParams) ([]ListMembershipsAtScopeRow, error)

What is granted at one scope and nothing granted elsewhere. The tenant scope carries no identifier and is matched by its type alone; every other scope by type and identifier, which is what IS NOT DISTINCT FROM does for the NULL. Newest first by identifier: UUIDv7 is time-ordered, so the primary key is the grant order and the keyset needs no second column. One row more than the page is read, and the caller reports has_more from it.

func (*Queries) ListNotificationPreferences 

func (q *Queries) ListNotificationPreferences(ctx context.Context, accountID pgtype.UUID) ([]NotificationPreference, error)

What one account has said, and nothing about what it has not: a pair with no row is the domain's default (notification.DefaultPreference), and the use case fills it in rather than the query inventing it. Ordered so that a form renders the same way twice.

func (*Queries) ListOauthClients 

func (q *Queries) ListOauthClients(ctx context.Context) ([]ListOauthClientsRow, error)

func (*Queries) ListOauthGrants 

func (q *Queries) ListOauthGrants(ctx context.Context, accountID pgtype.UUID) ([]ListOauthGrantsRow, error)

One's own, newest first, with the client's name and when a session under the grant last acted - computed from the sessions rather than written back, so the listing is accurate without the hot path paying a second write.

func (*Queries) ListOfferedAiProviderSecrets 

func (q *Queries) ListOfferedAiProviderSecrets(ctx context.Context) ([]ListOfferedAiProviderSecretsRow, error)

The installation round's read (ADR-0045): every offered model that holds a key, with the key it names, so the round can move each one under the purpose of its own row.

func (*Queries) ListOfferedAiProviders 

func (q *Queries) ListOfferedAiProviders(ctx context.Context) ([]ListOfferedAiProvidersRow, error)

The models the installation offers, never with the key. Read by the operator and, through the read policy, by a workspace choosing one - which is answered only name, processor and jurisdiction of it by the application.

func (*Queries) ListPasskeys 

func (q *Queries) ListPasskeys(ctx context.Context, accountID pgtype.UUID) ([]WebauthnCredential, error)

Passkeys and security keys (identity.md §23). Row security keeps every statement in the transaction's workspace; the account is named because a person reads and writes only their own.

func (*Queries) ListPausedAutomationRules 

func (q *Queries) ListPausedAutomationRules(ctx context.Context) ([]ListPausedAutomationRulesRow, error)

The rules a workspace's deletion request switched off (multi-tenancy.md §5), which a cancel switches back on. This tenant's rules the deletion request switched off, oldest first. Unbounded on purpose: a workspace's rules are a handful, and a cancel that came back for a second page could return a workspace half restored.

func (*Queries) ListPendingRemindersOfItem 

func (q *Queries) ListPendingRemindersOfItem(ctx context.Context, itemID pgtype.UUID) ([]ListPendingRemindersOfItemRow, error)

What a moved due date has to recompute: the entry's reminders that are still waiting. A reminder that has fired or was cancelled is not in it - neither is given a new future by a date changing - and which of the remaining ones actually move is the domain's question, because only it can read an offset spec.

func (*Queries) ListPlans 

func (q *Queries) ListPlans(ctx context.Context) ([]ListPlansRow, error)

The plans not removed, oldest first (multi-tenancy.md §4.2). No tenant predicate: the table carries no policy, and the transaction reading it has no tenant at all.

func (*Queries) ListPlatformSubscriptions 

func (q *Queries) ListPlatformSubscriptions(ctx context.Context) ([]ListPlatformSubscriptionsRow, error)

func (*Queries) ListPrivateHubAccesses 

func (q *Queries) ListPrivateHubAccesses(ctx context.Context, arg ListPrivateHubAccessesParams) ([]PrivateHubAccess, error)

Every emergency access to one hub, newest first: the members' record of who opened it and why.

func (*Queries) ListPrivateHubs 

func (q *Queries) ListPrivateHubs(ctx context.Context) ([]ListPrivateHubsRow, error)

The workspace's private hubs as an administrator may see them (ADR-0073 §3): whose - the accounts holding OWNER on the hub itself - and how much, never a name. Trashed ones included, with their stamp, because "a person left and the hub is going" is what the list is for.

func (*Queries) ListRemindersOfItem 

func (q *Queries) ListRemindersOfItem(ctx context.Context, itemID pgtype.UUID) ([]ListRemindersOfItemRow, error)

One entry's reminders, oldest first, and all of them: the number a single entry may carry is bounded where reminders are written, which is what makes this list answerable in one page rather than through a cursor. The order is (created_at, id) for the reason every list in this schema takes the pair: two rows written in the same millisecond are one timestamp. Served by reminder_item_idx, whose columns are this ORDER BY.

func (*Queries) ListRetentionRules 

func (q *Queries) ListRetentionRules(ctx context.Context) ([]RetentionRule, error)

Every rule the tenant has, narrowest scope first so that a reader walking the list meets the winner before the ones it beats.

The tenant is selected rather than left to row level security to imply, because the aggregate carries it: a correction rebuilds the rule from the row that was read, and `NewRule` refuses one whose tenant is zero.

func (*Queries) ListRuleRuns 

func (q *Queries) ListRuleRuns(ctx context.Context, arg ListRuleRunsParams) ([]ListRuleRunsRow, error)

Newest first by identifier: UUIDv7 is time-ordered, so the primary key is the order runs happened in. The five filters are nullable arguments rather than thirty-two statements, because a second statement differing in one predicate is a second place for a predicate to be forgotten. The window is on started_at - the run's own moment rather than the event's - half-open, as the audit trail's is.

func (*Queries) ListSavedViewsOwned 

func (q *Queries) ListSavedViewsOwned(ctx context.Context, ownerID pgtype.UUID) ([]SavedView, error)

The caller's own views, whatever their scope and sharing. Ordered by creation and then by identifier, so the answer is stable without an updated_at this table deliberately does not carry.

func (*Queries) ListSavedViewsReachable 

func (q *Queries) ListSavedViewsReachable(ctx context.Context, arg ListSavedViewsReachableParams) ([]SavedView, error)

The caller's own views plus what is shared along one container's path: the caller passes the scope identifiers that path names - the collection, its hub - and TENANT-scoped shares match by scope type alone, having no identifier to match. The authorisation happened before this runs (one question about the container, ADR-0005); the array is its answer bound into the statement, never a filter after the page.

func (*Queries) ListSchedulesForTarget 

func (q *Queries) ListSchedulesForTarget(ctx context.Context, targetID pgtype.UUID) ([]BackupSchedule, error)

The schedules the refusal names, so that an operator is told what to switch off rather than being told no.

func (*Queries) ListSetElements 

func (q *Queries) ListSetElements(ctx context.Context, arg ListSetElementsParams) ([]ListSetElementsRow, error)

Every tag of one set on one item: what a merge compares a client's tags against (offline-sync.md §4.2).

func (*Queries) ListStructureHeirs 

func (q *Queries) ListStructureHeirs(ctx context.Context, arg ListStructureHeirsParams) ([]ListStructureHeirsRow, error)

The live containers that inherit a layer: a hub's collections, or with no hub every hub and collection of the workspace. Bounded by the caller's ceiling, which it reads one past to know the fan-out is too large to write row by row. The column list is FindContainer's, so the rows map through the same reader.

func (*Queries) ListStructurePresetsOffered 

func (q *Queries) ListStructurePresetsOffered(ctx context.Context, ownerID pgtype.UUID) ([]ListStructurePresetsOfferedRow, error)

The workspace's presets and one person's own, by name; `id` closes the order.

func (*Queries) ListSuggestions 

func (q *Queries) ListSuggestions(ctx context.Context, arg ListSuggestionsParams) ([]ListSuggestionsRow, error)

Keyset over (created_at, id) descending, the ordering every list in this schema uses: a page boundary that repeats a row or skips one is what an offset does when a suggestion is recorded while somebody is reading.

func (*Queries) ListSystemCapabilityProfiles 

func (q *Queries) ListSystemCapabilityProfiles(ctx context.Context) ([]ListSystemCapabilityProfilesRow, error)

The system defaults alone, whatever the caller's tenant has overridden.

They bound what a narrowing may do, and one question can only be answered from them: which types sit directly under a collection. Read off a narrowed set, a tenant that removed a task's children would promote the work package to a top level it was never allowed to sit at (domain-model.md §2).

func (*Queries) ListTemplatesInScopes 

func (q *Queries) ListTemplatesInScopes(ctx context.Context, arg ListTemplatesInScopesParams) ([]ListTemplatesInScopesRow, error)

The templates a person picking one in a container can choose from: the ones defined on that container's path, plus the workspace-wide ones. The caller passes the identifiers the path names (the collection, its hub) and TENANT-scoped rows match by scope type alone, having no identifier to match - the shape the saved views' reachable list already has.

Newest first: a template somebody has just written is the one they are looking for. The keyset is (created_at, id) for the reason every list in this schema takes the pair.

func (*Queries) ListTenantHosts 

func (q *Queries) ListTenantHosts(ctx context.Context) ([]ListTenantHostsRow, error)

The hosts of this workspace, canonical first - what a reader needs to know which one a mail will name. Nothing resolves a request through this yet (migration 0104).

func (*Queries) ListTenantStorageKeys 

func (q *Queries) ListTenantStorageKeys(ctx context.Context, arg ListTenantStorageKeysParams) ([]string, error)

The purge walks the object store with this page: bytes are deleted store-first, rows after, ReconcileMedia's order - an orphaned byte object is reclaimable, an orphaned row lies.

func (*Queries) ListTextLanguages 

func (q *Queries) ListTextLanguages(ctx context.Context) ([]string, error)

The languages this installation can index, as BCP 47 tags (ADR-0034).

Read from the database rather than listed in Go, because it is the database that decides: the mapping lives in `hubtask_text_languages()`, which joins the tags this product knows against the text search configurations this PostgreSQL was actually built with. A constant in the application would answer for an installation that has one configuration fewer, and a client's language picker would then offer a language that is silently indexed word by word.

func (*Queries) ListTrash 

func (q *Queries) ListTrash(ctx context.Context, arg ListTrashParams) ([]ListTrashRow, error)

What is in the trash, newest deletion first.

One row per deletion rather than one per deleted row: a hub with two hundred entries under it went into the trash as one act and comes back as one act, so listing its subtree would be two hundred lines describing one decision. The row this returns is the batch's root - the thing a person deleted - and the batch identifier beside it is what restores the rest.

The root is found by asking each row whether its parent is in the same batch. It is not, exactly when the row is where the deletion started: a collection whose hub was deleted with it carries the hub's batch, an item whose collection or parent item was deleted with it carries theirs, and both are therefore dropped. `IS DISTINCT FROM` rather than `<>`, so that a row whose parent is not in the trash at all - a NULL on the joined side - counts as a root rather than as unknown.

`hub_id` is the level the permission question is asked at. A membership held at a hub applies downwards (domain-model.md §3.2), so an entry that named only its collection could not be shown to somebody whose right sits on the hub above it - and the trash is the one view that spans hubs, so there is no path parameter to read it from. For a hub it is null: the hub is its own level.

Both branches read through the partial trash indices, and the joins are primary key lookups.

The keyset is (deleted_at, id) descending, which is the order the page is in. A UNION of two tables cannot be walked by an index alone, so the sort is real - bounded by the size of the trash, which is bounded in turn by the retention period that empties it.

func (*Queries) ListVoiceAliases 

func (q *Queries) ListVoiceAliases(ctx context.Context) ([]ListVoiceAliasesRow, error)

func (*Queries) ListWebhookSubscriptions 

func (q *Queries) ListWebhookSubscriptions(ctx context.Context) ([]ListWebhookSubscriptionsRow, error)

Newest first by identifier: UUIDv7 is time-ordered, so the primary key is the creation order. Not paged - a workspace has a handful of integrations, and a cursor over a handful is machinery nobody reads.

func (*Queries) ListWorkItems 

func (q *Queries) ListWorkItems(ctx context.Context, arg ListWorkItemsParams) ([]ListWorkItemsRow, error)

One level of one collection, in its manual order: the items directly in the collection when no parent is named, that item's children when one is. Anchored to a collection because an unanchored list of every item in a tenant is an unindexed scan, and every filter beyond one level is what POST /items:query exists for.

The collection is compared as well as the parent, even when the parent decides the level on its own: it is the leading column of wi_level_order_idx, and a query that dropped it would fall back to wi_parent_idx and scan the whole tenant's tasks for the parent-IS-NULL case.

Everything else - the keyset, the collation, the row read beyond the page - is as ListContainers, and for the same reasons.

func (*Queries) LockAccountForAddress 

func (q *Queries) LockAccountForAddress(ctx context.Context, accountID pgtype.UUID) (LockAccountForAddressRow, error)

A managed account takes an address (ADR-0074 §6): the address waits on an ADDRESS row of auth_pending until somebody holding the mailbox follows the link; only then is it the account's. The account's row, locked for the request's transaction: two requests for one account are serialised, so the ten-minute floor between two mails is read and kept by one of them at a time.

func (*Queries) LockAccountForPasskeys 

func (q *Queries) LockAccountForPasskeys(ctx context.Context, accountID pgtype.UUID) (pgtype.UUID, error)

The row lock the limit's count and insert run under.

func (*Queries) LockAccountStatus 

func (q *Queries) LockAccountStatus(ctx context.Context, id pgtype.UUID) (LockAccountStatusRow, error)

The status a restriction starts from, with the row locked until the transaction ends: an erasure or an accepted invitation that changed it between the decision and the write would otherwise be written over (data-protection.md §4). Redeeming or accepting an invitation clears its token, so a token still there is an invitation nobody accepted.

func (*Queries) LockAuditChain 

func (q *Queries) LockAuditChain(ctx context.Context) error

The audit trail. The application role may only INSERT and SELECT here (db/schema.sql, grants), so there is deliberately no UPDATE and no DELETE in this file - the retention job drops whole partitions instead (audit.md §3). Serialises the chain per tenant for the rest of the transaction.

The sequence number has to be gapless and the previous hash has to be the one that is actually committed before this entry, so two transactions writing for the same tenant cannot both read the same tail. The lock is transaction-scoped: it is released by the commit or the rollback, never left behind by a process that died. Per tenant rather than global, so one busy workspace does not serialise the whole installation.

func (*Queries) LockAutoAssignPolicy 

func (q *Queries) LockAutoAssignPolicy(ctx context.Context, arg LockAutoAssignPolicyParams) (AutoAssignPolicy, error)

The same row, held for the rest of the transaction. ROUND_ROBIN reads its cursor through this rather than through FindAutoAssignPolicy: two creates arriving together must queue on the row, because a cursor read hopefully is a turn handed to both of them.

func (*Queries) LockContainerShared 

func (q *Queries) LockContainerShared(ctx context.Context, id pgtype.UUID) (pgtype.UUID, error)

Holds a hub's row while a collection's structure is resolved from it, so that the hub's own write - which updates this row - waits for that collection's, and the next reads it.

func (*Queries) LockContainers 

func (q *Queries) LockContainers(ctx context.Context, ids []pgtype.UUID) error

Takes the named containers' rows for the rest of the transaction. A grant on a hub or below it takes the same row (LockHubOf), so "no member is left", asked again after this, sees a grant that committed meanwhile.

func (*Queries) LockDataSubjectRequest 

func (q *Queries) LockDataSubjectRequest(ctx context.Context, id pgtype.UUID) (pgtype.UUID, error)

What an attached medium keeps is the file and the identifier of whoever uploaded it. After a full deletion that identifier points at nobody, which is the position `audit_log.actor_id` is in as well - and `audit_pseudonym` is what answers "who was this" for both. Rewriting the column would be a second mechanism for one question. ===================== What a legal hold keeps (data-protection.md §4.1) ===== Taken first by the erasure and by the remainder, so one case has one writer at a time: a retried erasure and a remainder seeded by a release in between would otherwise both decide what is kept.

func (*Queries) LockGroup 

func (q *Queries) LockGroup(ctx context.Context, id pgtype.UUID) (pgtype.UUID, error)

The group's row, held for the transaction: a member change, a deletion and a grant to the group take it first, so the roles a member change was judged against are the roles it places.

func (*Queries) LockHubMilestone 

func (q *Queries) LockHubMilestone(ctx context.Context, hubID pgtype.UUID) error

A collection's and a hub's milestone: the last moment they were left with nothing open (UC-WRK-29 check 4, domain-model.md §2).

"Nothing open" counts every entry that is neither archived nor trashed, at any level and whether the collection's structure hides its level or not - the roll-up counts a hidden child's completion too (I-W5), and hidden is not inactive. Taken by a completion before it asks whether nothing is open, for the rest of its transaction. Two completions finishing a hub's last two entries at once would each see the other's entry still open and record nothing; under this lock the second asks after the first committed, and sees it. Per hub, so completions in different hubs never wait for each other.

func (*Queries) LockHubOf 

func (q *Queries) LockHubOf(ctx context.Context, id pgtype.UUID) (LockHubOfRow, error)

The hub a container or an entry sits under, locked for the transaction: granting a group a role under a private hub and making a hub private both take this row first, so the second waits for the first and sees what it wrote (ADR-0073 §1).

func (*Queries) LockOwners 

func (q *Queries) LockOwners(ctx context.Context) error

Taken by every door that could end the workspace's last owner, inside its write transaction and before it counts the owners again: two owners revoking each other at once would otherwise each see the other still there. Transaction-scoped, per tenant, like the audit chain's (Audit.sql).

func (*Queries) LockPlatformEventNumbering 

func (q *Queries) LockPlatformEventNumbering(ctx context.Context) error

The installation's events (UC-INS-14, multi-tenancy.md §4.3; migration 0180).

Written beside a workspace's change, in that workspace's transaction, and read by the control plane under the installation's scope: the table carries no policy, as the journal does not. The order is the number's, drawn under the lock below, so a reader asking for numbers after the last one it saw never skips a row that commits late. Held until the transaction ends. Taken just before the insert rather than at the transaction's start, so that only the tail of a change - from its event to its commit - waits for another. A fixed key beside the scheduler's 8_010_001 rather than a hashed name, which would share its space with the per-workspace hashed keys.

func (*Queries) LockTenantPeople 

func (q *Queries) LockTenantPeople(ctx context.Context) error

Taken by the people limit's guard, inside the transaction that creates a person and before it counts: two creations at the last place would otherwise each see room. Transaction-scoped, per tenant, like the owners' lock (Identity.sql); taken before the audit chain's, never after it.

func (*Queries) MailReceiptExists 

func (q *Queries) MailReceiptExists(ctx context.Context, messageID string) (bool, error)

func (*Queries) MailWorkspaceNameTaken 

func (q *Queries) MailWorkspaceNameTaken(ctx context.Context, name string) (bool, error)

func (*Queries) MarkEventsDispatched 

func (q *Queries) MarkEventsDispatched(ctx context.Context, arg MarkEventsDispatchedParams) error

Recorded in the same transaction as the delivery itself. A mark that committed without its delivery would lose the event silently, which is the one failure an outbox exists to rule out.

func (*Queries) MarkItemsForRetention 

func (q *Queries) MarkItemsForRetention(ctx context.Context, arg MarkItemsForRetentionParams) (int64, error)

Phase one: what is coming, when, and under which rule (§5, §6).

The block is cleared with the marking: an entry that was held back and is now announced is an entry whose obstacle has gone, and a stale reason on it would tell somebody a hold is in force that was lifted last week.

func (*Queries) MarkMediaOrphans 

func (q *Queries) MarkMediaOrphans(ctx context.Context, arg MarkMediaOrphansParams) (int64, error)

The second pass: what nothing references is marked, not yet removed. Both kinds wait, and they wait on different clocks. A READY object is garbage once nothing has pointed at it for the unreferenced grace - never merely because a pass caught it between its confirmation and the first thing that uses it, which is a window every upload passes through and every detach opens again. A PENDING row is a staging nobody confirmed, and its clock runs from the staging.

Marking is not a reversible step, which is why the grace sits here rather than after it: a marked object is refused by every read path, so nothing can attach it, so nothing can ever recount it back to life.

func (*Queries) MarkPasskeyUsed 

func (q *Queries) MarkPasskeyUsed(ctx context.Context, arg MarkPasskeyUsedParams) (int64, error)

The counter only goes up: a counter not above a non-zero stored one is refused here, in the statement, so two sign-ins with one credential cannot both pass a comparison; a synchronised passkey's zero passes and never lowers the stored value (identity.md §23.3).

func (*Queries) MarkPlatformSubscriptionFromFile 

func (q *Queries) MarkPlatformSubscriptionFromFile(ctx context.Context, id pgtype.UUID) error

func (*Queries) MarkQuotaReached 

func (q *Queries) MarkQuotaReached(ctx context.Context, arg MarkQuotaReachedParams) (int64, error)

func (*Queries) MarkTenantPurgeStarted 

func (q *Queries) MarkTenantPurgeStarted(ctx context.Context, now pgtype.Timestamptz) (int64, error)

The grace job's mark, before the first byte goes. The first mark stands on a second pass, which is the same purge going on. The version is left alone: nobody read the row to configure it. No row is a workspace no longer pending - a cancel came first - or one whose deadline lies ahead.

func (*Queries) MediaServesAvatar 

func (q *Queries) MediaServesAvatar(ctx context.Context, mediaID pgtype.UUID) (bool, error)

Whether somebody shows the object as their picture, for GetMedia's authorisation: a picture is read by every member, as the name beside it is.

func (*Queries) MediaUploadedBy 

func (q *Queries) MediaUploadedBy(ctx context.Context, createdBy pgtype.UUID) ([]MediaUploadedByRow, error)

The media the person uploaded that nothing points at any more.

Only the unattached ones. A file attached to an entry, or shown as its cover, is the workspace's content - somebody else's work refers to it - and removing it would erase a third party's material along with the person's, which is exactly what the two erasure modes exist to keep apart. A cover also holds its object by a restricting foreign key: handed to the discard, its bytes went and its row could not.

func (*Queries) MembershipsAlongPath 

func (q *Queries) MembershipsAlongPath(ctx context.Context, arg MembershipsAlongPathParams) ([]MembershipsAlongPathRow, error)

What the account holds that could apply to this path, directly or through one of its groups.

Bounded by the path rather than reading everything the account holds: a permission check runs on every write, and an account in a large tenant may hold hundreds of memberships. It may be generous - a tenant-wide membership always applies, and the resolution ignores whatever is not on the path - but it must not be unbounded.

Whether the right is held directly or through a group is not distinguished in the result. The question is what the account may do, and a right held through a group is not a lesser right.

func (*Queries) MembershipsOfGroup 

func (q *Queries) MembershipsOfGroup(ctx context.Context, groupID pgtype.UUID) ([]MembershipsOfGroupRow, error)

Every grant a group holds, for the revocation that has to know what its members are about to lose. Unpaged: a group holds a handful of roles, and the caller reads them before the group's rows are gone. The tenant boundary is the transaction's (ADR-0010).

func (*Queries) MilestonesOf 

func (q *Queries) MilestonesOf(ctx context.Context, containerIds []pgtype.UUID) ([]MilestonesOfRow, error)

The milestones of one page of containers.

func (*Queries) MintAddressToken 

func (q *Queries) MintAddressToken(ctx context.Context, arg MintAddressTokenParams) (MintAddressTokenRow, error)

The mail's token, for a request that is neither spent nor expired. A retried delivery mints again, and only the newest mail's link works - the reset link's rule.

func (*Queries) MoveItemsBetweenBuckets 

func (q *Queries) MoveItemsBetweenBuckets(ctx context.Context, arg MoveItemsBetweenBucketsParams) (int64, error)

Every item in one bucket into another, or out of any bucket when the target is NULL. What DeleteBucket owes its items: the alternative is the foreign key's ON DELETE SET NULL, which would take a person's board apart silently.

Trashed items are moved too. Their bucket is part of the state a restore brings back, and leaving them pointing at a deleted column would restore them onto a board that no longer has it.

func (*Queries) MoveWorkItemSubtree 

func (q *Queries) MoveWorkItemSubtree(ctx context.Context, arg MoveWorkItemSubtreeParams) (int64, error)

Rewrites the materialised path, the depth and the collection of an item and everything below it, in one statement (I-W2: the path and the depth stay consistent, and changes go through a move that updates the subtree within one transaction).

The prefix swap is what makes this one statement rather than a walk: every descendant's new path is its old path with the old prefix replaced, and `substring(path from length(prefix) + 1)` is that suffix. The depth moves by a constant, because every row in a subtree shifts by the same number of levels.

`LIKE prefix || '%'` rather than starts_with, because that is the form wi_path_idx (tenant_id, path text_pattern_ops) serves as an index scan. A path is built from UUIDs and separators, so it can contain no LIKE metacharacter - there is nothing here for a `%` or a `_` in the data to do.

Trashed rows in the subtree are rewritten too, deliberately. Their path still has to describe where they would be restored to; leaving them behind would point a restore at an ancestor that has moved.

The version moves on every row, because a descendant's path is part of its state and a client caching the subtree has to be able to tell that it changed.

The moved item itself is excluded. Its own path begins with its own prefix, so it would match - and it is SetWorkItemPlacement that owns its row, which is where the optimistic lock is. Without the exclusion the moved item would have its version bumped twice by one move, which is not a design but an artefact of writing it in two statements.

func (*Queries) NarrowSuggestion 

func (q *Queries) NarrowSuggestion(ctx context.Context, arg NarrowSuggestionParams) (int64, error)

What is left of a proposal once part of it was taken, guarded like a decision: two people taking from one proposal at once is the same conflict as two answering it. Only an open proposal narrows.

func (*Queries) NaturalOrderingAvailable 

func (q *Queries) NaturalOrderingAvailable(ctx context.Context) (bool, error)

Whether names sort under the ICU root collation here (i18n-l10n.md §5).

Migration 0080 defines `hubtask_name` from `und-x-icu` where this PostgreSQL was built with ICU and from the database's own libc locale where it was not; the queries say `COLLATE hubtask_name` either way. The provider of the object is what says which of the two an installation got - and a client that sorts a list itself with Intl.Collator can read here whether the server already sorted it the same way.

func (*Queries) NextBackupScheduleDue 

func (q *Queries) NextBackupScheduleDue(ctx context.Context) (pgtype.Timestamptz, error)

The earliest moment this tenant owes a backup, which is what a poller reschedules itself to.

func (*Queries) NextDueAnnouncement 

func (q *Queries) NextDueAnnouncement(ctx context.Context, leadSeconds float64) (pgtype.Timestamptz, error)

When this tenant next owes an announcement: the lead before a deadline that has not been announced as approaching, or the deadline itself where only the overdue announcement is left. NULL when it owes none, which is half of what lets the firing job finish.

func (*Queries) NextDueAutomationRule 

func (q *Queries) NextDueAutomationRule(ctx context.Context) (pgtype.Timestamptz, error)

The earliest moment this tenant owes anything, and NULL when it owes nothing - which is what lets the poller finish instead of spinning. `max`/`min` over the partial index rather than a LIMIT 1 with an ORDER BY, so an empty result is a row with NULL rather than no row at all.

func (*Queries) NextDueRuleOccurrence 

func (q *Queries) NextDueRuleOccurrence(ctx context.Context) (pgtype.Timestamptz, error)

The earliest moment this tenant owes an occurrence, and NULL when it owes none.

func (*Queries) NextReminderMoment 

func (q *Queries) NextReminderMoment(ctx context.Context) (pgtype.Timestamptz, error)

When this tenant next owes something. NULL when it owes nothing, which is what lets the job finish rather than idle forever - the next write re-seeds it.

func (*Queries) OidcFlowLive 

func (q *Queries) OidcFlowLive(ctx context.Context, arg OidcFlowLiveParams) (bool, error)

Whether a flow of any kind - a sign-in, a step-up, a connection - is still live for this state: unexpired and unspent. Read, never burned: a provider's return asks where it belongs before it is finished, and is spent where it is finished (multi-tenancy.md §3).

func (*Queries) OpenTenantPassword 

func (q *Queries) OpenTenantPassword(ctx context.Context, arg OpenTenantPasswordParams) (int64, error)

An operator opens the password for this one workspace (ADR-0078 §3). A second opening replaces the first - the operator's latest word on how long, who asked and why. Only an active workspace opens: a suspended one refuses its people before any password is asked for, and a leaving one is shut out for good. The version is left alone: the opening is not the workspace's configuration, and an administrator's form open on it must not meet a conflict for something it never showed.

func (*Queries) OperatorRegisterState 

func (q *Queries) OperatorRegisterState(ctx context.Context) (OperatorRegisterStateRow, error)

Workspaces and operators, counted as `is_operator` counts, for the health report's warning about an installation with several workspaces and nobody registered to run it (migration 0128).

func (*Queries) OperatorRoster 

func (q *Queries) OperatorRoster(ctx context.Context, caller pgtype.UUID) ([]OperatorRosterRow, error)

The register with names, for the control plane's own screen (migration 0135): the account's name, address or sign-in name and kind, its workspace, and who added it. No row unless the caller is an operator, and never an account the register does not hold. The casts are for the generator: it cannot see into the function's OUT table; empty rather than NULL for the text columns that may be absent (`AdminTenants`' own note).

func (*Queries) OrderKeyNeighbours 

func (q *Queries) OrderKeyNeighbours(ctx context.Context, arg OrderKeyNeighboursParams) (OrderKeyNeighboursRow, error)

The two ranks a new position sits between: the rank of the item to go before, and the greatest rank below it in the same level.

Both come back as the empty string when there is nothing there, which is what the ordering service reads as "no bound" - before everything, or after everything. Asking the database for both in one row rather than computing one from a list keeps the answer consistent with what is stored at the moment it is asked.

COLLATE "C" on the comparison and nowhere else it could disagree: a rank key is a fractional index whose scheme rests on byte order, and a database created en_US.utf8 on glibc would order it differently from the domain that produced it.

The level is (collection, parent), and the parent is compared with IS NOT DISTINCT FROM so that an absent one means the items directly in the collection rather than no filter at all.

"Exclude nothing" has to be expressible, because a create has no row to leave out: the parameter is nullable and the comparison is IS DISTINCT FROM. With `<>` a NULL there is a predicate that is NULL for every row, which empties this list and reports an anchor that is present as missing.

func (*Queries) OrphanedPrivateHubs 

func (q *Queries) OrphanedPrivateHubs(ctx context.Context, named []pgtype.UUID) ([]pgtype.UUID, error)

The private hubs, not in the trash, that no member is left in (ADR-0073 §5): no account that is neither anonymised nor deleted holds a role on the hub, on a collection in it, or on an entry in one. Groups are not asked - none may hold a role there (identity.md §22). `named` narrows it to the hubs the named hubs, collections or entries sit under; null asks about every private hub, which is the retention pass's catch-all.

func (*Queries) OverdueRequestCount 

func (q *Queries) OverdueRequestCount(ctx context.Context, now pgtype.Timestamptz) (OverdueRequestCountRow, error)

How many open cases are past their deadline, and how soon the next one falls due.

The reading behind alert A-19 (data-protection.md §4): "without deadline monitoring, the right gets violated in practice even though the feature exists". Two numbers rather than a list, because a gauge is what an alert evaluates and the list is a page somebody reads.

func (*Queries) PageInstanceJournal 

func (q *Queries) PageInstanceJournal(ctx context.Context, arg PageInstanceJournalParams) ([]InstanceEvent, error)

The journal as the dashboard reads it: newest first, one page at a time, keyed on the moment and the identifier together - the same keyset every other listing here walks, because two entries can share a moment and an offset would then skip or repeat one.

One row more than asked for, so the caller knows whether there is another page without counting the table. Narrowed by an action prefix - `starts_with`, not `LIKE`, so a `%` or `_` in it is a character rather than a pattern - and by the workspace's slug as the journal kept it.

func (*Queries) PendingErasureKept 

func (q *Queries) PendingErasureKept(ctx context.Context, holdID pgtype.UUID) ([]PendingErasureKeptRow, error)

The cases something is still kept for, and under which hold - all of them, or one hold's.

func (*Queries) PlanOfWorkspace 

func (q *Queries) PlanOfWorkspace(ctx context.Context) (PlanOfWorkspaceRow, error)

The transaction's own workspace's plan, read in that workspace's scope: `tenant_self` admits its own row, and `plan` carries no policy (multi-tenancy.md §4.2).

func (*Queries) PlanSettings 

func (q *Queries) PlanSettings(ctx context.Context, planIds []pgtype.UUID) ([]PlanSetting, error)

What the given plans decide, in the installation level's key shape.

func (*Queries) PlanWorkspaceCounts 

func (q *Queries) PlanWorkspaceCounts(ctx context.Context) ([]PlanWorkspaceCountsRow, error)

How many workspaces are on each plan, through the control plane's own enumerator: `tenant` is behind tenant_self, and admin_tenants() is the one listing across it (multi-tenancy.md §2.1).

func (*Queries) PlatformDeliveries 

func (q *Queries) PlatformDeliveries(ctx context.Context, arg PlatformDeliveriesParams) ([]PlatformDelivery, error)

func (*Queries) PlatformEventsAfter 

func (q *Queries) PlatformEventsAfter(ctx context.Context, arg PlatformEventsAfterParams) ([]PlatformEventsAfterRow, error)

func (*Queries) PollOutboxEvents 

func (q *Queries) PollOutboxEvents(ctx context.Context, arg PollOutboxEventsParams) ([]PollOutboxEventsRow, error)

The pull half of the stream (automation.md §3.2): one type, oldest first, from a position.

Three predicates and each is a boundary the endpoint has to draw.

`replay = false` is the same rule the push half keeps: a restore's events go to nobody outward-facing, or a restore would report last month's states to every trigger (migration 0033).

`occurred_at <= horizon` is what makes the cursor gapless. The order is `(occurred_at, id)`, and `occurred_at` comes from the writing transaction rather than from its commit - so a transaction that began before one already answered can still commit a row that sorts *behind* the cursor, and a poller would step over it and never know. The horizon is a moment far enough back that no such transaction can still be open; rows newer than it are withheld from the page and from the cursor together, and are answered by the next poll. Withholding an event for a few seconds is a delay, and stepping over it is a loss.

The keyset itself is the row comparison rather than `occurred_at > $1 OR (= AND id > $2)`: one comparison the index can seek on, where the disjunction is two it cannot.

The two sides of the keyset are cast, because a row comparison gives sqlc nothing to infer a parameter's type from: without them `after_id` is generated as a timestamp, and the mistake is one the compiler would not catch until it was a uuid being written into a timestamptz.

No `dispatched_at` predicate. A poll answers what has been delivered as readily as what has not: the pull half is a second transport, not a second delivery.

func (*Queries) PrivateHubMembers 

func (q *Queries) PrivateHubMembers(ctx context.Context, hubID pgtype.UUID) ([]pgtype.UUID, error)

The members of a private hub as ADR-0073 §5 counts them: accounts, neither anonymised nor deleted, holding a role on the hub, on a collection in it, or on an entry in one. Groups are not asked - none may hold a role there (identity.md §22).

func (*Queries) PrivateHubsHeldBy 

func (q *Queries) PrivateHubsHeldBy(ctx context.Context, accountID pgtype.UUID) ([]pgtype.UUID, error)

The private hubs, not in the trash, the account holds a role on, on a collection in, or on an entry in: what an erasure asks before the account's memberships go with it.

func (*Queries) ProviderIdentityHolders 

func (q *Queries) ProviderIdentityHolders(ctx context.Context, providerID pgtype.UUID) ([]pgtype.UUID, error)

The accounts of this workspace that hold an identity at one provider, read before the provider is removed: each is told that the connection went (ADR-0078 §6). The workspace is named, not left to the policy alone, so the read is this workspace's whatever scope runs it.

func (*Queries) PurgeContainers 

func (q *Queries) PurgeContainers(ctx context.Context, ids []pgtype.UUID) (int64, error)

The hard delete for hubs and collections.

Called for the collections before the hubs that hold them: `container.parent_id` is ON DELETE RESTRICT, so a hub whose collections are still there refuses to go - which is the database insisting on the order rather than a rule this code could forget.

func (*Queries) PurgeFieldClocks 

func (q *Queries) PurgeFieldClocks(ctx context.Context, ids []pgtype.UUID) error

The merge's bookkeeping goes with the entity it is about: a purged entry's clocks would otherwise decide a merge over an identifier that a tombstone refuses anyway.

func (*Queries) PurgeFinishedJobs 

func (q *Queries) PurgeFinishedJobs(ctx context.Context, arg PurgeFinishedJobsParams) ([]string, error)

The catalogue's period for a finished job: seven days after it ended (docs/privacy/data-catalog.md). Every terminal state alike, dead letters included - a payload names people by identifier, and a dead letter has had A-07 for the week. Oldest first and bounded, so a backlog clears over runs rather than in one statement; no tenant, because the table has none (multi-tenancy.md §2.1).

func (*Queries) PurgeTenantTrail 

func (q *Queries) PurgeTenantTrail(ctx context.Context) (int64, error)

The SECURITY DEFINER act migration 0067 reasons through, aimed by the transaction's own scope: even this narrow path can only take the trail of the tenant it was opened for.

func (*Queries) PurgeWorkItems 

func (q *Queries) PurgeWorkItems(ctx context.Context, ids []pgtype.UUID) (int64, error)

The hard delete, by identifier.

By identifier rather than by predicate, because the identifiers have already been read, written to the journal and given tombstones - deleting a different set here than the one that was recorded is exactly the orphan the completeness rule forbids (ADR-0020 §6).

func (*Queries) PutAiRequest 

func (q *Queries) PutAiRequest(ctx context.Context, arg PutAiRequestParams) error

The words a person asked a template to be drafted from.

Every statement runs inside the transaction wrapper that sets `app.tenant_id`; the policy underneath answers "which workspace", and `current_tenant_id()` is written on insert.

func (*Queries) PutInstanceSetting 

func (q *Queries) PutInstanceSetting(ctx context.Context, arg PutInstanceSettingParams) error

One switch, written or overwritten.

func (*Queries) PutPlanSetting 

func (q *Queries) PutPlanSetting(ctx context.Context, arg PutPlanSettingParams) error

func (*Queries) QueryTenants 

func (q *Queries) QueryTenants(ctx context.Context, arg QueryTenantsParams) ([]QueryTenantsRow, error)

The control plane's filtered, paged read, through the one narrow door that filters and pages across tenant_self (migration 0165). The casts are for the generator.

func (*Queries) QuotaReachedMarked 

func (q *Queries) QuotaReachedMarked(ctx context.Context, quota string) (bool, error)

Read before the admitted path removes anything: almost every create finds no mark, and a read is all it then costs.

func (*Queries) QuotaReachedMarkedAt 

func (q *Queries) QuotaReachedMarkedAt(ctx context.Context, arg QuotaReachedMarkedAtParams) (bool, error)

A limit reached, marked once per crossing (migration 0181). Every statement is bounded to the transaction's workspace by its policy and names it through current_tenant_id(). Read before marking: a refusal at a crossing already told writes nothing.

func (*Queries) ReadChangesAfter 

func (q *Queries) ReadChangesAfter(ctx context.Context, arg ReadChangesAfterParams) ([]ReadChangesAfterRow, error)

One batch of the change log, in cursor order. What the stream sends and what `:pull` will page.

`seq > $1` and nothing else: the cursor is a position in a monotonic sequence, so a walk needs no offset, no timestamp comparison and no second sort key. The identity is table-wide rather than per tenant, which makes the sequence sparse for any one of them - a gap between two of a tenant's rows is somebody else's row, never a row of theirs that is missing.

func (*Queries) ReadInstanceSettings 

func (q *Queries) ReadInstanceSettings(ctx context.Context) ([]InstanceSetting, error)

The installation's own level (ADR-0070 §2).

The whole set in one read, because it is small by construction - eighteen switches and four links - and because the resolver needs all of it to answer one password screen. No tenant predicate: the table deliberately carries no policy, and the transaction reading it has no tenant at all.

func (*Queries) RebuildStaleSearchDocuments 

func (q *Queries) RebuildStaleSearchDocuments(ctx context.Context, batch int32) (int64, error)

One batch: the document and the configuration rewritten for up to `batch` stale rows. Written directly rather than through the trigger - the trigger fires on a change to the three columns the document is built from, and nothing about those changes here - and with SKIP LOCKED so that a person editing one of the rows is not made to wait for the walk, nor the walk for them.

The batch is a MATERIALIZED CTE and not an `IN (subquery)`, and that is not style: under row level security the planner put the subquery on the inner side of a nested-loop semi join and re-ran it per outer row, and a re-run after the first update no longer saw that row as stale - so the LIMIT walked on and a batch of one rewrote two. Found by the integration test; the CTE is evaluated once, which is what a batch means.

func (*Queries) RecentMailReceipts 

func (q *Queries) RecentMailReceipts(ctx context.Context, maxRows int32) ([]RecentMailReceiptsRow, error)

func (*Queries) RecentPasswordHashes 

func (q *Queries) RecentPasswordHashes(ctx context.Context, arg RecentPasswordHashesParams) ([]string, error)

The newest few, newest first. The depth is the policy's, passed in.

func (*Queries) RecordActivity 

func (q *Queries) RecordActivity(ctx context.Context, arg RecordActivityParams) error

The item history: what happened to a piece of work, in the words the people working on it read (domain-model.md §3.5).

Append-only. There is deliberately no UPDATE and no DELETE in this file: an entry is not edited, and what removes one is the deletion of the item it belongs to, through the foreign key (0009_activity_history.sql). A statement that deleted one by hand would be a history somebody could tidy up, which is the opposite of what a history is for.

The tenant is never a parameter. It comes from the transaction's own context through current_tenant_id(), which is the value row level security compares against (ADR-0010). One step of one item's history, written inside the transaction that made the change.

`container_id` is the collection the item was in when this happened - the visibility anchor rather than a second subject. It is stored rather than joined at read time because the item may have moved since, and a history that re-derived it would show where the entry is now instead of where it was then.

The correlation and causation columns stay NULL. They belong to an act caused by another act, and everything recorded here is something a person asked for directly; filling them with a request identifier would be a chain that describes nothing (automation.md §2).

func (*Queries) RecordAiNotice 

func (q *Queries) RecordAiNotice(ctx context.Context, arg RecordAiNoticeParams) error

The acknowledgement moves only forwards: a late, retried request must not make an earlier notice pending again.

func (*Queries) RecordAuditAnchor 

func (q *Queries) RecordAuditAnchor(ctx context.Context, arg RecordAuditAnchorParams) error

One anchor: the chain end, where the copy went and the digest it was written with. The primary key refuses a second anchor of the same sequence number, which is how a day on which the chain did not move writes nothing rather than a duplicate.

func (*Queries) RecordAutomationRuleCheck 

func (q *Queries) RecordAutomationRuleCheck(ctx context.Context, arg RecordAutomationRuleCheckParams) error

What the check found (ADR-0060). Unguarded on the version: the findings are the check's assessment of the rule as it stood, not an edit of it, and a concurrent edit is re-checked by the next check rather than refused here.

func (*Queries) RecordBackupTargetTest 

func (q *Queries) RecordBackupTargetTest(ctx context.Context, arg RecordBackupTargetTestParams) (int64, error)

What the connection probe leaves behind. The error is a message code, never a driver message: an FTP or SSH library's message carries the host, the user and sometimes the password (rule 10).

func (*Queries) RecordBackupVerification 

func (q *Queries) RecordBackupVerification(ctx context.Context, arg RecordBackupVerificationParams) (int64, error)

What `:verify` found, without touching anything else on the row.

func (*Queries) RecordChange 

func (q *Queries) RecordChange(ctx context.Context, arg RecordChangeParams) error

The change log: state deltas for offline clients (offline-sync.md §10). Deliberately separate from the outbox - different recipients, different retention, different compatibility commitments. `seq` is assigned by the database (GENERATED ALWAYS AS IDENTITY), because the cursor a client pages on has to be gapless and monotonic per tenant. A value chosen in the application would leave holes wherever a transaction rolled back, and a client would then wait for a change that is never coming.

func (*Queries) RecordCollectionMilestone 

func (q *Queries) RecordCollectionMilestone(ctx context.Context, arg RecordCollectionMilestoneParams) (int64, error)

Records, or moves, the collection's milestone when none of its entries is open. Writes nothing while one is.

func (*Queries) RecordDeletions 

func (q *Queries) RecordDeletions(ctx context.Context, arg RecordDeletionsParams) error

The journal: what was removed, when, and why.

Its purpose is a restore from backup. An archive taken before the deletion still holds the row, and without this the next restore would quietly bring back everything a tenant had deleted since (backup-restore.md §6) - so the journal outlives both the row and the backup.

Written from an array rather than row by row, because a retention run removes in batches of a thousand and a statement per row would make the transaction as long as the batch. One entity per call, so the array is identifiers alone: a purge that spans both tables makes two calls, which is cheaper than carrying the table name a thousand times to say the same thing.

ON CONFLICT DO NOTHING, because the whole job is at-least-once: a run that died after writing these and is picked up again writes the same rows, and a failure there would make the retry impossible rather than harmless.

func (*Queries) RecordHubMilestone 

func (q *Queries) RecordHubMilestone(ctx context.Context, arg RecordHubMilestoneParams) (int64, error)

Records, or moves, the hub's milestone when no collection in it - neither archived nor trashed - holds an open entry. Writes nothing while one does.

func (*Queries) RecordImportProgress 

func (q *Queries) RecordImportProgress(ctx context.Context, arg RecordImportProgressParams) (int64, error)

How far the run has got, written in the transaction of the batch it got there with, so that a resumed attempt skips what an earlier one decided (the applier's BK-7 rule).

func (*Queries) RecordMfaStep 

func (q *Queries) RecordMfaStep(ctx context.Context, arg RecordMfaStepParams) (int64, error)

The replay refusal, atomically: only a step past the last accepted one writes, and zero rows means the same or an older code was presented again.

func (*Queries) RecordPlatformDeliveryAttempt 

func (q *Queries) RecordPlatformDeliveryAttempt(ctx context.Context, arg RecordPlatformDeliveryAttemptParams) (int64, error)

One attempt's outcome, written only while the delivery is still the one the attempt read: a repeat of a settled job writes nothing.

func (*Queries) RecordPlatformSubscriptionOutcome 

func (q *Queries) RecordPlatformSubscriptionOutcome(ctx context.Context, arg RecordPlatformSubscriptionOutcomeParams) error

What the last attempt came to, for the screen: the moment of the last arrival, or the last error.

func (*Queries) RecordRestoreProgress 

func (q *Queries) RecordRestoreProgress(ctx context.Context, arg RecordRestoreProgressParams) (int64, error)

How far the run has got, written in the transaction of the batch it got there with (BK-7).

The report travels with it because a resumed attempt continues counting rather than starting again: a report that only covered the last attempt would say a restore did a fraction of what it did.

func (*Queries) RecordRestoreSafetyCopy 

func (q *Queries) RecordRestoreSafetyCopy(ctx context.Context, arg RecordRestoreSafetyCopyParams) (int64, error)

The copy §8.3 step 4 takes before a destructive mode, recorded before the mode runs: the way back has to be findable from the run even if the run itself then fails.

func (*Queries) RecordRuleFailure 

func (q *Queries) RecordRuleFailure(ctx context.Context, arg RecordRuleFailureParams) (int64, error)

A pass set the rule aside: its condition could not be evaluated on a candidate. The code and the moment (data-retention.md §2). Written in a transaction of its own beside the pass, so that it outlives the pass's rollback; it touches the rule's row only, which the pass reads and never locks.

func (*Queries) RecordSetElementAdded 

func (q *Queries) RecordSetElementAdded(ctx context.Context, arg RecordSetElementAddedParams) error

The OR-set tag of an addition (offline-sync.md §4.2, §10).

The add tag is kept and the remove tag cleared, so that "added later than it was removed" is a comparison a merge can make rather than a history it has to reconstruct. Without these tags a label added on one device would be lost the moment another device removed a different one - which is exactly what last writer wins over a whole array does.

func (*Queries) RecordSetElementRemoved 

func (q *Queries) RecordSetElementRemoved(ctx context.Context, arg RecordSetElementRemovedParams) error

The OR-set tag of a removal. The add tag stays: a merge decides membership by comparing the two, and a removal that erased the addition would make a concurrent re-add on another device indistinguishable from never having happened.

func (*Queries) RecordStepUp 

func (q *Queries) RecordStepUp(ctx context.Context, arg RecordStepUpParams) (int64, error)

============================ The step-up ============================ The proof lands on the caller's own session, replacing whatever stood: a fresh proof is the newest answer to "is this still you", and two live proofs would be two coverings.

func (*Queries) RecordSuggestion 

func (q *Queries) RecordSuggestion(ctx context.Context, arg RecordSuggestionParams) error

What AI proposed, and did not do.

Every statement runs inside the transaction wrapper that sets `app.tenant_id`, so the policy underneath answers "which workspace" - `current_tenant_id()` is written on insert rather than passed in, the way every tenant-scoped insert in this schema is.

func (*Queries) RecordSyncOp 

func (q *Queries) RecordSyncOp(ctx context.Context, arg RecordSyncOpParams) error

Written in the transaction that applied the mutation. A conflict is a repeat that raced this one and is left standing: the first answer is the answer.

func (*Queries) RecordTermsAgreement 

func (q *Queries) RecordTermsAgreement(ctx context.Context, arg RecordTermsAgreementParams) (int64, error)

The latest agreement replaces the one before; the trail keeps each of them.

func (*Queries) RecordTombstones 

func (q *Queries) RecordTombstones(ctx context.Context, arg RecordTombstonesParams) error

The markers that stop a device recreating what it still knows (offline-sync.md §7).

Without one, the classic bug appears: a device offline for eight weeks pushes a change for a row the server has no record of, and the server accepts it. `purge_after` is when the marker itself may go - the removal plus the maximum offline window, by which time a device with a cursor that old has to resynchronise from scratch anyway.

One array per entity and ON CONFLICT DO NOTHING for the reasons the journal has them.

func (*Queries) RecordWebhookDeliveryOutcome 

func (q *Queries) RecordWebhookDeliveryOutcome(ctx context.Context, arg RecordWebhookDeliveryOutcomeParams) (int64, error)

What became of one attempt. The response status is the target's own; the error is a message code of ours, never the target's response body (rule 10).

func (*Queries) RecountMediaReferences 

func (q *Queries) RecountMediaReferences(ctx context.Context, now pgtype.Timestamptz) error

The reconciliation's first pass: the counter becomes what the references say, and a row that nothing points at learns since when. Whole-tenant, which is a scan by design - the job runs in the background on a bounded table, and a recount that tried to be incremental would be a second bookkeeping to get wrong.

The stamp is maintained here rather than beside every AdjustRefCount, because this is already the statement that rewrites the counter for every live row: six call sites moving a counter are six places to forget, and this one cannot drift from the count it sets in the same breath. COALESCE keeps the first zero rather than the latest one - a row unreferenced for a week must not have its grace restarted by every pass that walks past it - and a row that gained a reference has its stamp cleared, which is what makes the grace start again when it next loses one.

READY only, and that is not tidiness. A staging points at nothing by definition, and a stamp it collected while it was PENDING would be an hour old by the time somebody confirmed it late - which would hand the confirmation an object already past its grace. A PENDING row is bounded by its own clock, which runs from the staging; this one starts at the confirmation, where the object first becomes something anything can point at.

func (*Queries) RecoveredErasureCases 

func (q *Queries) RecoveredErasureCases(ctx context.Context, recoveryPoint pgtype.Timestamptz) ([]RecoveredErasureCasesRow, error)

The erasure cases of the transaction's workspace completed after the recovery point, as the temporary cluster recovered to the end of the WAL archive holds them (backup-restore.md §8.5 step 5). The workspace is named in the statement as well as by row level security, because the operator may connect with a role that bypasses the policy (RecoveredLegalHolds' reason).

A full deletion's case no longer names its subject once the account went. `erased_accounts` are the accounts the erasure removed: the journal's account row written with the same clock reading as the case's `dsr.erased` entry. The caller takes exactly one, and reports none or several rather than guess.

func (*Queries) RecoveredLegalHolds 

func (q *Queries) RecoveredLegalHolds(ctx context.Context) ([]RecoveredLegalHoldsRow, error)

Every hold of the transaction's workspace, released or not, as a second database holds them: the temporary cluster recovered to the end of the WAL archive, read to place the holds of a rewound period again (backup-restore.md §8.5 step 5).

The workspace is named here although row level security names it too, and unlike every other statement in this file: the operator connects to the temporary cluster with whatever role it has, and its superuser bypasses the policy. Without the predicate that connection would hand back every workspace's holds, and they would be placed in this one.

func (*Queries) RedeemInvitation 

func (q *Queries) RedeemInvitation(ctx context.Context, arg RedeemInvitationParams) (int64, error)

One statement for the whole act: the password lands, the account becomes ACTIVE, and the token dies - so a second redemption matches nothing however fresh the token looked a moment ago.

func (*Queries) RefuseJob 

func (q *Queries) RefuseJob(ctx context.Context, arg RefuseJobParams) (int64, error)

A refusal the job met - an AI budget spent since it was queued, AI switched off - ends it as FAILED rather than in the dead letter: it is an answer for whoever asked, not work waiting for an operator. The parameters are the refusal's own, codes and moments (rule 10).

func (*Queries) RehashPassword 

func (q *Queries) RehashPassword(ctx context.Context, arg RehashPasswordParams) (int64, error)

The same password under the build's current cost, after a sign-in proved it. Conditional on the hash the sign-in read, so a password changed (or already rehashed) in between is never overwritten. Only the hash and updated_at move: the password's age, its start-password mark, its history and the row's version are about the password, which did not change - but the incremental backup selects account rows by updated_at, and must carry the new hash.

func (*Queries) ReleaseIdempotencyKey 

func (q *Queries) ReleaseIdempotencyKey(ctx context.Context, arg ReleaseIdempotencyKeyParams) error

A reservation whose work failed, let go. Without this, a failed action's claim would survive the run that recorded the failure - and a replay of that run would find the key taken and "complete" the action without ever performing it.

func (*Queries) ReleaseIntakeOf 

func (q *Queries) ReleaseIntakeOf(ctx context.Context, accountID pgtype.UUID) (int64, error)

The same in the mode that keeps the workspace's content: the text stays and stops being anybody's - the address goes where it is the person's, the account where it is theirs, each on its own.

func (*Queries) ReleaseLegalHold 

func (q *Queries) ReleaseLegalHold(ctx context.Context, arg ReleaseLegalHoldParams) (int64, error)

The lifting, and the guard that makes it happen once.

`released_at IS NULL` in the predicate rather than a check the caller ran a moment earlier: two requests lifting the same hold would otherwise both succeed, and the second would overwrite who lifted it and when - the one pair of values the record exists to keep.

func (*Queries) RemoveDeletedTemplates 

func (q *Queries) RemoveDeletedTemplates(ctx context.Context, ids []pgtype.UUID) ([]pgtype.UUID, error)

The held templates no hold covers any more, removed. The identifiers come back so that the journal names exactly the rows that went. A living template is never matched.

func (*Queries) RemoveGroupMember 

func (q *Queries) RemoveGroupMember(ctx context.Context, arg RemoveGroupMemberParams) error

func (*Queries) RemoveItemLabel 

func (q *Queries) RemoveItemLabel(ctx context.Context, arg RemoveItemLabelParams) (int64, error)

func (*Queries) RemoveItemMember 

func (q *Queries) RemoveItemMember(ctx context.Context, arg RemoveItemMemberParams) (int64, error)

func (*Queries) RemoveMediaObjectRows 

func (q *Queries) RemoveMediaObjectRows(ctx context.Context, ids []pgtype.UUID) (int64, error)

The rows go with the journal entries in one transaction; the bytes follow through the purge job, which retries - at least once, idempotent at the store (core/port/storage).

func (*Queries) RemovePasskey 

func (q *Queries) RemovePasskey(ctx context.Context, arg RemovePasskeyParams) (int64, error)

Only the account's own; it signs and proves nothing from the moment this commits.

func (*Queries) RemovePlan 

func (q *Queries) RemovePlan(ctx context.Context, arg RemovePlanParams) (string, error)

Through the one door that can see which workspaces are on the plan (migration 0164).

func (*Queries) RemoveTemplate 

func (q *Queries) RemoveTemplate(ctx context.Context, arg RemoveTemplateParams) (int64, error)

The deletion where no legal hold covers the template: the row goes at once (data-retention.md §4). Nothing shows a deleted template's name and nothing references one, so there is no tombstone row to keep; the journal and the tombstone the caller writes are the record. Under the same optimistic lock as the edit, and never on a row already deleted - that one is the hold's.

func (*Queries) RenameAccount 

func (q *Queries) RenameAccount(ctx context.Context, arg RenameAccountParams) (int64, error)

The display name and no other column, for the reason the preferences' query gives. An erased account keeps the marker its erasure wrote: nobody is left to rename it.

func (*Queries) RenamePasskey 

func (q *Queries) RenamePasskey(ctx context.Context, arg RenamePasskeyParams) (WebauthnCredential, error)

Only the account's own: another's, another workspace's or a removed one matches nothing.

func (*Queries) RepeatJob 

func (q *Queries) RepeatJob(ctx context.Context, arg RepeatJobParams) (int64, error)

A poller's next round rather than a retry: the attempts start again from zero, because the round that just finished succeeded.

func (*Queries) RepointWebhookDelivery 

func (q *Queries) RepointWebhookDelivery(ctx context.Context, arg RepointWebhookDeliveryParams) (int64, error)

The collapse: the pending delivery now stands for the newer event, whose payload is the one the target receives. Only while it is pending - an attempt already made was made with what it had.

func (*Queries) RequestTenantDeletion 

func (q *Queries) RequestTenantDeletion(ctx context.Context, arg RequestTenantDeletionParams) (int64, error)

The one edge with two origins (§5: Active and Suspended both lead to PendingDeletion). Where it came from is kept, so that a cancel returns it there; the right-hand side reads the row as it was.

func (*Queries) RequeueDeadPlatformDeliveries 

func (q *Queries) RequeueDeadPlatformDeliveries(ctx context.Context, arg RequeueDeadPlatformDeliveriesParams) ([]pgtype.UUID, error)

A batch of the subscription's dead letters back to pending, each at the start of a fresh round of attempts: the count is raised to the round's boundary, so a round a pause or an expiry cut short does not shorten the next. The status in the statement makes two redeliveries at once queue each dead letter once. A dead letter whose event was swept is not one: nothing can be sent for it.

func (*Queries) ResealMailbox 

func (q *Queries) ResealMailbox(ctx context.Context, arg ResealMailboxParams) (int64, error)

A provider that rotates its refresh token: the new one replaces the old.

func (*Queries) ReserveIdempotencyKey 

func (q *Queries) ReserveIdempotencyKey(ctx context.Context, arg ReserveIdempotencyKeyParams) (int64, error)

The tenant is never a parameter here: it comes from the transaction's own context through current_tenant_id(), which is the same value row level security compares against. A row can therefore not be written into the wrong tenant even by a caller that wanted to.

func (*Queries) ResolveMailWorkspace 

func (q *Queries) ResolveMailWorkspace(ctx context.Context, name string) (pgtype.UUID, error)

Before any tenant is known: the function reads past row level security, and only an enabled row.

func (*Queries) ResolveOperatorAccount 

func (q *Queries) ResolveOperatorAccount(ctx context.Context, arg ResolveOperatorAccountParams) (pgtype.UUID, error)

The account an address names inside one workspace, through the register's own narrow door (migration 0109). An operator cannot list accounts across workspaces - `account` is behind row level security - so an identifier is not something they can look up, and an address and a slug are what a person knows. Answers one identifier or nothing.

func (*Queries) ResolveSingleOperatorAccount 

func (q *Queries) ResolveSingleOperatorAccount(ctx context.Context, email string) (pgtype.UUID, error)

A bare address in `HUBTASK_OPERATORS` on a single-mode installation: its one workspace's account, or nothing (migration 0128).

func (*Queries) ResolveTenant 

func (q *Queries) ResolveTenant(ctx context.Context, slug *string) (pgtype.UUID, error)

The sign-in surface (security.md §5): sessions, refresh rotation, the attempt ledger and the invitation redeemed.

The tenant is never a parameter in this file: row level security bounds every statement to the tenant of the running transaction, which is what makes a session of another workspace invisible rather than forbidden (ADR-0010, multi-tenancy.md §2). The one exception is ResolveTenant, which exists because sign-in needs a tenant before it can open a bounded transaction at all (multi-tenancy.md §3) - it answers one identifier or none, through the SECURITY DEFINER function migration 0063 pins down, and never a listing.

func (*Queries) RestoreContainerBatch 

func (q *Queries) RestoreContainerBatch(ctx context.Context, arg RestoreContainerBatchParams) ([]pgtype.UUID, error)

The containers of one deletion, taken out of the trash together. Returns what came back, for the same reason the trashing statement does: each one is announced separately.

func (*Queries) RestoreInProgress 

func (q *Queries) RestoreInProgress(ctx context.Context) (bool, error)

Whether this tenant already has a restore going. Asked when one is requested, so that the refusal is a 409 the caller can read rather than a claim that fails minutes later inside a job.

func (*Queries) RestoreWorkItemBatch 

func (q *Queries) RestoreWorkItemBatch(ctx context.Context, arg RestoreWorkItemBatchParams) (int64, error)

The way back: every item of one deletion, taken out of the trash together.

Keyed on the batch and not on a path, which is what makes a restore exactly reverse the deletion it undoes. A subtree that has grown a younger, separate deletion inside it since would otherwise come back whole, and a subtree that has been moved apart in the meantime would not come back at all.

It serves a container's deletion as well as an item's: the items of a trashed collection carry the container batch, so this is the statement that gives them back too.

func (*Queries) RestrictedAccounts 

func (q *Queries) RestrictedAccounts(ctx context.Context, accountIds []pgtype.UUID) ([]pgtype.UUID, error)

Which of the accounts named may not be processed automatically (Art. 18, data-protection.md §4).

Anonymised as well as restricted: an account whose person has been erased is not a candidate for anything either, and the caller asks one question - "may this system decide something about them" - rather than two. And every account an erasure still keeps a part of under a hold, whatever its status, as RestrictedPeople answers it (data-protection.md §4.1).

func (*Queries) RestrictedPeople 

func (q *Queries) RestrictedPeople(ctx context.Context) ([]RestrictedPeopleRow, error)

Whose processing is restricted (Art. 18, data-protection.md §4): every account whose status is RESTRICTED, and every account a legal hold still keeps contributions of - the subject of an erasure case with a part not yet erased (§4.1), whatever its status: an invited or disabled one keeps its status, which RESTRICTED would turn into one that may act, and an anonymised one has no other mark. Not every anonymised account: what an erasure anonymised without a hold is the workspace's content. The names and the address are what a prompt builder replaces in what remains; an anonymised account has none left.

func (*Queries) ResumePausedAutomationRule 

func (q *Queries) ResumePausedAutomationRule(ctx context.Context, arg ResumePausedAutomationRuleParams) (int64, error)

Switches one of them back on with its next moment, and takes the mark off. The failure count is left as it was: the rule was on with that count when the request switched it off, and nobody has looked at it since.

func (*Queries) RetentionCandidatesByArchivedAt 

func (q *Queries) RetentionCandidatesByArchivedAt(ctx context.Context, arg RetentionCandidatesByArchivedAtParams) ([]RetentionCandidatesByArchivedAtRow, error)

func (*Queries) RetentionCandidatesByCompletedAt 

func (q *Queries) RetentionCandidatesByCompletedAt(ctx context.Context, arg RetentionCandidatesByCompletedAtParams) ([]RetentionCandidatesByCompletedAtRow, error)

The candidates of phase one, one statement per anchor.

Only what is not already marked and not already gone: a row the last pass marked is phase two's business, and a row in the trash is the trash's. The hub is joined in because the scope of a rule can be a hub and an entry three levels down does not know which hub it is under.

`after_at` and `after_id` continue the read after a row the caller already judged (keyset, both NULL for the start): rows the caller could not act on - a legal hold, a condition, a narrower rule's period - stay in this set and would otherwise fill every batch ahead of a due row. The order ends in the identifier, so a position names one place; and unlike an offset, a page costs a page however far into the rows it starts, and a position kept across passes stays where it was when rows before it are marked or removed (data-retention.md §5).

func (*Queries) RetentionCandidatesByDeletedAt 

func (q *Queries) RetentionCandidatesByDeletedAt(ctx context.Context, arg RetentionCandidatesByDeletedAtParams) ([]RetentionCandidatesByDeletedAtRow, error)

The trash: what the trash's own rule governs, and what a chain whose first stage put it there comes back for.

func (*Queries) RetentionMarkedItemsDue 

func (q *Queries) RetentionMarkedItemsDue(ctx context.Context, arg RetentionMarkedItemsDueParams) ([]RetentionMarkedItemsDueRow, error)

Phase two: what the grace period has run out on. `after_at` and `after_id` continue past marked rows a hold or a retained descendant keeps, as the candidates above do.

func (*Queries) RetryJob 

func (q *Queries) RetryJob(ctx context.Context, arg RetryJobParams) (int64, error)

func (*Queries) RevokeAccessToken 

func (q *Queries) RevokeAccessToken(ctx context.Context, arg RevokeAccessTokenParams) (int64, error)

Only the first withdrawal writes. A second call matches nothing, which is how the use case tells "revoked just now" from "already revoked" without reading the row again - and what keeps the moment it was first pulled from being overwritten.

func (*Queries) RevokeAllSessionsForAccount 

func (q *Queries) RevokeAllSessionsForAccount(ctx context.Context, arg RevokeAllSessionsForAccountParams) (int64, error)

Every device at once, the answer to "I left myself signed in somewhere".

func (*Queries) RevokeCalendarFeed 

func (q *Queries) RevokeCalendarFeed(ctx context.Context, arg RevokeCalendarFeedParams) (int64, error)

Revocation is a stamp rather than a delete: "that token was revoked on Tuesday" is a question somebody asks after a laptop goes missing, and a deleted row answers it with silence.

The revoked_at IS NULL condition is what makes the moment the first one. A second revocation changes no row, which is how the caller learns it was already revoked without reading first.

func (*Queries) RevokeConsent 

func (q *Queries) RevokeConsent(ctx context.Context, arg RevokeConsentParams) (int64, error)

Ends every standing consent of one account for one purpose.

The moment is only written where there is none: when the processing stopped is the fact being kept, and a second withdrawal must not move it.

func (*Queries) RevokeGrantSessions 

func (q *Queries) RevokeGrantSessions(ctx context.Context, arg RevokeGrantSessionsParams) (int64, error)

The leash pulled: every session the grant issued refuses on its next request, the way refresh reuse would end them.

func (*Queries) RevokeMembership 

func (q *Queries) RevokeMembership(ctx context.Context, id pgtype.UUID) (int64, error)

func (*Queries) RevokeOauthGrant 

func (q *Queries) RevokeOauthGrant(ctx context.Context, arg RevokeOauthGrantParams) (int64, error)

Bounded to the owner in the same statement that writes; only the first withdrawal writes.

func (*Queries) RevokeOtherSessionsForAccount 

func (q *Queries) RevokeOtherSessionsForAccount(ctx context.Context, arg RevokeOtherSessionsForAccountParams) (int64, error)

Every device but the one asking (UC-ID-06 check 4). A NULL `keep` spares nothing: the comparison is written so that it can never become `id <> ”`, which would compare against nothing at all.

func (*Queries) RevokeSession 

func (q *Queries) RevokeSession(ctx context.Context, arg RevokeSessionParams) (int64, error)

Bounded to the owner in the same statement that writes, and only the first withdrawal writes - a second call matches nothing, which is how the use case tells "ended just now" from "already ended" without reading the row again.

func (*Queries) RevokeSessionsOfStaleDevices 

func (q *Queries) RevokeSessionsOfStaleDevices(ctx context.Context, arg RevokeSessionsOfStaleDevicesParams) (int64, error)

§6's other half: a device silent past the period loses its sign-in. The session the device last synchronised under is revoked before the row goes, in the same pass; a credential that is not a session matches nothing here and revokes nothing.

func (*Queries) RewrapAiProviderKey 

func (q *Queries) RewrapAiProviderKey(ctx context.Context, arg RewrapAiProviderKeyParams) (int64, error)

A re-seal (ADR-0045): the wrapping moves, the configuration does not, so the version stays - an operator rotating the installation's keys has not changed anybody's provider.

func (*Queries) RewrapAutomationRuleActions 

func (q *Queries) RewrapAutomationRuleActions(ctx context.Context, arg RewrapAutomationRuleActionsParams) (int64, error)

Only the actions, guarded by the version and not bumping it: the rule's definition is what it was, and a person editing it at the same moment must not meet a conflict caused by a rotation of the installation's keys.

func (*Queries) RewrapBackupTargetCredential 

func (q *Queries) RewrapBackupTargetCredential(ctx context.Context, arg RewrapBackupTargetCredentialParams) (int64, error)

func (*Queries) RewrapCallJobSecret 

func (q *Queries) RewrapCallJobSecret(ctx context.Context, arg RewrapCallJobSecretParams) (int64, error)

Only the sealed secret, guarded by the key it named when it was read: a job that finished, or that another round moved, in between is left alone. The lease columns are not touched, so a worker holding the job finishes it as it would have.

func (*Queries) RewrapIdentityProviderSecret 

func (q *Queries) RewrapIdentityProviderSecret(ctx context.Context, arg RewrapIdentityProviderSecretParams) (int64, error)

A re-seal (ADR-0045): the wrapping moves, the configuration does not, so the version stays - an operator rotating the installation's keys has not changed anybody's provider.

func (*Queries) RewrapMfaEnrollment 

func (q *Queries) RewrapMfaEnrollment(ctx context.Context, arg RewrapMfaEnrollmentParams) (int64, error)

The wrapping moves and nothing else does: no updated_at the person would read as their enrolment having changed. The guard on the key the row named is what keeps a re-seal from overwriting an enrolment that was replaced between the read and this write.

func (*Queries) RewrapMfaReplacement 

func (q *Queries) RewrapMfaReplacement(ctx context.Context, arg RewrapMfaReplacementParams) (int64, error)

RewrapMfaEnrollment's guard, for the replacement's wrapping.

func (*Queries) RewrapOfferedAiProviderKey 

func (q *Queries) RewrapOfferedAiProviderKey(ctx context.Context, arg RewrapOfferedAiProviderKeyParams) (int64, error)

A re-seal of one offered model's key: the wrapping moves, the configuration and its version do not. Guarded on the key the row named when it was read, so an operator's change of the key in between wins. Only the installation's own scope writes it - the installation_write policy.

func (*Queries) RewrapWebhookSecrets 

func (q *Queries) RewrapWebhookSecrets(ctx context.Context, arg RewrapWebhookSecretsParams) (int64, error)

Both wrappings in one statement, guarded by the version and deliberately not bumping it: a re-seal is not an edit anybody made, and a rotation of the installation's keys must not turn into a conflict for the person editing their subscription at the same moment.

func (*Queries) RolesHeldAnywhere 

func (q *Queries) RolesHeldAnywhere(ctx context.Context, accountID pgtype.UUID) ([]MembershipRole, error)

Every role the account holds anywhere in the tenant, directly or through a group, each once: what a new way into the account would hand its issuer (identity.md §13). The rows that stand are the rows there are - a revoked membership is deleted, and a deleted group takes its memberships and its members with it - so nothing further is filtered, as HoldsAnyMembership filters nothing.

func (*Queries) RotatePlatformSubscriptionSecret 

func (q *Queries) RotatePlatformSubscriptionSecret(ctx context.Context, arg RotatePlatformSubscriptionSecretParams) (int64, error)

func (*Queries) RotateRefreshToken 

func (q *Queries) RotateRefreshToken(ctx context.Context, arg RotateRefreshTokenParams) (int64, error)

Only the first exchange writes. A second call matches nothing, and that nothing is the reuse detection: the caller then kills the family rather than minting a second line.

func (*Queries) RotateWebhookSecret 

func (q *Queries) RotateWebhookSecret(ctx context.Context, arg RotateWebhookSecretParams) (int64, error)

The rotation, as one statement: the new secret becomes current, the current one becomes previous with the moment it stops verifying, and the version moves. Two statements could leave a subscription with a new secret and no grace, which is the failure the grace exists to prevent.

func (*Queries) RulesByTriggerKind 

func (q *Queries) RulesByTriggerKind(ctx context.Context, kind string) ([]RulesByTriggerKindRow, error)

The enabled rules of one trigger kind, which is what a producer that is not the event dispatcher asks. The scope is not in the predicate, for RulesForEventType's reason: the narrowing is the producer's, against what it can resolve.

func (*Queries) RulesForEventType 

func (q *Queries) RulesForEventType(ctx context.Context, eventType string) ([]RulesForEventTypeRow, error)

What the subscriber asks per event: the enabled rules whose trigger is this event type.

The event type is cast, because `->>` gives sqlc nothing to infer a parameter's type from: without it the argument is generated as bytes rather than as the text the column holds.

The scope is not in the predicate. A rule scoped to a hub matches an event in that hub's collections, and the event carries a subject rather than a path - so the narrowing is the subscriber's, against what it can resolve, rather than a join this statement cannot make.

func (*Queries) RunningPrivateHubAccess 

func (q *Queries) RunningPrivateHubAccess(ctx context.Context, arg RunningPrivateHubAccessParams) ([]PrivateHubAccess, error)

The access this person opened on this hub that has not ended. At most one: a second is refused while the first runs, under the hub's row (LockHubOf).

func (*Queries) SaveAutoAssignPolicyState 

func (q *Queries) SaveAutoAssignPolicyState(ctx context.Context, arg SaveAutoAssignPolicyStateParams) (int64, error)

The advanced cursor, written by the transaction that holds the lock LockAutoAssignPolicy took. No version guard: the lock is the concurrency control here, and a version bump per assignment would make the rotation's bookkeeping look like a configuration change to a client comparing versions.

func (*Queries) SaveNotificationOutcome 

func (q *Queries) SaveNotificationOutcome(ctx context.Context, arg SaveNotificationOutcomeParams) (int64, error)

What the delivery leaves behind: the state, why, when it went, and how often it has been tried.

The identity, the references and the moment it was written are not in the SET list, and that is the point: a delivery may change what happened to a notification and nothing about what it is about. An UPDATE that could rewrite recipient_id would be a way to send somebody else's message.

func (*Queries) SaveNotificationPreference 

func (q *Queries) SaveNotificationPreference(ctx context.Context, arg SaveNotificationPreferenceParams) error

A row is an exception rather than a setting, so writing one is an upsert: somebody switching a category off for the second time is stating the same thing, not making a new row.

func (*Queries) ScheduledJobBacklog 

func (q *Queries) ScheduledJobBacklog(ctx context.Context, arg ScheduledJobBacklogParams) (int64, error)

The retry ladder parked on the queue: jobs of one kind waiting for a future moment. A webhook retry is exactly one scheduled job - one attempt, one row - so this answers hubtask_webhook_retry_backlog (§4) from the one table that has no tenant boundary to cross.

func (*Queries) SealMediaObject 

func (q *Queries) SealMediaObject(ctx context.Context, arg SealMediaObjectParams) (int64, error)

The confirmation's write: PENDING becomes READY, carrying the judged type and the measured size. Matches only a live PENDING row, so a double confirmation and a confirmation racing the reconciliation job both come back as zero rows - the caller reads the row again and answers from what it finds.

func (*Queries) SealedMfaEnrollmentsNotUnder 

func (q *Queries) SealedMfaEnrollmentsNotUnder(ctx context.Context, keyID string) ([]SealedMfaEnrollmentsNotUnderRow, error)

The rows a re-seal visits (ADR-0045): every enrolment whose secret names a key other than the current one. The key is a filter, never a tenant - row level security bounds this like every other statement in the file.

func (*Queries) SealedMfaReplacementsNotUnder 

func (q *Queries) SealedMfaReplacementsNotUnder(ctx context.Context, keyID *string) ([]SealedMfaReplacementsNotUnderRow, error)

A replacement's wrapping is a sealed value like the armed one's, so a rotation moves it too: the census counts it, and a rotation that skipped it would report done while it named the leaving key.

func (*Queries) SemanticSearchAvailable 

func (q *Queries) SemanticSearchAvailable(ctx context.Context) (bool, error)

Whether this installation has somewhere to keep meaning (ADR-0050).

The *table's* existence rather than the extension's, and the difference matters: an installation where somebody installed pgvector after the migrations ran has the extension and no store, which is not a working semantic search. One question, asked of the object the search actually reads.

The store is half of the answer and this query is deliberately only that half. Searching by meaning also needs a provider that embeds, which is a workspace's configuration rather than an installation's schema, and the two are joined where both are known - in the manifest.

func (*Queries) SessionElevatedUntil 

func (q *Queries) SessionElevatedUntil(ctx context.Context, arg SessionElevatedUntilParams) (pgtype.Timestamptz, error)

When the caller's live session stops carrying the control plane's scope; NULL where it never did. Read before a raise, so a client that lost its copy of a running hour learns the end instead of spending a proof on a refusal.

func (*Queries) SessionsForAccount 

func (q *Queries) SessionsForAccount(ctx context.Context, arg SessionsForAccountParams) ([]SessionsForAccountRow, error)

One's own unrevoked, unexpired sessions, newest first. The ended and the run-out are absent here; the workspace's bounds are judged by the application with the method authentication uses, which is why the rotation cutoff rides along, off the row FindSessionForAuth reads it from.

The provider's name is joined under the reader's own row policy (migration 0111): one this tenant can see - its own or the installation's - is named, and a removed one or another tenant's is not.

func (*Queries) SetAccountAvatar 

func (q *Queries) SetAccountAvatar(ctx context.Context, arg SetAccountAvatarParams) (int64, error)

The picture and no other column, for the reason the preferences' query gives. NULL takes it away. An erased account has no picture to set: its anonymisation cleared it.

func (*Queries) SetAccountPassword 

func (q *Queries) SetAccountPassword(ctx context.Context, arg SetAccountPasswordParams) (int64, error)

The hash and the moment in one statement, so no reader sees one without the other. A password set through any door is the person's own, so a start password's mark goes with it (ADR-0074 §2).

func (*Queries) SetAccountStatus 

func (q *Queries) SetAccountStatus(ctx context.Context, arg SetAccountStatusParams) (int64, error)

One column, for the reason UpdateAccountPreferences writes three: the status decides whether an account may act at all, and a statement that could write anything else while setting it is one that can change what somebody may do by accident.

func (*Queries) SetAutomationRuleEnabled 

func (q *Queries) SetAutomationRuleEnabled(ctx context.Context, arg SetAutomationRuleEnabledParams) (int64, error)

Switching a rule on or off, and nothing else.

Its own statement rather than a column in the update above, because the two are different acts with different audit entries - and one statement carrying both would let an edit switch a rule on as a side effect of changing its name.

The failure counter is cleared only on the way on. A rule somebody has looked at and turned back on is one whose run of failures has been dealt with; a rule switched off by hand has not been fixed, and clearing the count there would forget why it stopped.

func (*Queries) SetAutomationRuleInboundToken 

func (q *Queries) SetAutomationRuleInboundToken(ctx context.Context, arg SetAutomationRuleInboundTokenParams) (int64, error)

The INBOUND_WEBHOOK trigger's address: hashed, answered once, revoked by rotating (automation.md §1.1). Mints or rotates the address. One statement, so the old hash and the new one never coexist: rotating *is* revoking, and a window in which both open the same rule would be the one thing "revocable by rotating" must not mean.

The version is deliberately untouched. The address is a credential beside the rule rather than part of its definition, and bumping the version would make a rotation look like an edit to a client holding an optimistic lock.

func (*Queries) SetAutomationRuleNextRun 

func (q *Queries) SetAutomationRuleNextRun(ctx context.Context, arg SetAutomationRuleNextRunParams) error

Moves one rule on to its next moment.

The version is deliberately untouched. Nobody read this rule in order to advance it - a pass did, because a moment arrived - and bumping the version would make every occurrence look like an edit to a client holding an optimistic lock.

func (*Queries) SetBackupRunExpiry 

func (q *Queries) SetBackupRunExpiry(ctx context.Context, arg SetBackupRunExpiryParams) error

When the generation plan expects an archive to go. Written after a successful run has decided, and cleared for an archive the plan now intends to keep - a stale date on a kept archive is what an operator would read as "this is about to disappear".

func (*Queries) SetBackupScheduleNextRun 

func (q *Queries) SetBackupScheduleNextRun(ctx context.Context, arg SetBackupScheduleNextRunParams) error

func (*Queries) SetBucketAttributes 

func (q *Queries) SetBucketAttributes(ctx context.Context, arg SetBucketAttributesParams) (int64, error)

Every column is written on every call, not only the ones that moved: the application has already decided what the row should say, so this writes that decision whole. `wip_limit = COALESCE($1, wip_limit)` would additionally make clearing a limit unexpressible.

Optimistic locking in the WHERE clause, as everywhere: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md §5).

func (*Queries) SetBucketDeleted 

func (q *Queries) SetBucketDeleted(ctx context.Context, arg SetBucketDeletedParams) (int64, error)

A soft delete: the row stays so that a change log entry can still name it and a restore stays possible (offline-sync.md §7). The unique name index is partial on `deleted_at IS NULL`, so the name is free again the moment this runs.

func (*Queries) SetBucketOrderKey 

func (q *Queries) SetBucketOrderKey(ctx context.Context, arg SetBucketOrderKeyParams) (int64, error)

The whole of what a reorder changes. A board is one level, so nothing below a column has to follow it.

func (*Queries) SetCollectionHandle 

func (q *Queries) SetCollectionHandle(ctx context.Context, arg SetCollectionHandleParams) (int64, error)

func (*Queries) SetCommentBody 

func (q *Queries) SetCommentBody(ctx context.Context, arg SetCommentBodyParams) (int64, error)

The rewrite, under the same optimistic lock every other row takes (api-guidelines.md §5). The deletion stamp is in the guard rather than trusted to the caller's read: a tombstone's text is gone, and an edit racing a deletion must lose to it rather than resurrect the words.

func (*Queries) SetCommentDeleted 

func (q *Queries) SetCommentDeleted(ctx context.Context, arg SetCommentDeletedParams) (int64, error)

The tombstone: text gone, identity and timestamps kept. edited_at survives deliberately - that the words had been rewritten is part of the thread's history, what they were is not.

keep_text is a legal hold covering the comment (data-retention.md §4): the row is a tombstone for every reader all the same, and the text stays until the retention pass clears it (ClearCommentTexts) once no hold covers it.

func (*Queries) SetContainerArchived 

func (q *Queries) SetContainerArchived(ctx context.Context, arg SetContainerArchivedParams) (int64, error)

The archive stamp, set or cleared. One statement for both directions, because they differ in the value and in nothing else.

Only this row. A collection under an archived hub inherits the state through FindContainer's join rather than through a stamp of its own, so archiving a hub writes one row here however many collections sit in it - and unarchiving it restores exactly what it covered, leaving a collection that was archived in its own right archived (I-C3).

func (*Queries) SetContainerAttributes 

func (q *Queries) SetContainerAttributes(ctx context.Context, arg SetContainerAttributesParams) (int64, error)

A container's own descriptive fields: what RenameContainer may change.

Every column is written on every call, not only the ones that moved. The application has already decided what the row should say - it read the container, applied the update and refused what the lifecycle does not allow - so this writes that decision whole. `description = COALESCE($1, description)` would additionally make clearing a description unexpressible.

The name is normalised here for the reason InsertContainer normalises it: the unique index has to see two spellings of the same word as one name, and the domain may not import a Unicode library (ADR-0001). A rename into a name already taken at this level therefore fails on `container_name_uq` exactly as an insert does, which is what keeps one answer for one condition.

Optimistic locking in the WHERE clause, as everywhere: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md §5).

func (*Queries) SetContainerPlacement 

func (q *Queries) SetContainerPlacement(ctx context.Context, arg SetContainerPlacementParams) (int64, error)

Where a collection sits and how it ranks there: the whole of what a move changes.

No subtree statement beside it, unlike the item move. A container tree is two levels deep (I-C1), so a collection has no containers below it whose path would have to follow - and the items it holds reference their collection rather than a path through the hubs.

A name already taken in the destination fails on `container_name_uq`, which is the same index that decides an insert. Checking beforehand would be two statements with a gap, and two moves arriving inside that gap would both pass the check (multi-tenancy.md §2.1).

func (*Queries) SetContainerPolicies 

func (q *Queries) SetContainerPolicies(ctx context.Context, arg SetContainerPoliciesParams) (int64, error)

One key of the policies document, set in place.

`jsonb_set` rather than replacing the column, because the column holds other keys and this use case owns one of them. Overwriting the whole document would silently discard the container's structure layer (Settings.sql) - a data loss nobody would see until the collection lost its shape.

The value is a parameter of the jsonb constructor rather than concatenated text: `to_jsonb` on a bound parameter is what keeps this a parameterised statement, which rule 9 requires of every query including the ones that build a document.

func (*Queries) SetContainerPrivate 

func (q *Queries) SetContainerPrivate(ctx context.Context, arg SetContainerPrivateParams) (int64, error)

Whether a hub is private (ADR-0073 §1). The column's CHECK refuses it on a collection whatever the caller did.

func (*Queries) SetContainerRank 

func (q *Queries) SetContainerRank(ctx context.Context, arg SetContainerRankParams) (int64, error)

The rank alone, which is the whole of what a reorder changes.

Beside SetContainerPlacement rather than reusing it, and the difference is not stylistic. That one writes `parent_id` because a move changes it, and it is a required argument because a collection always has one. A **hub** has none: it sits in the tenant and in nothing else (I-C1), so a reorder of a hub through the placement statement passes an identifier that does not exist and fails before it reaches the database.

The narrower statement is also the truer one. A reorder does not move anything, so writing the parent at all would be a statement claiming to change something it must not.

func (*Queries) SetContainerStructure 

func (q *Queries) SetContainerStructure(ctx context.Context, arg SetContainerStructureParams) (int64, error)

The structure layers of hubs, collections and the workspace (domain-model.md §2, "Levels and presets"). A container's own layer is the `structure` key of its policies document, beside `completion_policy`, which is the collection's own completion; the workspace's layer, its locks and its default preset are the `structure` key of the tenant's settings. Both documents are written by key, so every other key in them - and every writer that predates this file - is left alone. A container's own layer, and on a collection its own completion: an empty completion removes the key, so the collection follows its hub again. Both in one statement, guarded on the version like every container write (api-guidelines.md §5). The document is bound as a parameter (rule 9).

func (*Queries) SetContainerTrashed 

func (q *Queries) SetContainerTrashed(ctx context.Context, arg SetContainerTrashedParams) (int64, error)

The deletion stamp on the hub or collection the caller read, set or cleared, with its batch.

func (*Queries) SetJobProgress 

func (q *Queries) SetJobProgress(ctx context.Context, arg SetJobProgressParams) error

How far along a long job is, written by the handler as it goes (migration 0032).

Fenced on the lease like every other statement a handler runs: a worker that fell so far behind that somebody else took the job over must not keep writing a fraction of work it is no longer doing. A job that is not RUNNING under this lease is simply not updated, and the handler finds out at its next write.

Clamped in SQL rather than trusted from the caller, because a fraction outside [0,1] on a progress bar is a rendering bug in every client at once.

func (*Queries) SetJumbleIntakeToken 

func (q *Queries) SetJumbleIntakeToken(ctx context.Context, arg SetJumbleIntakeTokenParams) error

Minting and rotating are one statement: the upsert replaces the hash, so the old token and the new one never both open the intake.

func (*Queries) SetLabelAttributes 

func (q *Queries) SetLabelAttributes(ctx context.Context, arg SetLabelAttributesParams) (int64, error)

func (*Queries) SetLabelDeleted 

func (q *Queries) SetLabelDeleted(ctx context.Context, arg SetLabelDeletedParams) (int64, error)

A soft delete. The rows in item_label stay: an item that carried the label goes on carrying it, and the read side filters on the label's own stamp - which is what makes a deletion undoable without having to remember who wore it.

func (*Queries) SetLabelRestored 

func (q *Queries) SetLabelRestored(ctx context.Context, arg SetLabelRestoredParams) (int64, error)

Clears the deletion stamp. Conditional on the version the writer read, as every label write is; whether the name is still free is decided by label_name_uq, which counts the label again the moment its stamp is gone - the index rather than a check first, so a create racing the restore loses to whichever commits first.

func (*Queries) SetMailboxChecked 

func (q *Queries) SetMailboxChecked(ctx context.Context, arg SetMailboxCheckedParams) (int64, error)

func (*Queries) SetOccurrenceSeries 

func (q *Queries) SetOccurrenceSeries(ctx context.Context, arg SetOccurrenceSeriesParams) (int64, error)

An occurrence's two pointers, written together: which series it belongs to, and which entry it was copied from.

Both, because with one alone every occurrence would carry the rule identifier the template carries, so the column would distinguish neither and nothing on an occurrence would name the entry it repeats from.

No version and no stamp, for SetWorkItemRecurrence's reasons: neither column is one a client owns, and what serialises two writers is the rule's own lock, in whose transaction this runs.

func (*Queries) SetProviderWithdrawal 

func (q *Queries) SetProviderWithdrawal(ctx context.Context, arg SetProviderWithdrawalParams) (SetProviderWithdrawalRow, error)

When the installation's offer ends; NULL keeps offering it, and keeping it switches the row back on for an offer a previous binary ended through the form. The installation's scope only: the write policy matches no row in a workspace's.

func (*Queries) SetRedemptionToken 

func (q *Queries) SetRedemptionToken(ctx context.Context, arg SetRedemptionTokenParams) (int64, error)

========================== Invitation redemption ========================== Minted on invite and replaced by re-inviting; only an account still waiting can carry one.

func (*Queries) SetReminderFireAt 

func (q *Queries) SetReminderFireAt(ctx context.Context, arg SetReminderFireAtParams) (int64, error)

The recomputation a moved due date causes. Neither the version nor the stamp moves with it: fire_at is derived from the offset and the entry's date, so nobody edited this row - and a version spent here would answer a client's If-Match with a conflict it could not have avoided. What serialises two concurrent moves is the entry's own optimistic lock, in whose transaction this runs.

func (*Queries) SetReminderState 

func (q *Queries) SetReminderState(ctx context.Context, arg SetReminderStateParams) (int64, error)

The guarded transition. PENDING is in the predicate rather than trusted to the caller's read: that is what makes firing exactly-once across a leader failover, because the row leaves PENDING once and the transaction that moved it is the one that wrote the notification.

func (*Queries) SetRetentionCursor 

func (q *Queries) SetRetentionCursor(ctx context.Context, arg SetRetentionCursorParams) error

One row per reader; a second pass at the same place overwrites rather than fails. One retention job runs per tenant at a time, so there is no second writer in practice.

func (*Queries) SetSavedViewAttributes 

func (q *Queries) SetSavedViewAttributes(ctx context.Context, arg SetSavedViewAttributesParams) (int64, error)

A view's own fields, written whole under the optimistic lock every editable row takes. The scope and the sharing are not in the statement: where a view lives is decided at creation, and sharing has a statement of its own - one decision about one field, never spending a rename's version.

func (*Queries) SetSavedViewSharing 

func (q *Queries) SetSavedViewSharing(ctx context.Context, arg SetSavedViewSharingParams) (int64, error)

func (*Queries) SetTemplateDeleted 

func (q *Queries) SetTemplateDeleted(ctx context.Context, arg SetTemplateDeletedParams) (int64, error)

The deletion while a legal hold covers the template (data-retention.md §4): the row stays, unreadable, until the retention pass removes it (RemoveDeletedTemplates). The trees the template has stamped out are ordinary entries and are not touched; what goes is the ability to stamp out more - and the name, which the partial unique index frees for a template defined afterwards.

func (*Queries) SetTenantOwnAiBudget 

func (q *Queries) SetTenantOwnAiBudget(ctx context.Context, arg SetTenantOwnAiBudgetParams) (int64, error)

The workspace's own budget for its own AI model, beside the quotas key rather than in it: the operator's write replaces that key whole, and this budget is not the operator's. NULL removes it. Last write wins, as for every setting a workspace's administrators share; the version moves so an operator's write guarded on the old one sees it.

func (*Queries) SetTenantPlan 

func (q *Queries) SetTenantPlan(ctx context.Context, arg SetTenantPlanParams) (int64, error)

A workspace onto another plan, or none (multi-tenancy.md §4.2). Guarded on the version read, so a move cannot land on a workspace that changed meanwhile, and refused once the purge has begun.

func (*Queries) SetTenantQuotas 

func (q *Queries) SetTenantQuotas(ctx context.Context, arg SetTenantQuotasParams) (int64, error)

Replaces the quotas key and only it - require_admin_totp and whatever else lives beside it stay untouched. Guarded on the row version: two operators moving one wall see each other.

func (*Queries) SetTenantReference 

func (q *Queries) SetTenantReference(ctx context.Context, arg SetTenantReferenceParams) (int64, error)

A platform's reference on the workspace, or none (multi-tenancy.md §4.3). Guarded on the version read, and refused once the purge has begun; a reference another workspace holds is the unique index's refusal.

func (*Queries) SetTenantStatus 

func (q *Queries) SetTenantStatus(ctx context.Context, arg SetTenantStatusParams) (int64, error)

The lifecycle edges of §5, one guarded write each: the expected status is the edge's origin, so a suspension of a suspended tenant or a resume of an active one changes zero rows and the caller reports the conflict instead of overwriting a state it never read.

func (*Queries) SetWorkItemArchived 

func (q *Queries) SetWorkItemArchived(ctx context.Context, arg SetWorkItemArchivedParams) (int64, error)

The trash and the archive: the statements that move rows between the two lifecycle stamps, and the ones that read and finally remove what is in the trash.

Their own file rather than more of Work.sql, because they are one subject with one invariant running through all of them - the batch identifier every row of one deletion shares (I-C2) - and because the file that holds the live tree's reads should not be where somebody looks for a delete.

The tenant is never a parameter here either: it comes from the transaction's own context through current_tenant_id(), which is the value row level security compares against. The archive stamp on one item, set or cleared. One statement for both directions, because they differ in the value and in nothing else.

Only this row. Archiving is a decision about one entry and does not descend: a work package under an archived task stays writable, unlike a collection under an archived hub, because an item's children are entries in their own right rather than a level of the structure (I-C3 is about containers). Optimistic locking in the WHERE clause, as everywhere.

func (*Queries) SetWorkItemAssignee 

func (q *Queries) SetWorkItemAssignee(ctx context.Context, arg SetWorkItemAssigneeParams) (int64, error)

The one person an entry is on, set or cleared, under the same optimistic lock every write to this row takes: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md §5).

Its own statement rather than a column added to SetWorkItemAttributes. An assignment is one decision about one field, and a statement that wrote the title alongside it would make handing an entry to somebody spend the version of a rename nobody asked for - which is the same reason the completion has a statement of its own.

Whether that account may be assigned at all is not asked here. It is a question about a membership somewhere above the entry, decided in the application layer before this runs (ADR-0005); the tenant-scoped foreign key is what stops the identifier pointing outside the tenant, and it is the database's rather than this statement's (ADR-0024).

func (*Queries) SetWorkItemAttributes 

func (q *Queries) SetWorkItemAttributes(ctx context.Context, arg SetWorkItemAttributesParams) (int64, error)

The item's own fields: what UpdateWorkItem may change.

Every column is written on every call, not only the ones that moved. The application has already decided what the row should say - it read the item, applied the update and refused what the capability profile does not allow - so this writes that decision whole. A statement that switched on which fields were sent would be the second place deciding it, in the layer that is not allowed to decide anything (ADR-0005), and `notes = COALESCE($1, notes)` would additionally make clearing the notes unexpressible.

Optimistic locking in the WHERE clause, as everywhere: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md §5).

`search_document` follows by itself, through the trigger migration 0019 puts on this table. The index behind full text search therefore cannot fall behind a rename, and it cannot fall behind a change of language either - which is what the trigger buys over the generated column it replaces (ADR-0034): a generated column can only be a function of the row, and the configuration a document is built under is not one PostgreSQL will let a generated column choose.

func (*Queries) SetWorkItemCompletion 

func (q *Queries) SetWorkItemCompletion(ctx context.Context, arg SetWorkItemCompletionParams) (int64, error)

Optimistic locking in the WHERE clause: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md §5).

Both completion columns are written together, always. The table's own CHECK insists that `is_completed = (completed_at IS NOT NULL)`, so a statement that set one without the other would be refused by the database - which is the right place for that rule and the reason this query has no branch in it.

The count moves in the same statement, and only with a move from open to done: the old row's `is_completed` is what the CASE reads, so a repeat counts nothing and nothing reads the count to write it back (migration 0189).

func (*Queries) SetWorkItemCover 

func (q *Queries) SetWorkItemCover(ctx context.Context, arg SetWorkItemCoverParams) (int64, error)

The cover, set or cleared, under the same optimistic lock every write to this row takes. Its own statement for the reason the assignee has one: a cover is one decision about one field, and spending a rename's version on it would be a version nobody asked for. The consistency of the three columns is the table's CHECK (migration 0013), so a statement that half-set a cover would be refused by the database.

func (*Queries) SetWorkItemCustomField 

func (q *Queries) SetWorkItemCustomField(ctx context.Context, arg SetWorkItemCustomFieldParams) (int64, error)

One key of the entry's custom field document, under the same optimistic lock every write to this row takes. One key rather than the whole document, and that is a data-safety decision as much as a merge one: the row may hold values whose definitions were deleted - visible to no read, but kept - and a write that replaced the document with what a read answered would erase them. The ref travels in the same statement, because a value and the identity of the definition it was written under are one fact: written apart, a crash between the two would leave a value no read can ever judge. A NULL value removes the key and its ref - "cleared" has one spelling, since the reads cannot tell a stored null from an absent key. The version predicate is what makes two devices writing two different keys resolve rather than overwrite.

func (*Queries) SetWorkItemDueDate 

func (q *Queries) SetWorkItemDueDate(ctx context.Context, arg SetWorkItemDueDateParams) (int64, error)

The due trio, set or cleared whole, under the same optimistic lock every write to this row takes (api-guidelines.md §5).

Its own statement rather than columns added to SetWorkItemAttributes, for the reason the assignee has one: a due date is one decision about one date, and a statement that wrote the title alongside it would make moving a deadline spend the version of a rename nobody asked for. The three columns travel together because none of them means anything alone (i18n-l10n.md §4) - which fields *moved* is the application's answer, recorded in the change log per field; the row simply says what is now true.

The two announcement stamps are cleared with it: a date that moves is a new deadline, which may be approached and missed again, and a stamp left standing would silence the announcement for it. Cleared here rather than by the caller, because they are bookkeeping about this column and nothing outside this statement writes it.

func (*Queries) SetWorkItemOrderKey 

func (q *Queries) SetWorkItemOrderKey(ctx context.Context, arg SetWorkItemOrderKeyParams) (int64, error)

A reorder within one level: the rank and the column, which is the whole of what drag and drop changes. The column is written although a plain reorder keeps it: a card dragged to another column of the same board stays on its level, and a statement that left the column out would drop that half of the move.

func (*Queries) SetWorkItemOrigin 

func (q *Queries) SetWorkItemOrigin(ctx context.Context, arg SetWorkItemOriginParams) (int64, error)

The provenance a conversion records: which jumble entry this item came from. Set exactly once - the guard is in the WHERE, so a second writer changes nothing - and never cleared: where an item came from does not stop being true.

func (*Queries) SetWorkItemPlacement 

func (q *Queries) SetWorkItemPlacement(ctx context.Context, arg SetWorkItemPlacementParams) (int64, error)

The moved item's own row: the parent it now sits under and the rank it takes among its new siblings.

This row is written here in full and excluded from the subtree statement, so that one move moves one version. Only this row's parent changes - a descendant keeps the parent it had - and the optimistic lock belongs on the row the caller actually read, which is this one.

func (*Queries) SetWorkItemRecurrence 

func (q *Queries) SetWorkItemRecurrence(ctx context.Context, arg SetWorkItemRecurrenceParams) (int64, error)

The entry's pointer at its series, set when a rule is stored and cleared when it goes.

No version and no stamp: the pointer is derived from whether a rule exists, so nobody edited the entry - and a version spent here would answer a client's If-Match with a conflict about a field it does not own. What serialises two writers is the rule's own lock, in whose transaction this runs.

func (*Queries) SetWorkItemTrashed 

func (q *Queries) SetWorkItemTrashed(ctx context.Context, arg SetWorkItemTrashedParams) (int64, error)

The deletion stamp on the row the caller actually read, set or cleared, with the batch it belongs to. Both columns move together: a stamp without a batch could not be restored as part of anything, and a batch without a stamp is a row that is not in the trash claiming to be part of a deletion.

This row alone, and it is excluded from the two statements below for the reason SetWorkItemPlacement is excluded from MoveWorkItemSubtree: one deletion moves one version on the row the optimistic lock is on, and writing it twice would be an artefact of splitting the work in two rather than a design.

func (*Queries) SetWorkspaceStructure 

func (q *Queries) SetWorkspaceStructure(ctx context.Context, arg SetWorkspaceStructureParams) (int64, error)

The workspace's layer, written by key under the tenant row's version: two administrators changing it see each other (409), and the sign-in rule's writer keeps its keys.

func (*Queries) SettleJumbleEntry 

func (q *Queries) SettleJumbleEntry(ctx context.Context, arg SettleJumbleEntryParams) (int64, error)

The one statement that decides an entry, whichever way it was decided. The status guard is in the WHERE rather than in a read-then-write: two conversions racing both read NEW, and the second would produce a second item - here the second matches nothing, and zero rows is what "somebody got there first" looks like from a statement that cannot be raced.

func (*Queries) ShareLegalHolds 

func (q *Queries) ShareLegalHolds(ctx context.Context) error

Taken before the holds are read by anything that deletes, for the rest of its transaction.

A hold placed or lifted while a deletion runs would otherwise pass it: the deletion read the holds a moment before, and removes what the new hold names. Shared, so deletions never wait for each other; placing and lifting take the exclusive lock below and wait for them, or are waited for. Transaction-scoped, per tenant, like the audit chain's (Audit.sql).

func (*Queries) SharedItemsInCollection 

func (q *Queries) SharedItemsInCollection(ctx context.Context, arg SharedItemsInCollectionParams) ([]pgtype.UUID, error)

The entries inside one collection that the account holds a membership on directly, or through one of its groups.

What "shared with me" means (domain-model.md §3.2): a membership at ITEM scope reaches that entry and nothing else, so the answer to "which of this collection's entries may I see" is the list of those scope identifiers. It is asked only when the account holds no role on the collection itself - the ordinary case answers the whole level in one check and never runs this.

The join is what bounds it: without it the query would return every entry shared with the account anywhere in the tenant, and the caller asked about one collection.

func (*Queries) SnapshotBuckets 

func (q *Queries) SnapshotBuckets(ctx context.Context, arg SnapshotBucketsParams) ([]Bucket, error)

func (*Queries) SnapshotComments 

func (q *Queries) SnapshotComments(ctx context.Context, arg SnapshotCommentsParams) ([]SnapshotCommentsRow, error)

func (*Queries) SnapshotContainers 

func (q *Queries) SnapshotContainers(ctx context.Context, arg SnapshotContainersParams) ([]SnapshotContainersRow, error)

The initial synchronisation (offline-sync.md §3.1): the current state, one kind at a time, in pages by identifier. Each statement is its kind's Find with the identifier as the page key and the live rows only - the trash and the deleted are tombstones in the log, not state. The column lists mirror the Find statements on purpose, so that the row mappers are shared and a device starting from nothing reads exactly the shape a device that pulled the change would.

func (*Queries) SnapshotLabels 

func (q *Queries) SnapshotLabels(ctx context.Context, arg SnapshotLabelsParams) ([]Label, error)

func (*Queries) SnapshotRecurrenceRules 

func (q *Queries) SnapshotRecurrenceRules(ctx context.Context, arg SnapshotRecurrenceRulesParams) ([]SnapshotRecurrenceRulesRow, error)

func (*Queries) SnapshotReminders 

func (q *Queries) SnapshotReminders(ctx context.Context, arg SnapshotRemindersParams) ([]SnapshotRemindersRow, error)

func (*Queries) SnapshotSetElements 

func (q *Queries) SnapshotSetElements(ctx context.Context, arg SnapshotSetElementsParams) ([]SnapshotSetElementsRow, error)

Every tag row of every live entry, keyed the way the table is. Both tags travel: a removed element with its removal tag is what lets a device merge a later re-add correctly (core/domain/model/work/SetElement.go).

func (*Queries) SnapshotTemplates 

func (q *Queries) SnapshotTemplates(ctx context.Context, arg SnapshotTemplatesParams) ([]SnapshotTemplatesRow, error)

func (*Queries) SnapshotWorkItems 

func (q *Queries) SnapshotWorkItems(ctx context.Context, arg SnapshotWorkItemsParams) ([]SnapshotWorkItemsRow, error)

func (*Queries) SoftDeleteAutomationRule 

func (q *Queries) SoftDeleteAutomationRule(ctx context.Context, arg SoftDeleteAutomationRuleParams) (int64, error)

The rule stops matching anything at once and leaves the listing; its runs stay readable.

Also switched off, rather than left enabled behind the tombstone. Every read here filters on `deleted_at IS NULL` so nothing would find it either way, but a row that says `enabled = true` and is never enabled again is a row that reads as a lie to whoever opens the table next.

func (*Queries) SoftDeleteCustomField 

func (q *Queries) SoftDeleteCustomField(ctx context.Context, arg SoftDeleteCustomFieldParams) (int64, error)

A soft delete. The values stay in the entries and stop being visible: rewriting `custom_fields` across every entry in a collection would be an unbounded write from one request, and a definition recreated under the same key must not resurrect what the old one held - which the partial unique index makes possible by ignoring the deleted row.

func (*Queries) SpendAccountPending 

func (q *Queries) SpendAccountPending(ctx context.Context, arg SpendAccountPendingParams) (int64, error)

Every unfinished step of the account, whatever its purpose: a change-step credential won with the old start password must not set a password after the new one was issued.

func (*Queries) StampFieldClock 

func (q *Queries) StampFieldClock(ctx context.Context, arg StampFieldClockParams) error

The clock per field (offline-sync.md §4.2): the reading of the write that landed, which a push's reading is compared against per field. The reading of the write that landed replaces what stood: the writer decided, and the row records the decision. A guard that kept an older row would let a device outvote an edit made after it by a clock that was merely ahead.

func (*Queries) StandingWithdrawals 

func (q *Queries) StandingWithdrawals(ctx context.Context, purpose string) ([]StandingWithdrawalsRow, error)

The people whose newest record for one purpose is a withdrawal: who keeps their content out of AI, for the consent register and for the prompt builder alike. The newest record decides, so a consent given again after a withdrawal ends it. The names and addresses are what the prompt builder replaces in what remains; the register answers only the name.

func (*Queries) StartMfaReplacement 

func (q *Queries) StartMfaReplacement(ctx context.Context, arg StartMfaReplacementParams) (int64, error)

The new secret beside the armed one: only an armed enrolment takes a replacement - an unconfirmed one is replaced by enrolling again - and a replacement begun earlier is overwritten, the latest start being the one the person is looking at.

func (*Queries) StartRetentionRun 

func (q *Queries) StartRetentionRun(ctx context.Context, arg StartRetentionRunParams) error

The log of one run, opened before it does anything.

Opened first and closed afterwards rather than written once at the end, so that a run killed halfway leaves a row saying RUNNING with no finish. That is the state an operator needs to see: a deletion run that vanished without trace is indistinguishable from one that never started.

`policy_id` stays null. A trash period is keyed on (tenant, data kind) rather than by an identifier of its own.

The phase is EXECUTE and not MARK. For the trash the grace period ADR-0020 §3 asks for is the trash itself: the object is visible, it can be taken out, and it has a date - so a MARK pass would be a second grace period on top of a grace period. MARK belongs to the data kinds that have no trash of their own.

func (*Queries) StarterPending 

func (q *Queries) StarterPending(ctx context.Context) (bool, error)

The first start's question (UC-WRK-30 check 5): asked once, while nobody has made anything in the workspace yet. The tenant is the transaction's own, as everywhere: current_tenant_id(). The hub and collection a workspace is created with (multi-tenancy.md §5) are written in the tenant row's own moment, so a container from any other moment, or any entry, is something somebody made. Trashed and archived ones count: a workspace that ever held one is not new.

func (*Queries) SubjectAccountExists 

func (q *Queries) SubjectAccountExists(ctx context.Context, accountID pgtype.UUID) (bool, error)

Whether the recovered workspace has the account an erasure is about. One created after the recovery point went with the rewind, and there is nothing of it to erase.

func (*Queries) SubjectTenants 

func (q *Queries) SubjectTenants(ctx context.Context, subjectEmail string) ([]pgtype.UUID, error)

The workspaces of this installation in which one person is a member.

The one cross-tenant question in the system (data-protection.md §4), answered by a function that returns tenant identifiers and nothing else - never a name, never a row of anybody's data. What follows is one ordinary transaction per tenant, under that tenant's own context (db/migrations/0044_privacy_requests.sql).

func (*Queries) SubscriptionsForEventType 

func (q *Queries) SubscriptionsForEventType(ctx context.Context, eventType string) ([]SubscriptionsForEventTypeRow, error)

What the dispatcher asks per event: the active subscriptions that named this type.

Filtered in the database rather than in the process, because the alternative is reading every subscription of the tenant on every event. The array containment is what the whole shape of `event_types` is for.

func (*Queries) SubtreeOfWorkItem 

func (q *Queries) SubtreeOfWorkItem(ctx context.Context, arg SubtreeOfWorkItemParams) ([]SubtreeOfWorkItemRow, error)

Everything below one entry, the entry itself excluded: what a copy of a subtree reads before it writes anything.

The prefix match is MoveWorkItemSubtree's, and for the same reasons: every descendant's path begins with the entry's own, `LIKE prefix || '%'` is the form wi_path_idx (tenant_id, path text_pattern_ops) serves as an index scan, and a path built from UUIDs and separators can hold no LIKE metacharacter. The entry itself matches its own prefix and is excluded, because the caller already holds it and copies it under rules of its own.

Trashed rows are left out. They are on their way out of the system, and a copy that carried them would put back what somebody deleted; an archived one is copied, because it is a place rather than a deletion and the copy keeps it.

Ordered by depth first, so that a caller walking the rows always meets a parent before its children and can carry the mapping from old identifier to new one forwards in one pass. The rank decides within a level, in byte order, exactly as every other ordered read of this table (ADR-0022): a rank is a fractional index and the database's collation would compare it as words.

The limit is the caller's bound rather than a page: a copy is one transaction, and a subtree larger than the caller allows is refused rather than copied halfway. One row beyond the bound is read on purpose, so that "too large" is distinguishable from "exactly at the bound".

func (*Queries) SumTenantMediaBytes 

func (q *Queries) SumTenantMediaBytes(ctx context.Context) (int64, error)

Soft-deleted objects excluded: their bytes are the reconciliation job's to reclaim, not the workspace's to answer for.

func (*Queries) SumTenantUsageSince 

func (q *Queries) SumTenantUsageSince(ctx context.Context, arg SumTenantUsageSinceParams) (int64, error)

What the workspace has spent on one metered thing since a day.

The ledger as an enforcement source, which the statement below is at pains to say it is not - and the exception is the point rather than an oversight. `usage_record` is barred elsewhere because it is a lagging copy of something countable: items are in `work_item`, media in `media_object`. A token has no row. It was spent on somebody else's machine and this tally *is* the record, so there is nothing more authoritative to count.

func (*Queries) SupersedePasskeyChallenges 

func (q *Queries) SupersedePasskeyChallenges(ctx context.Context, arg SupersedePasskeyChallengesParams) error

The newest start wins: an older challenge of the account is spent, so it finishes nothing.

func (*Queries) SupersedePending 

func (q *Queries) SupersedePending(ctx context.Context, arg SupersedePendingParams) (int64, error)

A new credential of a purpose replaces the account's earlier unspent ones (UC-ID-04 check 2: a second reset request replaces the first link instead of adding one). Spent rather than deleted, so a link that arrives late is refused as any spent one is.

func (*Queries) SwapMfaReplacement 

func (q *Queries) SwapMfaReplacement(ctx context.Context, arg SwapMfaReplacementParams) (int64, error)

The swap, in one statement: the replacement becomes the armed secret and the old one is gone, with the confirming step as the new replay floor. Only for the session that began it, inside its window, and only if the replacement is still the very secret the confirmation verified - a second start in between would otherwise arm a secret nobody proved.

func (*Queries) SweepUsage 

func (q *Queries) SweepUsage(ctx context.Context, beforeDay pgtype.Date) (int64, error)

The scheduler leader's daily sweep (migration 0183): counts older than the day go, inside workspaces and in the installation's ledger.

func (*Queries) TakeBackKudos 

func (q *Queries) TakeBackKudos(ctx context.Context, arg TakeBackKudosParams) (int64, error)

func (*Queries) TakeMailboxAuthorization 

func (q *Queries) TakeMailboxAuthorization(ctx context.Context, stateHash []byte) (TakeMailboxAuthorizationRow, error)

Used once: the row is gone whatever the provider answered.

func (*Queries) TakeMediaOrphans 

func (q *Queries) TakeMediaOrphans(ctx context.Context, arg TakeMediaOrphansParams) ([]TakeMediaOrphansRow, error)

The third pass: marked rows past their grace, handed to the purge job. The keys travel in the job's payload, so the byte deletion needs no transaction of its own to find them.

func (*Queries) TallyItems 

func (q *Queries) TallyItems(ctx context.Context, itemIds []pgtype.UUID) ([]TallyItemsRow, error)

What a card and a row say about an entry beside its own fields, for a page of entries in one statement: what `expand=counts` needs. Its parts (the direct children) and how many are done, what people wrote on it, and what is attached to it.

Only what a reader would find: parts in the trash are left out, comments the server filed (`kind = 'SYSTEM'`) and deleted ones are not counted, and an attachment whose object is gone is not one. Every count is a correlated subquery over an index the table already has (`wi_parent_idx`, `comment_item_idx`, the attachment's primary key), so a page of fifty costs fifty index probes per count and no scan.

func (*Queries) TemplateExists 

func (q *Queries) TemplateExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) TenantQuotaOverrides 

func (q *Queries) TenantQuotaOverrides(ctx context.Context) (TenantQuotaOverridesRow, error)

The §4 limits (multi-tenancy.md): the overrides in the tenant's own settings document, the live counts the capacity quotas are measured against, and the billing ledger's first writer. Every statement is bounded to the transaction's tenant by row level security; the one naming a tenant column explicitly says why in place. The quotas key of the settings document, whole: the adapter parses it, the application layer never learns the document's shape (TenantPolicy's discipline). Beside it the workspace's own AI budget, which lives outside that key because the operator's write replaces the key whole.

func (*Queries) TenantSettings 

func (q *Queries) TenantSettings(ctx context.Context) ([]byte, error)

The tenant's own row, reachable under its own policy: the enforcement switch lives in the settings document (multi-tenancy.md §4's home for per-tenant knobs).

func (*Queries) TenantTimeZone 

func (q *Queries) TenantTimeZone(ctx context.Context) (string, error)

The zone the workspace's AI budget's day ends in (UC-AI-07 check 2).

func (*Queries) TouchAccessToken 

func (q *Queries) TouchAccessToken(ctx context.Context, arg TouchAccessTokenParams) error

func (*Queries) TouchDevice 

func (q *Queries) TouchDevice(ctx context.Context, arg TouchDeviceParams) (TouchDeviceRow, error)

The devices (offline-sync.md §6, §10). Registration and every contact after it in one statement. The insert is the registration; the update is the contact, and it is refused - no row comes back - when the identifier belongs to another account or the device was forgotten, which the adapter then tells apart. What the device said about itself replaces what stood; what it left out leaves it alone.

func (*Queries) TouchSession 

func (q *Queries) TouchSession(ctx context.Context, arg TouchSessionParams) error

func (*Queries) TrashBatchMembers 

func (q *Queries) TrashBatchMembers(ctx context.Context, batchIds []pgtype.UUID) ([]TrashBatchMembersRow, error)

Every row still in the trash that one of these deletions took, the root included, with the levels a legal hold could name it by: an entry's hub, collection and path, a container's hub.

Read for the trash list, which says whether a hold keeps a deletion by judging each of its rows as the retention pass does (`lifecycle.Holds.Blocking`). The tenant is the transaction's, as row level security has it; naming it again keeps the partial trash indices in play.

func (*Queries) TrashCollectionsOfHub 

func (q *Queries) TrashCollectionsOfHub(ctx context.Context, arg TrashCollectionsOfHubParams) ([]pgtype.UUID, error)

A hub's collections go into the trash with it, under the same batch (I-C2).

It returns the identifiers rather than a count, because they are needed twice afterwards: the items of those collections are the next statement's argument, and each collection is announced separately to offline clients - a device that subscribes to one collection rather than to the hub would otherwise never learn that its collection is gone (offline-sync.md §3.1).

`deleted_at IS NULL` for the reason it is on the item statement: a collection already in the trash keeps its own deletion, and is therefore not in this batch and not in this answer.

func (*Queries) TrashItemsForRetention 

func (q *Queries) TrashItemsForRetention(ctx context.Context, arg TrashItemsForRetentionParams) (int64, error)

The act of a TRASH stage. The batch identifier is what makes one act one restore (F-09).

func (*Queries) TrashItemsOfCollections 

func (q *Queries) TrashItemsOfCollections(ctx context.Context, arg TrashItemsOfCollectionsParams) (int64, error)

Every item of the collections a container's deletion covers, under the same batch.

The whole of each collection in one statement, at every level: an item's collection is denormalised onto every row of its subtree (domain-model.md §3.4), so there is no walk to do here - which is what keeps deleting a hub a fixed number of statements rather than one per level.

func (*Queries) TrashKeptBelow 

func (q *Queries) TrashKeptBelow(ctx context.Context, arg TrashKeptBelowParams) ([]TrashKeptBelowRow, error)

What stays below each of these when a purge removes only the rows it was handed (data-retention.md §4 item 6): an entry's descendants, a collection's entries, a hub's collections and their entries - each one that is not in `going`.

Asked before the rows go, because both cascades would otherwise take what stays: `work_item.parent_id` and `work_item.collection_id` are ON DELETE CASCADE, so a parent or a collection removed while a held child is still there takes the child with it, uncounted and unrecorded. One row per kind of thing below; the caller adds them up.

func (*Queries) TrashWorkItemDescendants 

func (q *Queries) TrashWorkItemDescendants(ctx context.Context, arg TrashWorkItemDescendantsParams) (int64, error)

Everything below one item goes into the trash with it, under the same batch.

`LIKE prefix || '%'` rather than starts_with, because that is the form wi_path_idx (tenant_id, path text_pattern_ops) serves as an index scan. A path is built from UUIDs and separators, so there is nothing in the data for a `%` or a `_` to do.

`deleted_at IS NULL` is the whole of invariant I-C2's second half: a descendant already in the trash from an earlier, separate deletion keeps that deletion. Adopting it into this batch would restart its retention period and make a restore of this batch bring back something nobody deleted this time.

func (*Queries) TrimPasswordHistory 

func (q *Queries) TrimPasswordHistory(ctx context.Context, arg TrimPasswordHistoryParams) error

Everything past the newest `keep`, dropped in the same transaction as the append - so the table cannot grow past the policy even after the policy is lowered.

func (*Queries) UnlinkAccountIdentities 

func (q *Queries) UnlinkAccountIdentities(ctx context.Context, accountID pgtype.UUID) (int64, error)

Every provider identity of one account (ADR-0078 §1): an invited account is activated only with a second proof, and what was connected to it before that proof is dropped in the activation's transaction. Row level security keeps it to this workspace's accounts.

func (*Queries) UpdateAccountPreferences 

func (q *Queries) UpdateAccountPreferences(ctx context.Context, arg UpdateAccountPreferencesParams) (int64, error)

The preference columns and no others. An update that could write any column is one that can write the status by accident, and the status is what decides whether an account may act at all.

func (*Queries) UpdateAutomationRule 

func (q *Queries) UpdateAutomationRule(ctx context.Context, arg UpdateAutomationRuleParams) (int64, error)

The whole definition at once, and the version guard in the WHERE.

The guard is here rather than in a read-then-write, because a check in the application layer is a check something else can commit between: two writers that both read version 3 would both find it current and the second would overwrite the first. `execrows` returning zero is what "somebody got there first" looks like from a statement that cannot be raced.

func (*Queries) UpdateBackupSchedule 

func (q *Queries) UpdateBackupSchedule(ctx context.Context, arg UpdateBackupScheduleParams) (int64, error)

The lifecycle: a schedule that can be changed and removed, and a target that can be removed once nothing points at it. Everything a schedule may change, plus the moment it is next owed, guarded on the row version. The target and the scope are not among the columns: a schedule that moved either would be a different schedule under an old identifier.

func (*Queries) UpdateCustomField 

func (q *Queries) UpdateCustomField(ctx context.Context, arg UpdateCustomFieldParams) (int64, error)

What an edit may change, under the optimistic lock every editable row takes. The key and the kind are not in the statement at all: a key that moved would orphan every value stored under it, and a kind that changed would reinterpret them.

func (*Queries) UpdateDataSubjectRequest 

func (q *Queries) UpdateDataSubjectRequest(ctx context.Context, arg UpdateDataSubjectRequestParams) (int64, error)

The whole case as the domain decided it, written back in one statement.

Every column the state machine can move is here and no others: a case carries a person's request and the answer to it, and an update that could write `received_at` or the subject would be one that can rewrite what somebody asked for.

func (*Queries) UpdateGroup 

func (q *Queries) UpdateGroup(ctx context.Context, arg UpdateGroupParams) (int64, error)

Optimistic locking in the WHERE clause: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md).

func (*Queries) UpdateIdentityProvider 

func (q *Queries) UpdateIdentityProvider(ctx context.Context, arg UpdateIdentityProviderParams) (UpdateIdentityProviderRow, error)

Set whole, not patched: a provider half-changed is a provider nobody can reason about. The secret is the one exception and the reason is that there is no way to read it back - a caller that sent none means "keep the one that is sealed", and COALESCE is what says so in a single statement rather than a read-then-write two sign-ins could interleave.

The version rises on every write, so a concurrent second configuration is visible as a conflict.

A NULL `enabled` leaves the switch as the row holds it (ADR-0076 §5): a workspace's own form configures and never switches, and saying so in the statement is what keeps a save from writing back a switch the list of ways to sign in changed a moment earlier.

func (*Queries) UpdateInstallationPreset 

func (q *Queries) UpdateInstallationPreset(ctx context.Context, arg UpdateInstallationPresetParams) (int64, error)

Writes a preset whole under the expected version; none expected writes whatever stands - the instance file, which is the source.

func (*Queries) UpdateOfferedAiProvider 

func (q *Queries) UpdateOfferedAiProvider(ctx context.Context, arg UpdateOfferedAiProviderParams) (UpdateOfferedAiProviderRow, error)

Set whole, as the workspace's own row is, with the key replaced (NULL clears it).

func (*Queries) UpdateOfferedAiProviderKeepingKey 

func (q *Queries) UpdateOfferedAiProviderKeepingKey(ctx context.Context, arg UpdateOfferedAiProviderKeepingKeyParams) (UpdateOfferedAiProviderKeepingKeyRow, error)

func (*Queries) UpdatePlan 

func (q *Queries) UpdatePlan(ctx context.Context, arg UpdatePlanParams) (int64, error)

The plan's own row, guarded on the version read: zero rows means somebody saved first, or the plan is gone.

func (*Queries) UpdatePlatformSubscription 

func (q *Queries) UpdatePlatformSubscription(ctx context.Context, arg UpdatePlatformSubscriptionParams) (int64, error)

Guarded on the version read: a change made on stale values is refused, not applied over another.

func (*Queries) UpdateRecurrenceRule 

func (q *Queries) UpdateRecurrenceRule(ctx context.Context, arg UpdateRecurrenceRuleParams) (int64, error)

The whole document, under the same optimistic lock every other row takes (api-guidelines.md §5). A series is one statement rather than six settings, which is why there is no per-column writer: "every Monday in Berlin, on completion, ninety days ahead" is a sentence, and half of it is a different one.

last_materialized_at is deliberately untouched. It is the materialisation's own bookkeeping, and a rule that changed does not un-create the occurrences that already exist.

func (*Queries) UpdateReminder 

func (q *Queries) UpdateReminder(ctx context.Context, arg UpdateReminderParams) (int64, error)

The edit, under the same optimistic lock every other row takes (api-guidelines.md §5). The state is in the guard rather than trusted to the caller's read: a reminder that fired while the edit was being written must lose to the firing rather than be given a new moment afterwards.

func (*Queries) UpdateRetentionRule 

func (q *Queries) UpdateRetentionRule(ctx context.Context, arg UpdateRetentionRuleParams) (int64, error)

The lifecycle: a rule that deletes data has to be correctable and withdrawable. Everything a rule may change, guarded on the row version. The kind and the scope are not among the columns: the unique index over the pair is what makes "the rule for this kind at this level" a thing one can name, and a rule that moved either would be a different rule under an old identifier.

func (*Queries) UpdateStructurePreset 

func (q *Queries) UpdateStructurePreset(ctx context.Context, arg UpdateStructurePresetParams) (int64, error)

func (*Queries) UpdateTemplate 

func (q *Queries) UpdateTemplate(ctx context.Context, arg UpdateTemplateParams) (int64, error)

The whole document, under the same optimistic lock every other row takes (api-guidelines.md §5). The scope and the root type are not here on purpose: a template that changed scope would move out from under the people who could use it, and one whose root type changed would produce a different kind of thing under the same name.

func (*Queries) UpdateWebhookSubscription 

func (q *Queries) UpdateWebhookSubscription(ctx context.Context, arg UpdateWebhookSubscriptionParams) (int64, error)

Optimistic locking in the WHERE clause: the update matches nothing when somebody else has moved the row on, and the caller learns that rather than overwriting them (api-guidelines.md).

func (*Queries) UpdateWorkspace 

func (q *Queries) UpdateWorkspace(ctx context.Context, arg UpdateWorkspaceParams) (int64, error)

The three columns and the settings keys this build models, guarded on the row version so that two administrators changing one workspace see each other. The settings document is merged rather than replaced: `||` keeps every key this version does not know, which is what stops an older binary from discarding what a newer one wrote.

func (*Queries) UpsertAiProvider 

func (q *Queries) UpsertAiProvider(ctx context.Context, arg UpsertAiProviderParams) (UpsertAiProviderRow, error)

The workspace's AI provider, and the models the installation offers (ADR-0072).

Every statement here runs inside the transaction wrapper that sets `app.tenant_id`, so the policy underneath answers "which workspace" - `current_tenant_id()` is written on insert rather than passed in, the way every tenant-scoped insert in this schema is.

The read policy also admits the installation's offered rows (migration 0129), so every statement about the workspace's own row names it: `tenant_id = current_tenant_id()`. Without that, a read answering one row could answer an offered one, and a delete could reach for it. Set whole, not patched: a provider half-changed is one nobody can reason about, and the endpoint, the models and the key have to agree with each other. The version rises on every write, so a concurrent second configuration is visible as a conflict.

func (*Queries) UpsertAiProviderKeepingKey 

func (q *Queries) UpsertAiProviderKeepingKey(ctx context.Context, arg UpsertAiProviderKeepingKeyParams) (UpsertAiProviderKeepingKeyRow, error)

The same write with the stored envelope left where it is, for a caller who changed a model and sent no key. Its own statement rather than a branch inside the one above, because "keep what is there" and "store this" are different intentions and a NULL cannot carry both.

func (*Queries) UpsertAiSource 

func (q *Queries) UpsertAiSource(ctx context.Context, arg UpsertAiSourceParams) (AiSource, error)

The version rises on every write, so two administrators choosing at once are both in the trail and the later one stands.

func (*Queries) UpsertAuthAttempt 

func (q *Queries) UpsertAuthAttempt(ctx context.Context, arg UpsertAuthAttemptParams) error

The counter and the moment are computed by the caller from what it read: the delay curve is the domain's, and a statement that computed it would be policy in SQL.

func (*Queries) UpsertAutoAssignPolicy 

func (q *Queries) UpsertAutoAssignPolicy(ctx context.Context, arg UpsertAutoAssignPolicyParams) error

The whole definition in one statement, because the caller holds PUT semantics: the policies document arrives complete, so the row it maps to is written complete. A rewrite resets the state - the rotation belongs to the pool that was configured, and a new pool starts at its head rather than at an index into a list that no longer exists.

func (*Queries) UpsertErasureKept 

func (q *Queries) UpsertErasureKept(ctx context.Context, arg UpsertErasureKeptParams) error

What one hold keeps for one case, now. A row that was erased or blocked and keeps something again is pending again; when it was first recorded stays.

func (*Queries) UpsertMailSetting 

func (q *Queries) UpsertMailSetting(ctx context.Context, arg UpsertMailSettingParams) error

func (*Queries) UpsertMfaEnrollment 

func (q *Queries) UpsertMfaEnrollment(ctx context.Context, arg UpsertMfaEnrollmentParams) (int64, error)

============================ The second factor ============================ A fresh enrolment, or the replacement of an unconfirmed one. An armed enrolment matches nothing - zero rows is the "disable first, with the password" refusal - so a stolen session cannot quietly swap the secret out from under the real authenticator.

func (*Queries) UpsertOauthGrant 

func (q *Queries) UpsertOauthGrant(ctx context.Context, arg UpsertOauthGrantParams) (pgtype.UUID, error)

One live grant per person and app: a fresh consent is the newest answer and replaces the scopes, rather than accumulating every set ever agreed to.

func (*Queries) UpsertRuleOccurrence 

func (q *Queries) UpsertRuleOccurrence(ctx context.Context, arg UpsertRuleOccurrenceParams) error

The RELATIVE_DATE trigger's occurrences (automation.md §1.1). The reminder's shape: a row per (rule, entry) saying when this rule owes that entry a run, moved when the anchor moves and gone when the anchor is cleared. Writes or moves the moment one rule owes for one entry.

An upsert rather than a delete-then-insert, because "the due date moved" is one fact: two statements would leave a window in which the tenant owed nothing, and a pass committing in that window would answer the wrong next moment.

func (*Queries) UpsertVoiceSetting 

func (q *Queries) UpsertVoiceSetting(ctx context.Context, arg UpsertVoiceSettingParams) error

func (*Queries) WalkAuditEntries 

func (q *Queries) WalkAuditEntries(ctx context.Context, arg WalkAuditEntriesParams) ([]AuditLog, error)

One batch of the trail over a period, oldest first, for a verification or an export.

Ascending, because both callers walk the chain rather than read a screen: the chain is built forwards, and a verifier that met the entries newest first would have to hold the whole period in memory before it could check the first link.

Ordered by `seq`, which is what the chain is built over - **not** by `occurred_at`. Every caller takes its own clock reading before it queues for the chain's lock, so two entries can carry timestamps in the opposite order to their sequence numbers. A walk in timestamp order then meets the chain out of order and reports a hash mismatch and a screenful of gaps for a trail that is perfectly intact. The period still selects by `occurred_at` - that is what an operator asks for, and it is what prunes the partitions - and only the order changes.

Its own statement rather than a direction parameter on the list. A direction that decides an ORDER BY is either two statements behind one name or a string somebody assembles, and the second of those is what rule 9 forbids.

func (*Queries) WebhookDeliveries 

func (q *Queries) WebhookDeliveries(ctx context.Context, arg WebhookDeliveriesParams) ([]WebhookDelivery, error)

One subscription's attempts, newest first, optionally narrowed to one outcome - DEAD_LETTER is the one an operator usually wants. The cursor is the identifier, which is time-ordered.

func (*Queries) WebhookSubscriptionExists 

func (q *Queries) WebhookSubscriptionExists(ctx context.Context, id pgtype.UUID) (bool, error)

func (*Queries) WebhookSubscriptionsSealedNotUnder 

func (q *Queries) WebhookSubscriptionsSealedNotUnder(ctx context.Context, keyID *string) ([]WebhookSubscriptionsSealedNotUnderRow, error)

The rows a re-seal visits (ADR-0045): a subscription whose current or previous secret names a key other than the current one. Both, because a grace that outlives a rotation is still a secret the verifier has to open.

func (*Queries) WithTx 

func (q *Queries) WithTx(tx pgx.Tx) *Queries

func (*Queries) WorkItemSubtreeIDs 

func (q *Queries) WorkItemSubtreeIDs(ctx context.Context, prefix string) ([]pgtype.UUID, error)

Every identifier in one item's subtree, the item included, oldest path first.

Read before a hard delete rather than derived from it: each row that goes needs a tombstone and a journal entry of its own (offline-sync.md §7, data-retention.md §5), and a cascade that removed them silently would leave a device free to recreate a purged entry on its next push.

func (*Queries) WorkItemTypes 

func (q *Queries) WorkItemTypes(ctx context.Context, ids []pgtype.UUID) ([]WorkItemTypesRow, error)

The type of each entry among ids, and nothing else: what a collection hides of an entry depends on the levels above it (domain-model.md §2), and a page of entries asks for every ancestor on it in this one statement rather than reading whole rows. An identifier of another tenant is absent, by the predicate and by row level security.

func (*Queries) WorkspaceLeaving 

func (q *Queries) WorkspaceLeaving(ctx context.Context) (bool, error)

Whether the transaction's workspace is pending deletion: placing a hold asks it after the exclusive hold lock (data-protection.md §5).

func (*Queries) WorkspaceOwnerPaths 

func (q *Queries) WorkspaceOwnerPaths(ctx context.Context) ([]WorkspaceOwnerPathsRow, error)

Every way a person holds OWNER on the workspace: a grant of their own, or a grant to a group they are in. Only a person who can act counts - a USER, active or restricted, not deleted - so an invitation never redeemed or an erased account does not keep the workspace administered. One row per grant and account; the tenant boundary is the transaction's (ADR-0010).

func (*Queries) WorkspaceOwners 

func (q *Queries) WorkspaceOwners(ctx context.Context) ([]pgtype.UUID, error)

The persons holding OWNER on the workspace itself, directly or through a group, who can still be told something: told when a private hub lost its last member (ADR-0073 §5).

type QueryTenantsParams 

type QueryTenantsParams struct {
	WantID          pgtype.UUID
	WantSlug        *string
	WantReference   *string
	WantPlan        *string
	WantWithoutPlan *bool
	WantStatus      *string
	AfterAt         pgtype.Timestamptz
	AfterID         pgtype.UUID
	PageSize        int32
}

type QueryTenantsRow 

type QueryTenantsRow struct {
	ID                      pgtype.UUID
	Slug                    string
	DisplayName             string
	Status                  string
	DefaultLocale           string
	DefaultTimeZone         string
	CreatedAt               pgtype.Timestamptz
	PurgeAfter              pgtype.Timestamptz
	PasswordOpenedUntil     pgtype.Timestamptz
	PasswordOpenedRequester string
	PasswordOpenedReason    string
	LegalHold               bool
	PurgeStartedAt          pgtype.Timestamptz
	PlanName                string
	Version                 int32
	ExternalReference       string
}

type QuotaReached 

type QuotaReached struct {
	TenantID  pgtype.UUID
	Quota     string
	Period    string
	ReachedAt pgtype.Timestamptz
}

type QuotaReachedMarkedAtParams 

type QuotaReachedMarkedAtParams struct {
	Quota  string
	Period string
}

type ReadChangesAfterParams 

type ReadChangesAfterParams struct {
	After int64
	Batch int32
}

type ReadChangesAfterRow 

type ReadChangesAfterRow struct {
	Seq         int64
	Entity      string
	EntityID    pgtype.UUID
	Op          string
	ContainerID pgtype.UUID
	ActorID     pgtype.UUID
	DeviceID    pgtype.UUID
	Hlc         string
	OccurredAt  pgtype.Timestamptz
	Payload     []byte
}

type RecentMailReceiptsRow 

type RecentMailReceiptsRow struct {
	ID         pgtype.UUID
	MessageID  string
	ReceivedAt pgtype.Timestamptz
	Sender     string
	Subject    string
	Outcome    string
	Reason     string
	ItemID     pgtype.UUID
	EntryID    pgtype.UUID
	Door       string
}

type RecentPasswordHashesParams 

type RecentPasswordHashesParams struct {
	AccountID pgtype.UUID
	Depth     int32
}

type RecordActivityParams 

type RecordActivityParams struct {
	ID          pgtype.UUID
	ItemID      pgtype.UUID
	ContainerID pgtype.UUID
	ActorType   string
	ActorID     pgtype.UUID
	Verb        string
	ChangeSet   []byte
	OccurredAt  pgtype.Timestamptz
}

type RecordAiNoticeParams 

type RecordAiNoticeParams struct {
	AccountID pgtype.UUID
	NoticedAt pgtype.Timestamptz
}

type RecordAuditAnchorParams 

type RecordAuditAnchorParams struct {
	AnchoredAt  pgtype.Timestamptz
	LastSeq     int64
	ChainHash   []byte
	Destination *string
	Receipt     *string
}

type RecordAutomationRuleCheckParams 

type RecordAutomationRuleCheckParams struct {
	Findings []byte
	At       pgtype.Timestamptz
	ID       pgtype.UUID
}

type RecordBackupTargetTestParams 

type RecordBackupTargetTestParams struct {
	TestedAt  pgtype.Timestamptz
	Succeeded *bool
	ErrorCode *string
	ID        pgtype.UUID
}

type RecordBackupVerificationParams 

type RecordBackupVerificationParams struct {
	VerifiedAt pgtype.Timestamptz
	VerifyOk   *bool
	ID         pgtype.UUID
}

type RecordChangeParams 

type RecordChangeParams struct {
	Entity      string
	EntityID    pgtype.UUID
	Op          string
	ContainerID pgtype.UUID
	ActorID     pgtype.UUID
	DeviceID    pgtype.UUID
	Hlc         string
	OccurredAt  pgtype.Timestamptz
	Payload     []byte
}

type RecordCollectionMilestoneParams 

type RecordCollectionMilestoneParams struct {
	CollectionID pgtype.UUID
	ReachedAt    pgtype.Timestamptz
}

type RecordDeletionsParams 

type RecordDeletionsParams struct {
	Entity    string
	DeletedAt pgtype.Timestamptz
	Reason    string
	EntityIds []pgtype.UUID
}

type RecordHubMilestoneParams 

type RecordHubMilestoneParams struct {
	HubID     pgtype.UUID
	ReachedAt pgtype.Timestamptz
}

type RecordImportProgressParams 

type RecordImportProgressParams struct {
	Report   []byte
	Progress []byte
	ID       pgtype.UUID
}

type RecordMfaStepParams 

type RecordMfaStepParams struct {
	Step      *int64
	Now       pgtype.Timestamptz
	AccountID pgtype.UUID
}

type RecordPlatformDeliveryAttemptParams 

type RecordPlatformDeliveryAttemptParams struct {
	Attempt        int32
	Status         string
	ResponseStatus *int32
	ErrorCode      *string
	NextAttemptAt  pgtype.Timestamptz
	Now            pgtype.Timestamptz
	ID             pgtype.UUID
}

type RecordPlatformSubscriptionOutcomeParams 

type RecordPlatformSubscriptionOutcomeParams struct {
	DeliveredAt pgtype.Timestamptz
	LastError   *string
	ID          pgtype.UUID
}

type RecordRestoreProgressParams 

type RecordRestoreProgressParams struct {
	Report   []byte
	Progress []byte
	ID       pgtype.UUID
}

type RecordRestoreSafetyCopyParams 

type RecordRestoreSafetyCopyParams struct {
	SafetyBackupRunID pgtype.UUID
	ID                pgtype.UUID
}

type RecordRuleFailureParams 

type RecordRuleFailureParams struct {
	Code *string
	At   pgtype.Timestamptz
	ID   pgtype.UUID
}

type RecordSetElementAddedParams 

type RecordSetElementAddedParams struct {
	ItemID    pgtype.UUID
	SetName   string
	ElementID pgtype.UUID
	Tag       *string
}

type RecordSetElementRemovedParams 

type RecordSetElementRemovedParams struct {
	ItemID    pgtype.UUID
	SetName   string
	ElementID pgtype.UUID
	Tag       *string
}

type RecordStepUpParams 

type RecordStepUpParams struct {
	TokenHash []byte
	Now       pgtype.Timestamptz
	Method    *string
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type RecordSuggestionParams 

type RecordSuggestionParams struct {
	ID            pgtype.UUID
	TargetType    string
	TargetID      pgtype.UUID
	Kind          string
	Payload       []byte
	Source        string
	Model         string
	PromptID      string
	PromptVersion string
	ProducedAt    pgtype.Timestamptz
	InputDigest   []byte
	CreatedAt     pgtype.Timestamptz
	DroppedNodes  int32
}

type RecordSyncOpParams 

type RecordSyncOpParams struct {
	OpID      pgtype.UUID
	DeviceID  pgtype.UUID
	Result    string
	EntityID  pgtype.UUID
	AppliedAt pgtype.Timestamptz
	Response  []byte
}

type RecordTermsAgreementParams 

type RecordTermsAgreementParams struct {
	TermsUrl     *string
	TermsVersion *string
	At           pgtype.Timestamptz
	ID           pgtype.UUID
}

type RecordTombstonesParams 

type RecordTombstonesParams struct {
	Entity     string
	DeletedAt  pgtype.Timestamptz
	PurgeAfter pgtype.Timestamptz
	EntityIds  []pgtype.UUID
}

type RecordWebhookDeliveryOutcomeParams 

type RecordWebhookDeliveryOutcomeParams struct {
	Status         string
	ResponseStatus *int32
	ErrorCode      *string
	NextAttemptAt  pgtype.Timestamptz
	ID             pgtype.UUID
}

type RecoveredErasureCasesRow 

type RecoveredErasureCasesRow struct {
	ID               pgtype.UUID
	SubjectAccountID pgtype.UUID
	SubjectEmail     *string
	ErasureMode      *string
	ReceivedAt       pgtype.Timestamptz
	DueAt            pgtype.Timestamptz
	CompletedAt      pgtype.Timestamptz
	HandledBy        pgtype.UUID
	Notes            *string
	OriginalDueAt    pgtype.Timestamptz
	ExtensionReason  *string
	InformedOn       pgtype.Date
	ErasedAccounts   []pgtype.UUID
}

type RecoveredLegalHoldsRow 

type RecoveredLegalHoldsRow struct {
	ID             pgtype.UUID
	ScopeKind      string
	ScopeID        pgtype.UUID
	Reason         string
	PlacedBy       pgtype.UUID
	PlacedAt       pgtype.Timestamptz
	ReleasedBy     pgtype.UUID
	ReleasedAt     pgtype.Timestamptz
	ReleasedReason *string
}

type RecurrenceRule 

type RecurrenceRule struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	SourceItemID       pgtype.UUID
	Rrule              string
	TimeZone           string
	Mode               string
	HorizonDays        int32
	EndsAt             pgtype.Timestamptz
	MaxCount           *int32
	LastMaterializedAt pgtype.Timestamptz
	CreatedAt          pgtype.Timestamptz
	Version            int32
	UpdatedAt          pgtype.Timestamptz
}

type RedeemInvitationParams 

type RedeemInvitationParams struct {
	PasswordHash *string
	Now          pgtype.Timestamptz
	ID           pgtype.UUID
}

type RefuseJobParams 

type RefuseJobParams struct {
	Now             pgtype.Timestamptz
	LastError       *string
	LastErrorParams []byte
	ID              pgtype.UUID
	Lease           pgtype.Timestamptz
}

type RehashPasswordParams 

type RehashPasswordParams struct {
	Replacement *string
	At          pgtype.Timestamptz
	ID          pgtype.UUID
	Current     *string
}

type ReleaseIdempotencyKeyParams 

type ReleaseIdempotencyKeyParams struct {
	Key      string
	Endpoint string
}

type ReleaseLegalHoldParams 

type ReleaseLegalHoldParams struct {
	ReleasedBy     pgtype.UUID
	ReleasedAt     pgtype.Timestamptz
	ReleasedReason *string
	ID             pgtype.UUID
}

type Reminder 

type Reminder struct {
	ID         pgtype.UUID
	TenantID   pgtype.UUID
	ItemID     pgtype.UUID
	OffsetSpec string
	Channels   []string
	Recipients []pgtype.UUID
	State      string
	FireAt     pgtype.Timestamptz
	CreatedAt  pgtype.Timestamptz
	Version    int32
	UpdatedAt  pgtype.Timestamptz
}

type RemoveGroupMemberParams 

type RemoveGroupMemberParams struct {
	GroupID   pgtype.UUID
	AccountID pgtype.UUID
}

type RemoveItemLabelParams 

type RemoveItemLabelParams struct {
	ItemID  pgtype.UUID
	LabelID pgtype.UUID
}

type RemoveItemMemberParams 

type RemoveItemMemberParams struct {
	ItemID    pgtype.UUID
	AccountID pgtype.UUID
}

type RemovePasskeyParams 

type RemovePasskeyParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type RemovePlanParams 

type RemovePlanParams struct {
	ID    pgtype.UUID
	Now   pgtype.Timestamptz
	Actor pgtype.UUID
}

type RemoveTemplateParams 

type RemoveTemplateParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type RenameAccountParams 

type RenameAccountParams struct {
	DisplayName string
	UpdatedAt   pgtype.Timestamptz
	ID          pgtype.UUID
}

type RenamePasskeyParams 

type RenamePasskeyParams struct {
	Name      string
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type RepeatJobParams 

type RepeatJobParams struct {
	RunAt pgtype.Timestamptz
	ID    pgtype.UUID
	Lease pgtype.Timestamptz
}

type RepointWebhookDeliveryParams 

type RepointWebhookDeliveryParams struct {
	EventID pgtype.UUID
	ID      pgtype.UUID
}

type RequestTenantDeletionParams 

type RequestTenantDeletionParams struct {
	PurgeAfter pgtype.Timestamptz
	Now        pgtype.Timestamptz
}

type RequeueDeadPlatformDeliveriesParams 

type RequeueDeadPlatformDeliveriesParams struct {
	Now            pgtype.Timestamptz
	Round          int32
	SubscriptionID pgtype.UUID
	Batch          int32
}

type ResealMailboxParams 

type ResealMailboxParams struct {
	SecretEnc   []byte
	SecretKeyID string
	ID          pgtype.UUID
}

type ReserveIdempotencyKeyParams 

type ReserveIdempotencyKeyParams struct {
	Key         string
	Endpoint    string
	RequestHash []byte
}

type ResolveOperatorAccountParams 

type ResolveOperatorAccountParams struct {
	Slug  string
	Email string
}

type RestoreContainerBatchParams 

type RestoreContainerBatchParams struct {
	UpdatedAt    pgtype.Timestamptz
	TrashBatchID pgtype.UUID
	ContainerID  pgtype.UUID
}

type RestoreDrillMarker 

type RestoreDrillMarker struct {
	RunID     string
	Seq       int16
	WrittenAt pgtype.Timestamptz
}

type RestoreRun 

type RestoreRun struct {
	ID            pgtype.UUID
	TargetID      pgtype.UUID
	SourceArchive string
	// The tenant that asked for the restore, and the one the row is visible in (RLS).
	TenantID          pgtype.UUID
	Mode              string
	ConflictRule      string
	Selection         []byte
	DryRun            bool
	SafetyBackupRunID pgtype.UUID
	Status            string
	Report            []byte
	RequestedBy       pgtype.UUID
	ApprovedBy        pgtype.UUID
	StartedAt         pgtype.Timestamptz
	FinishedAt        pgtype.Timestamptz
	ErrorCode         *string
	// The tenant being restored into. Differs from tenant_id only for NEW_TENANT, and is NULL for an instance restore.
	TargetTenantID     pgtype.UUID
	CreateSafetyBackup bool
	Progress           []byte
}

type RestoreWorkItemBatchParams 

type RestoreWorkItemBatchParams struct {
	UpdatedAt    pgtype.Timestamptz
	TrashBatchID pgtype.UUID
	ItemID       pgtype.UUID
}

type RestrictedPeopleRow 

type RestrictedPeopleRow struct {
	AccountID   pgtype.UUID
	DisplayName string
	Email       *string
	SignInName  *string
}

type ResumePausedAutomationRuleParams 

type ResumePausedAutomationRuleParams struct {
	NextRunAt pgtype.Timestamptz
	At        pgtype.Timestamptz
	ID        pgtype.UUID
}

type RetentionCandidatesByArchivedAtParams 

type RetentionCandidatesByArchivedAtParams struct {
	Cutoff   pgtype.Timestamptz
	OwnChain bool
	RuleID   pgtype.UUID
	AfterAt  pgtype.Timestamptz
	AfterID  pgtype.UUID
	Batch    int32
}

type RetentionCandidatesByArchivedAtRow 

type RetentionCandidatesByArchivedAtRow struct {
	ID           pgtype.UUID
	Type         ItemType
	Path         string
	CollectionID pgtype.UUID
	HubID        pgtype.UUID
	AnchoredAt   pgtype.Timestamptz
	Title        string
}

type RetentionCandidatesByCompletedAtParams 

type RetentionCandidatesByCompletedAtParams struct {
	Cutoff  pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type RetentionCandidatesByCompletedAtRow 

type RetentionCandidatesByCompletedAtRow struct {
	ID           pgtype.UUID
	Type         ItemType
	Path         string
	CollectionID pgtype.UUID
	HubID        pgtype.UUID
	AnchoredAt   pgtype.Timestamptz
	Title        string
}

type RetentionCandidatesByDeletedAtParams 

type RetentionCandidatesByDeletedAtParams struct {
	Cutoff   pgtype.Timestamptz
	OwnChain bool
	RuleID   pgtype.UUID
	AfterAt  pgtype.Timestamptz
	AfterID  pgtype.UUID
	Batch    int32
}

type RetentionCandidatesByDeletedAtRow 

type RetentionCandidatesByDeletedAtRow struct {
	ID           pgtype.UUID
	Type         ItemType
	Path         string
	CollectionID pgtype.UUID
	HubID        pgtype.UUID
	AnchoredAt   pgtype.Timestamptz
	Title        string
}

type RetentionCursor 

type RetentionCursor struct {
	TenantID pgtype.UUID
	Reader   string
	DataKind *string
	RuleID   pgtype.UUID
	AfterAt  pgtype.Timestamptz
	AfterID  pgtype.UUID
}

type RetentionMarkedItemsDueParams 

type RetentionMarkedItemsDueParams struct {
	Now     pgtype.Timestamptz
	AfterAt pgtype.Timestamptz
	AfterID pgtype.UUID
	Batch   int32
}

type RetentionMarkedItemsDueRow 

type RetentionMarkedItemsDueRow struct {
	ID                    pgtype.UUID
	Type                  ItemType
	Path                  string
	CollectionID          pgtype.UUID
	HubID                 pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	Title                 string
}

type RetentionPolicy 

type RetentionPolicy struct {
	TenantID      pgtype.UUID
	DataKind      string
	RetainDays    int32
	MinDays       int32
	MaxDays       *int32
	Justification *string
	UpdatedAt     pgtype.Timestamptz
	UpdatedBy     pgtype.UUID
}

type RetentionRule 

type RetentionRule struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	ScopeKind       string
	ScopeID         pgtype.UUID
	DataKind        string
	Condition       *string
	RetainDays      int32
	Action          string
	ThenAfterDays   *int32
	ThenAction      *string
	GraceDays       int32
	Notify          []byte
	Justification   *string
	Enabled         bool
	ExportTargetID  pgtype.UUID
	CreatedBy       pgtype.UUID
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
	LastFailureCode *string
	LastFailureAt   pgtype.Timestamptz
}

type RetentionRun 

type RetentionRun struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	PolicyID       pgtype.UUID
	DataKind       string
	Phase          string
	Matched        int32
	Affected       int32
	Blocked        int32
	BlockedReasons []byte
	StartedAt      pgtype.Timestamptz
	FinishedAt     pgtype.Timestamptz
	Status         string
}

type RetryJobParams 

type RetryJobParams struct {
	RunAt     pgtype.Timestamptz
	LastError *string
	ID        pgtype.UUID
	Lease     pgtype.Timestamptz
}

type RevokeAccessTokenParams 

type RevokeAccessTokenParams struct {
	RevokedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type RevokeAllSessionsForAccountParams 

type RevokeAllSessionsForAccountParams struct {
	RevokedAt pgtype.Timestamptz
	AccountID pgtype.UUID
}

type RevokeCalendarFeedParams 

type RevokeCalendarFeedParams struct {
	RevokedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type RevokeConsentParams 

type RevokeConsentParams struct {
	RevokedAt pgtype.Timestamptz
	Purpose   string
	AccountID pgtype.UUID
}

type RevokeGrantSessionsParams 

type RevokeGrantSessionsParams struct {
	RevokedAt pgtype.Timestamptz
	GrantID   pgtype.UUID
}

type RevokeOauthGrantParams 

type RevokeOauthGrantParams struct {
	RevokedAt pgtype.Timestamptz
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type RevokeOtherSessionsForAccountParams 

type RevokeOtherSessionsForAccountParams struct {
	RevokedAt pgtype.Timestamptz
	AccountID pgtype.UUID
	Keep      pgtype.UUID
}

type RevokeSessionParams 

type RevokeSessionParams struct {
	RevokedAt pgtype.Timestamptz
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type RevokeSessionsOfStaleDevicesParams 

type RevokeSessionsOfStaleDevicesParams struct {
	Now    pgtype.Timestamptz
	Cutoff pgtype.Timestamptz
	Batch  int32
}

type RewrapAiProviderKeyParams 

type RewrapAiProviderKeyParams struct {
	ApiKeyEnc     []byte
	ApiKeyKeyID   *string
	ExpectedKeyID *string
}

type RewrapAutomationRuleActionsParams 

type RewrapAutomationRuleActionsParams struct {
	Actions         []byte
	ID              pgtype.UUID
	ExpectedVersion int32
}

type RewrapBackupTargetCredentialParams 

type RewrapBackupTargetCredentialParams struct {
	CredentialEnc   []byte
	CredentialKeyID *string
	ID              pgtype.UUID
	ExpectedKeyID   *string
}

type RewrapCallJobSecretParams 

type RewrapCallJobSecretParams struct {
	Sealed        []byte
	ID            pgtype.UUID
	ExpectedKeyID string
}

type RewrapIdentityProviderSecretParams 

type RewrapIdentityProviderSecretParams struct {
	ClientSecretEnc   []byte
	ClientSecretKeyID string
	ID                pgtype.UUID
	ExpectedKeyID     string
}

type RewrapMfaEnrollmentParams 

type RewrapMfaEnrollmentParams struct {
	SecretEnc     []byte
	SecretKeyID   string
	AccountID     pgtype.UUID
	ExpectedKeyID string
}

type RewrapMfaReplacementParams 

type RewrapMfaReplacementParams struct {
	SecretEnc     []byte
	SecretKeyID   *string
	AccountID     pgtype.UUID
	ExpectedKeyID *string
}

type RewrapOfferedAiProviderKeyParams 

type RewrapOfferedAiProviderKeyParams struct {
	ApiKeyEnc     []byte
	ApiKeyKeyID   *string
	ID            pgtype.UUID
	ExpectedKeyID *string
}

type RewrapWebhookSecretsParams 

type RewrapWebhookSecretsParams struct {
	SecretEnc           []byte
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	ID                  pgtype.UUID
	ExpectedVersion     int32
}

type RotatePlatformSubscriptionSecretParams 

type RotatePlatformSubscriptionSecretParams struct {
	SecretEnc   []byte
	SecretKeyID string
	Now         pgtype.Timestamptz
	ID          pgtype.UUID
}

type RotateRefreshTokenParams 

type RotateRefreshTokenParams struct {
	RotatedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type RotateWebhookSecretParams 

type RotateWebhookSecretParams struct {
	PreviousSecretUntil pgtype.Timestamptz
	SecretEnc           []byte
	SecretKeyID         *string
	ID                  pgtype.UUID
	ExpectedVersion     int32
}

type RuleOccurrence 

type RuleOccurrence struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	RuleID    pgtype.UUID
	ItemID    pgtype.UUID
	FireAt    pgtype.Timestamptz
	CreatedAt pgtype.Timestamptz
}

type RuleRun 

type RuleRun struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	RuleID           pgtype.UUID
	EventID          pgtype.UUID
	Status           string
	ConditionResults []byte
	ActionResults    []byte
	ErrorCode        *string
	StartedAt        pgtype.Timestamptz
	FinishedAt       pgtype.Timestamptz
	CausationDepth   int32
	Trigger          string
	TriggeredBy      pgtype.UUID
	SubjectID        pgtype.UUID
	Occasion         *string
}

type RulesByTriggerKindRow 

type RulesByTriggerKindRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type RulesForEventTypeRow 

type RulesForEventTypeRow struct {
	ID               pgtype.UUID
	TenantID         pgtype.UUID
	ScopeType        string
	ScopeID          pgtype.UUID
	Name             string
	Enabled          bool
	RunAs            pgtype.UUID
	Trigger          []byte
	Conditions       []byte
	Actions          []byte
	Throttle         []byte
	OnError          string
	FailureCount     int32
	CreatedBy        pgtype.UUID
	CreatedAt        pgtype.Timestamptz
	UpdatedAt        pgtype.Timestamptz
	DeletedAt        pgtype.Timestamptz
	Version          int32
	NextRunAt        pgtype.Timestamptz
	InboundRotatedAt pgtype.Timestamptz
	Findings         []byte
	CheckedAt        pgtype.Timestamptz
}

type RunningPrivateHubAccessParams 

type RunningPrivateHubAccessParams struct {
	HubID    pgtype.UUID
	OpenedBy pgtype.UUID
	Now      pgtype.Timestamptz
}

type SaveAutoAssignPolicyStateParams 

type SaveAutoAssignPolicyStateParams struct {
	State []byte
	ID    pgtype.UUID
}

type SaveNotificationOutcomeParams 

type SaveNotificationOutcomeParams struct {
	State    string
	Reason   *string
	SentAt   pgtype.Timestamptz
	Attempts int32
	ID       pgtype.UUID
}

type SaveNotificationPreferenceParams 

type SaveNotificationPreferenceParams struct {
	AccountID    pgtype.UUID
	Category     string
	Channel      string
	Enabled      bool
	IncludeTitle bool
	UpdatedAt    pgtype.Timestamptz
}

type SavedView 

type SavedView struct {
	ID            pgtype.UUID
	TenantID      pgtype.UUID
	ScopeType     string
	ScopeID       pgtype.UUID
	OwnerID       pgtype.UUID
	Name          string
	Layout        string
	Query         []byte
	Grouping      []byte
	VisibleFields []string
	Sharing       string
	CreatedAt     pgtype.Timestamptz
	Version       int32
}

type ScheduledJobBacklogParams 

type ScheduledJobBacklogParams struct {
	Kind string
	Now  pgtype.Timestamptz
}

type SealMediaObjectParams 

type SealMediaObjectParams struct {
	MimeType string
	ByteSize int64
	ID       pgtype.UUID
}

type SealedMfaEnrollmentsNotUnderRow 

type SealedMfaEnrollmentsNotUnderRow struct {
	AccountID   pgtype.UUID
	SecretEnc   []byte
	SecretKeyID string
	ConfirmedAt pgtype.Timestamptz
	LastStep    *int64
}

type SealedMfaReplacementsNotUnderRow 

type SealedMfaReplacementsNotUnderRow struct {
	AccountID              pgtype.UUID
	ReplacementSecretEnc   []byte
	ReplacementSecretKeyID *string
}

type Session 

type Session struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	AccountID          pgtype.UUID
	CreatedAt          pgtype.Timestamptz
	LastSeenAt         pgtype.Timestamptz
	UserAgent          *string
	IpClass            *string
	ExpiresAt          pgtype.Timestamptz
	RevokedAt          pgtype.Timestamptz
	StepUpTokenHash    []byte
	StepUpAt           pgtype.Timestamptz
	StepUpMethod       *string
	StepUpConsumedAt   pgtype.Timestamptz
	GrantID            pgtype.UUID
	Scopes             []string
	SignedInWith       *string
	HardExpiresAt      pgtype.Timestamptz
	IdleMinutes        *int32
	ElevatedUntil      pgtype.Timestamptz
	SignedInProviderID pgtype.UUID
}

type SessionElevatedUntilParams 

type SessionElevatedUntilParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
}

type SessionRefreshToken 

type SessionRefreshToken struct {
	ID        pgtype.UUID
	TenantID  pgtype.UUID
	SessionID pgtype.UUID
	TokenHash []byte
	CreatedAt pgtype.Timestamptz
	ExpiresAt pgtype.Timestamptz
	RotatedAt pgtype.Timestamptz
}

type SessionsForAccountParams 

type SessionsForAccountParams struct {
	AccountID pgtype.UUID
	Now       pgtype.Timestamptz
}

type SessionsForAccountRow 

type SessionsForAccountRow struct {
	ID                   pgtype.UUID
	AccountID            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	LastSeenAt           pgtype.Timestamptz
	UserAgent            *string
	IpClass              *string
	ExpiresAt            pgtype.Timestamptz
	RevokedAt            pgtype.Timestamptz
	HardExpiresAt        pgtype.Timestamptz
	IdleMinutes          *int32
	SignedInWith         *string
	SignedInProviderID   pgtype.UUID
	SignedInProviderName *string
	RotationFrom         interface{}
}

type SetAccountAvatarParams 

type SetAccountAvatarParams struct {
	AvatarMediaID pgtype.UUID
	UpdatedAt     pgtype.Timestamptz
	ID            pgtype.UUID
}

type SetAccountPasswordParams 

type SetAccountPasswordParams struct {
	PasswordHash *string
	At           pgtype.Timestamptz
	AccountID    pgtype.UUID
}

type SetAccountStatusParams 

type SetAccountStatusParams struct {
	Status    AccountStatus
	UpdatedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetAutomationRuleEnabledParams 

type SetAutomationRuleEnabledParams struct {
	Enabled         bool
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetAutomationRuleInboundTokenParams 

type SetAutomationRuleInboundTokenParams struct {
	TokenHash []byte
	RotatedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetAutomationRuleNextRunParams 

type SetAutomationRuleNextRunParams struct {
	NextRunAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetBackupRunExpiryParams 

type SetBackupRunExpiryParams struct {
	ExpiresAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetBackupScheduleNextRunParams 

type SetBackupScheduleNextRunParams struct {
	NextRunAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetBucketAttributesParams 

type SetBucketAttributesParams struct {
	Name            string
	WipLimit        *int32
	IsDoneBucket    bool
	ColorToken      *string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetBucketDeletedParams 

type SetBucketDeletedParams struct {
	DeletedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetBucketOrderKeyParams 

type SetBucketOrderKeyParams struct {
	OrderKey        string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetCollectionHandleParams 

type SetCollectionHandleParams struct {
	Handle *string
	ID     pgtype.UUID
}

type SetCommentBodyParams 

type SetCommentBodyParams struct {
	Body            string
	EditedAt        pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetCommentDeletedParams 

type SetCommentDeletedParams struct {
	KeepText        bool
	DeletedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerArchivedParams 

type SetContainerArchivedParams struct {
	ArchivedAt      pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerAttributesParams 

type SetContainerAttributesParams struct {
	Name            string
	Description     *string
	Icon            *string
	ColorToken      *string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerPlacementParams 

type SetContainerPlacementParams struct {
	ParentID        pgtype.UUID
	OrderKey        string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerPoliciesParams 

type SetContainerPoliciesParams struct {
	CompletionPolicy string
	UpdatedAt        pgtype.Timestamptz
	ID               pgtype.UUID
	ExpectedVersion  int32
}

type SetContainerPrivateParams 

type SetContainerPrivateParams struct {
	Private         bool
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerRankParams 

type SetContainerRankParams struct {
	OrderKey        string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetContainerStructureParams 

type SetContainerStructureParams struct {
	CompletionPolicy string
	Structure        []byte
	UpdatedAt        pgtype.Timestamptz
	ID               pgtype.UUID
	ExpectedVersion  int32
}

type SetContainerTrashedParams 

type SetContainerTrashedParams struct {
	DeletedAt       pgtype.Timestamptz
	TrashBatchID    pgtype.UUID
	DeletedByType   *string
	DeletedByID     pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetElement 

type SetElement struct {
	TenantID  pgtype.UUID
	ItemID    pgtype.UUID
	SetName   string
	ElementID pgtype.UUID
	AddTag    *string
	RemoveTag *string
}

type SetJobProgressParams 

type SetJobProgressParams struct {
	Progress float32
	ID       pgtype.UUID
	Lease    pgtype.Timestamptz
}

type SetJumbleIntakeTokenParams 

type SetJumbleIntakeTokenParams struct {
	TokenHash []byte
	RotatedAt pgtype.Timestamptz
}

type SetLabelAttributesParams 

type SetLabelAttributesParams struct {
	Name            string
	ColorToken      string
	Description     *string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetLabelDeletedParams 

type SetLabelDeletedParams struct {
	DeletedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetLabelRestoredParams 

type SetLabelRestoredParams struct {
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetMailboxCheckedParams 

type SetMailboxCheckedParams struct {
	CheckedAt    pgtype.Timestamptz
	Failure      *string
	FailingSince pgtype.Timestamptz
	ID           pgtype.UUID
}

type SetOccurrenceSeriesParams 

type SetOccurrenceSeriesParams struct {
	RecurrenceRuleID   pgtype.UUID
	RecurrenceSourceID pgtype.UUID
	ID                 pgtype.UUID
}

type SetProviderWithdrawalParams 

type SetProviderWithdrawalParams struct {
	WithdrawAt pgtype.Timestamptz
	Now        pgtype.Timestamptz
	ID         pgtype.UUID
}

type SetProviderWithdrawalRow 

type SetProviderWithdrawalRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	OfferedWorkspaces   int32
}

type SetRedemptionTokenParams 

type SetRedemptionTokenParams struct {
	TokenHash []byte
	ExpiresAt pgtype.Timestamptz
	Now       pgtype.Timestamptz
	ID        pgtype.UUID
}

type SetReminderFireAtParams 

type SetReminderFireAtParams struct {
	FireAt pgtype.Timestamptz
	ID     pgtype.UUID
}

type SetReminderStateParams 

type SetReminderStateParams struct {
	State string
	ID    pgtype.UUID
}

type SetRetentionCursorParams 

type SetRetentionCursorParams struct {
	Reader   string
	DataKind *string
	RuleID   pgtype.UUID
	AfterAt  pgtype.Timestamptz
	AfterID  pgtype.UUID
}

type SetSavedViewAttributesParams 

type SetSavedViewAttributesParams struct {
	Name            string
	Layout          string
	Query           []byte
	Grouping        []byte
	VisibleFields   []string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetSavedViewSharingParams 

type SetSavedViewSharingParams struct {
	Sharing         string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetTemplateDeletedParams 

type SetTemplateDeletedParams struct {
	DeletedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetTenantOwnAiBudgetParams 

type SetTenantOwnAiBudgetParams struct {
	Tokens *int64
	Now    pgtype.Timestamptz
}

type SetTenantPlanParams 

type SetTenantPlanParams struct {
	PlanID  pgtype.UUID
	Now     pgtype.Timestamptz
	Version int32
}

type SetTenantQuotasParams 

type SetTenantQuotasParams struct {
	Quotas          []byte
	Now             pgtype.Timestamptz
	ExpectedVersion int32
}

type SetTenantReferenceParams 

type SetTenantReferenceParams struct {
	ExternalReference *string
	Now               pgtype.Timestamptz
	Version           int32
}

type SetTenantStatusParams 

type SetTenantStatusParams struct {
	NextStatus     TenantStatus
	PurgeAfter     pgtype.Timestamptz
	Now            pgtype.Timestamptz
	ExpectedStatus TenantStatus
}

type SetWorkItemArchivedParams 

type SetWorkItemArchivedParams struct {
	ArchivedAt      pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemAssigneeParams 

type SetWorkItemAssigneeParams struct {
	AssigneeID      pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemAttributesParams 

type SetWorkItemAttributesParams struct {
	Title           string
	Amount          *string
	Notes           *string
	BucketID        pgtype.UUID
	StartAt         pgtype.Timestamptz
	ContentLanguage *string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemCompletionParams 

type SetWorkItemCompletionParams struct {
	IsCompleted     bool
	CompletedAt     pgtype.Timestamptz
	CompletedBy     pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemCoverParams 

type SetWorkItemCoverParams struct {
	CoverKind       *string
	CoverColorToken *string
	CoverMediaID    pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemCustomFieldParams 

type SetWorkItemCustomFieldParams struct {
	Value           []byte
	Key             string
	DefinitionID    pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemDueDateParams 

type SetWorkItemDueDateParams struct {
	DueAt           pgtype.Timestamptz
	DueDateOnly     *bool
	DueTimeZone     *string
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemOrderKeyParams 

type SetWorkItemOrderKeyParams struct {
	OrderKey        string
	BucketID        pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemOriginParams 

type SetWorkItemOriginParams struct {
	OriginJumbleID pgtype.UUID
	ID             pgtype.UUID
}

type SetWorkItemPlacementParams 

type SetWorkItemPlacementParams struct {
	ParentID        pgtype.UUID
	CollectionID    pgtype.UUID
	Path            string
	Depth           int32
	OrderKey        string
	BucketID        pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkItemRecurrenceParams 

type SetWorkItemRecurrenceParams struct {
	RecurrenceRuleID pgtype.UUID
	ID               pgtype.UUID
}

type SetWorkItemTrashedParams 

type SetWorkItemTrashedParams struct {
	DeletedAt       pgtype.Timestamptz
	TrashBatchID    pgtype.UUID
	DeletedByType   *string
	DeletedByID     pgtype.UUID
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SetWorkspaceStructureParams 

type SetWorkspaceStructureParams struct {
	Structure       []byte
	UpdatedAt       pgtype.Timestamptz
	ExpectedVersion int32
}

type SettleJumbleEntryParams 

type SettleJumbleEntryParams struct {
	Status       string
	TargetItemID pgtype.UUID
	SettledAt    pgtype.Timestamptz
	ID           pgtype.UUID
}

type SharedItemsInCollectionParams 

type SharedItemsInCollectionParams struct {
	CollectionID pgtype.UUID
	AccountID    pgtype.UUID
}

type SnapshotBucketsParams 

type SnapshotBucketsParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotCommentsParams 

type SnapshotCommentsParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotCommentsRow 

type SnapshotCommentsRow struct {
	ID              pgtype.UUID
	TenantID        pgtype.UUID
	ItemID          pgtype.UUID
	AuthorID        pgtype.UUID
	ParentCommentID pgtype.UUID
	Body            string
	CreatedAt       pgtype.Timestamptz
	EditedAt        pgtype.Timestamptz
	DeletedAt       pgtype.Timestamptz
	Version         int32
	Kind            string
	SystemCode      *string
	SystemParams    []byte
	CollectionID    pgtype.UUID
}

type SnapshotContainersParams 

type SnapshotContainersParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotContainersRow 

type SnapshotContainersRow struct {
	ID                   pgtype.UUID
	TenantID             pgtype.UUID
	Type                 ContainerType
	ParentID             pgtype.UUID
	Name                 string
	Description          *string
	Icon                 *string
	ColorToken           *string
	OrderKey             string
	CompletionPolicy     string
	Structure            string
	AutoAssignStrategy   *string
	AutoAssignCandidates []byte
	AutoAssignEnabled    *bool
	ArchivedAt           pgtype.Timestamptz
	ParentArchivedAt     pgtype.Timestamptz
	DeletedAt            pgtype.Timestamptz
	TrashBatchID         pgtype.UUID
	CreatedBy            pgtype.UUID
	CreatedAt            pgtype.Timestamptz
	UpdatedAt            pgtype.Timestamptz
	Version              int32
	Private              bool
	Handle               *string
}

type SnapshotLabelsParams 

type SnapshotLabelsParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotRecurrenceRulesParams 

type SnapshotRecurrenceRulesParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotRecurrenceRulesRow 

type SnapshotRecurrenceRulesRow struct {
	ID                 pgtype.UUID
	TenantID           pgtype.UUID
	SourceItemID       pgtype.UUID
	Rrule              string
	TimeZone           string
	Mode               string
	HorizonDays        int32
	EndsAt             pgtype.Timestamptz
	MaxCount           *int32
	LastMaterializedAt pgtype.Timestamptz
	CreatedAt          pgtype.Timestamptz
	UpdatedAt          pgtype.Timestamptz
	Version            int32
	CollectionID       pgtype.UUID
}

type SnapshotRemindersParams 

type SnapshotRemindersParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotRemindersRow 

type SnapshotRemindersRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	ItemID       pgtype.UUID
	OffsetSpec   string
	Channels     []string
	Recipients   []pgtype.UUID
	State        string
	FireAt       pgtype.Timestamptz
	CreatedAt    pgtype.Timestamptz
	UpdatedAt    pgtype.Timestamptz
	Version      int32
	CollectionID pgtype.UUID
}

type SnapshotSetElementsParams 

type SnapshotSetElementsParams struct {
	AfterItemID    pgtype.UUID
	AfterSetName   string
	AfterElementID pgtype.UUID
	Batch          int32
}

type SnapshotSetElementsRow 

type SnapshotSetElementsRow struct {
	ItemID       pgtype.UUID
	SetName      string
	ElementID    pgtype.UUID
	AddTag       *string
	RemoveTag    *string
	CollectionID pgtype.UUID
}

type SnapshotTemplatesParams 

type SnapshotTemplatesParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotTemplatesRow 

type SnapshotTemplatesRow struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	ScopeType   string
	ScopeID     pgtype.UUID
	Name        string
	Description *string
	RootType    ItemType
	Nodes       []byte
	CreatedAt   pgtype.Timestamptz
	UpdatedAt   pgtype.Timestamptz
	DeletedAt   pgtype.Timestamptz
	Version     int32
}

type SnapshotWorkItemsParams 

type SnapshotWorkItemsParams struct {
	After pgtype.UUID
	Batch int32
}

type SnapshotWorkItemsRow 

type SnapshotWorkItemsRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type SoftDeleteAutomationRuleParams 

type SoftDeleteAutomationRuleParams struct {
	DeletedAt pgtype.Timestamptz
	ID        pgtype.UUID
}

type SoftDeleteCustomFieldParams 

type SoftDeleteCustomFieldParams struct {
	DeletedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type SpendAccountPendingParams 

type SpendAccountPendingParams struct {
	Now       pgtype.Timestamptz
	AccountID pgtype.UUID
}

type StampFieldClockParams 

type StampFieldClockParams struct {
	Entity   string
	EntityID pgtype.UUID
	Field    string
	Hlc      string
}

type StandingWithdrawalsRow 

type StandingWithdrawalsRow struct {
	AccountID   pgtype.UUID
	DisplayName string
	Email       *string
	SignInName  *string
	Since       pgtype.Timestamptz
	Source      *string
}

type StartMfaReplacementParams 

type StartMfaReplacementParams struct {
	SecretEnc   []byte
	SecretKeyID *string
	SessionID   pgtype.UUID
	ExpiresAt   pgtype.Timestamptz
	Now         pgtype.Timestamptz
	AccountID   pgtype.UUID
}

type StartRetentionRunParams 

type StartRetentionRunParams struct {
	ID        pgtype.UUID
	DataKind  string
	StartedAt pgtype.Timestamptz
}

type StructurePreset 

type StructurePreset struct {
	TenantID  pgtype.UUID
	ID        pgtype.UUID
	Origin    string
	OwnerID   pgtype.UUID
	Name      string
	Settings  []byte
	CreatedAt pgtype.Timestamptz
	Version   int32
}

type SubscriptionsForEventTypeRow 

type SubscriptionsForEventTypeRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	TargetUrl           string
	EventTypes          []string
	FilterExpr          *string
	ScopeType           *string
	ScopeID             pgtype.UUID
	SecretEnc           []byte
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	PreviousSecretUntil pgtype.Timestamptz
	State               string
	FailureCount        int32
	LastError           *string
	DisabledAt          pgtype.Timestamptz
	CreatedBy           pgtype.UUID
	CreatedAt           pgtype.Timestamptz
	Version             int32
}

type SubtreeOfWorkItemParams 

type SubtreeOfWorkItemParams struct {
	PathPrefix string
	ItemID     pgtype.UUID
	RowLimit   int32
}

type SubtreeOfWorkItemRow 

type SubtreeOfWorkItemRow struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Amount                *string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	CompletionCount       int32
	BucketID              pgtype.UUID
	OrderKey              string
	AssigneeID            pgtype.UUID
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	ContentLanguage       *string
	CalendarUid           *string
	RecurrenceRuleID      pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	OriginJumbleID        pgtype.UUID
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	Number                *int64
}

type SumTenantUsageSinceParams 

type SumTenantUsageSinceParams struct {
	Metric string
	Since  pgtype.Date
}

type SupersedePasskeyChallengesParams 

type SupersedePasskeyChallengesParams struct {
	Now       pgtype.Timestamptz
	AccountID pgtype.UUID
}

type SupersedePendingParams 

type SupersedePendingParams struct {
	Now       pgtype.Timestamptz
	AccountID pgtype.UUID
	Purpose   string
}

type SwapMfaReplacementParams 

type SwapMfaReplacementParams struct {
	Step              *int64
	Now               pgtype.Timestamptz
	AccountID         pgtype.UUID
	SessionID         pgtype.UUID
	ExpectedSecretEnc []byte
}

type SyncDevice 

type SyncDevice struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	LastSeenAt   pgtype.Timestamptz
	Scopes       []byte
	PushToken    *string
	Blocked      bool
	CreatedAt    pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type SyncOpLog 

type SyncOpLog struct {
	TenantID  pgtype.UUID
	OpID      pgtype.UUID
	DeviceID  pgtype.UUID
	Result    string
	EntityID  pgtype.UUID
	AppliedAt pgtype.Timestamptz
	Response  []byte
}

type TakeBackKudosParams 

type TakeBackKudosParams struct {
	ItemID  pgtype.UUID
	GivenBy pgtype.UUID
	GivenTo pgtype.UUID
}

type TakeMailboxAuthorizationRow 

type TakeMailboxAuthorizationRow struct {
	ID                pgtype.UUID
	AccountID         pgtype.UUID
	Provider          string
	AuthorizeUrl      string
	TokenUrl          string
	Scopes            []string
	ClientID          string
	Installation      bool
	Host              string
	Port              int32
	LoginHint         *string
	VerifierEnc       []byte
	VerifierKeyID     string
	ClientSecretEnc   []byte
	ClientSecretKeyID *string
	ExpiresAt         pgtype.Timestamptz
}

type TakeMediaOrphansParams 

type TakeMediaOrphansParams struct {
	MarkedBefore pgtype.Timestamptz
	Batch        int32
}

type TakeMediaOrphansRow 

type TakeMediaOrphansRow struct {
	ID         pgtype.UUID
	StorageKey string
}

type TallyItemsRow 

type TallyItemsRow struct {
	ItemID      pgtype.UUID
	Parts       int32
	PartsDone   int32
	Comments    int32
	Attachments int32
}

type Template 

type Template struct {
	ID          pgtype.UUID
	TenantID    pgtype.UUID
	ScopeType   string
	ScopeID     pgtype.UUID
	Name        string
	Description *string
	RootType    ItemType
	Nodes       []byte
	CreatedAt   pgtype.Timestamptz
	DeletedAt   pgtype.Timestamptz
	Version     int32
	UpdatedAt   pgtype.Timestamptz
}

type Tenant 

type Tenant struct {
	ID                      pgtype.UUID
	Slug                    string
	DisplayName             string
	Status                  TenantStatus
	DefaultLocale           string
	DefaultTimeZone         string
	Settings                []byte
	CreatedAt               pgtype.Timestamptz
	UpdatedAt               pgtype.Timestamptz
	DeletedAt               pgtype.Timestamptz
	Version                 int32
	PurgeAfter              pgtype.Timestamptz
	SyncEpoch               int64
	PlanID                  pgtype.UUID
	PasswordOpenedUntil     pgtype.Timestamptz
	PasswordOpenedRequester *string
	PasswordOpenedReason    *string
	StatusBeforeDeletion    *TenantStatus
	PurgeStartedAt          pgtype.Timestamptz
	ExternalReference       *string
	StarterAnsweredAt       pgtype.Timestamptz
}

type TenantHost 

type TenantHost struct {
	TenantID     pgtype.UUID
	Host         string
	State        string
	Verification string
	VerifiedAt   pgtype.Timestamptz
	IsCanonical  bool
	CreatedAt    pgtype.Timestamptz
}

type TenantQuotaOverridesRow 

type TenantQuotaOverridesRow struct {
	Quotas      string
	OwnAiBudget string
}

type TenantStatus 

type TenantStatus string
const (
	TenantStatusACTIVE          TenantStatus = "ACTIVE"
	TenantStatusSUSPENDED       TenantStatus = "SUSPENDED"
	TenantStatusPENDINGDELETION TenantStatus = "PENDING_DELETION"
)

func (*TenantStatus) Scan 

func (e *TenantStatus) Scan(src interface{}) error

type Tombstone 

type Tombstone struct {
	TenantID   pgtype.UUID
	Entity     string
	EntityID   pgtype.UUID
	DeletedAt  pgtype.Timestamptz
	PurgeAfter pgtype.Timestamptz
}

type TouchAccessTokenParams 

type TouchAccessTokenParams struct {
	ID         pgtype.UUID
	LastUsedAt pgtype.Timestamptz
}

type TouchDeviceParams 

type TouchDeviceParams struct {
	ID           pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	Now          pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type TouchDeviceRow 

type TouchDeviceRow struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	AccountID    pgtype.UUID
	Platform     *string
	DisplayName  *string
	LastCursor   *int64
	LastSeenAt   pgtype.Timestamptz
	Blocked      bool
	CreatedAt    pgtype.Timestamptz
	CredentialID pgtype.UUID
}

type TouchSessionParams 

type TouchSessionParams struct {
	ID         pgtype.UUID
	LastSeenAt pgtype.Timestamptz
}

type TrashBatchMembersRow 

type TrashBatchMembersRow struct {
	Kind         string
	ID           pgtype.UUID
	TrashBatchID pgtype.UUID
	HubID        pgtype.UUID
	CollectionID pgtype.UUID
	Path         string
}

type TrashCollectionsOfHubParams 

type TrashCollectionsOfHubParams struct {
	DeletedAt     pgtype.Timestamptz
	TrashBatchID  pgtype.UUID
	DeletedByType *string
	DeletedByID   pgtype.UUID
	UpdatedAt     pgtype.Timestamptz
	HubID         pgtype.UUID
}

type TrashItemsForRetentionParams 

type TrashItemsForRetentionParams struct {
	At      pgtype.Timestamptz
	BatchID pgtype.UUID
	Ids     []pgtype.UUID
}

type TrashItemsOfCollectionsParams 

type TrashItemsOfCollectionsParams struct {
	DeletedAt     pgtype.Timestamptz
	TrashBatchID  pgtype.UUID
	DeletedByType *string
	DeletedByID   pgtype.UUID
	UpdatedAt     pgtype.Timestamptz
	CollectionIds []pgtype.UUID
}

type TrashKeptBelowParams 

type TrashKeptBelowParams struct {
	Going []pgtype.UUID
	Ids   []pgtype.UUID
}

type TrashKeptBelowRow 

type TrashKeptBelowRow struct {
	ID   pgtype.UUID
	Kept int64
}

type TrashWorkItemDescendantsParams 

type TrashWorkItemDescendantsParams struct {
	DeletedAt     pgtype.Timestamptz
	TrashBatchID  pgtype.UUID
	DeletedByType *string
	DeletedByID   pgtype.UUID
	UpdatedAt     pgtype.Timestamptz
	Prefix        string
	ItemID        pgtype.UUID
}

type TrimPasswordHistoryParams 

type TrimPasswordHistoryParams struct {
	AccountID pgtype.UUID
	Keep      int32
}

type UpdateAccountPreferencesParams 

type UpdateAccountPreferencesParams struct {
	Locale                *string
	TimeZone              *string
	WeekStart             *string
	Celebrations          *bool
	OnboardingCompletedAt pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	ID                    pgtype.UUID
}

type UpdateAutomationRuleParams 

type UpdateAutomationRuleParams struct {
	ScopeType       string
	ScopeID         pgtype.UUID
	Name            string
	RunAs           pgtype.UUID
	Trigger         []byte
	Conditions      []byte
	Actions         []byte
	Throttle        []byte
	OnError         string
	UpdatedAt       pgtype.Timestamptz
	NextRunAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateBackupScheduleParams 

type UpdateBackupScheduleParams struct {
	Rrule           string
	TimeZone        string
	Mode            string
	FullRrule       *string
	IncludeMedia    bool
	IncludeAudit    bool
	TrialRestore    bool
	Retention       []byte
	NotifyOn        []string
	Enabled         bool
	NextRunAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateCustomFieldParams 

type UpdateCustomFieldParams struct {
	Options         []byte
	IsRequired      bool
	AppliesTo       []ItemType
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateDataSubjectRequestParams 

type UpdateDataSubjectRequestParams struct {
	Status           string
	ErasureMode      *string
	HandledBy        pgtype.UUID
	RejectionReason  *string
	CompletedAt      pgtype.Timestamptz
	TargetID         pgtype.UUID
	ResultArchive    *string
	SubjectAccountID pgtype.UUID
	Notes            *string
	ID               pgtype.UUID
}

type UpdateGroupParams 

type UpdateGroupParams struct {
	Name            string
	Description     *string
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateIdentityProviderParams 

type UpdateIdentityProviderParams struct {
	Issuer              string
	ClientID            string
	ClientSecretEnc     []byte
	ClientSecretKeyID   *string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	Enabled             *bool
	Now                 pgtype.Timestamptz
	ID                  pgtype.UUID
}

type UpdateIdentityProviderRow 

type UpdateIdentityProviderRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	Issuer              string
	ClientID            string
	DisplayName         string
	Kind                string
	Provisioning        string
	Position            int32
	AllowedEmailDomains []string
	AllowedDirectories  []string
	Enabled             bool
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	Version             int32
	WithdrawAt          pgtype.Timestamptz
	NewcomerRole        *MembershipRole
	NewcomerGroupID     pgtype.UUID
	OfferedWorkspaces   int32
}

type UpdateInstallationPresetParams 

type UpdateInstallationPresetParams struct {
	Name            string
	Settings        []byte
	IsDefault       bool
	Locks           []string
	Now             pgtype.Timestamptz
	UpdatedBy       pgtype.UUID
	ID              pgtype.UUID
	ExpectedVersion *int32
}

type UpdateOfferedAiProviderKeepingKeyParams 

type UpdateOfferedAiProviderKeepingKeyParams struct {
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	Jurisdiction    string
	Now             pgtype.Timestamptz
	ID              pgtype.UUID
}

type UpdateOfferedAiProviderKeepingKeyRow 

type UpdateOfferedAiProviderKeepingKeyRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	HasApiKey       bool
	Jurisdiction    string
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
}

type UpdateOfferedAiProviderParams 

type UpdateOfferedAiProviderParams struct {
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	ApiKeyEnc       []byte
	ApiKeyKeyID     *string
	Jurisdiction    string
	Now             pgtype.Timestamptz
	ID              pgtype.UUID
}

type UpdateOfferedAiProviderRow 

type UpdateOfferedAiProviderRow struct {
	ID              pgtype.UUID
	DisplayName     string
	Processor       string
	Kind            string
	BaseUrl         string
	CompletionModel string
	EmbeddingModel  string
	HasApiKey       bool
	Jurisdiction    string
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	Version         int32
}

type UpdatePlanParams 

type UpdatePlanParams struct {
	DisplayName string
	Now         pgtype.Timestamptz
	UpdatedBy   pgtype.UUID
	ID          pgtype.UUID
	Version     *int32
}

type UpdatePlatformSubscriptionParams 

type UpdatePlatformSubscriptionParams struct {
	TargetUrl       string
	State           string
	Now             pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateRecurrenceRuleParams 

type UpdateRecurrenceRuleParams struct {
	Rrule           string
	TimeZone        string
	Mode            string
	HorizonDays     int32
	EndsAt          pgtype.Timestamptz
	MaxCount        *int32
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateReminderParams 

type UpdateReminderParams struct {
	OffsetSpec      string
	Channels        []string
	Recipients      []pgtype.UUID
	FireAt          pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateRetentionRuleParams 

type UpdateRetentionRuleParams struct {
	Condition       *string
	RetainDays      int32
	Action          string
	ThenAfterDays   *int32
	ThenAction      *string
	GraceDays       int32
	Notify          []byte
	Justification   *string
	Enabled         bool
	ExportTargetID  pgtype.UUID
	Now             pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateStructurePresetParams 

type UpdateStructurePresetParams struct {
	Name            string
	Settings        []byte
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateTemplateParams 

type UpdateTemplateParams struct {
	Name            string
	Description     *string
	Nodes           []byte
	UpdatedAt       pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateWebhookSubscriptionParams 

type UpdateWebhookSubscriptionParams struct {
	TargetUrl       string
	EventTypes      []string
	FilterExpr      *string
	ScopeType       *string
	ScopeID         pgtype.UUID
	State           string
	FailureCount    int32
	LastError       *string
	DisabledAt      pgtype.Timestamptz
	ID              pgtype.UUID
	ExpectedVersion int32
}

type UpdateWorkspaceParams 

type UpdateWorkspaceParams struct {
	DisplayName     string
	DefaultLocale   string
	DefaultTimeZone string
	Settings        []byte
	Now             pgtype.Timestamptz
	ExpectedVersion int32
}

type UpsertAiProviderKeepingKeyParams 

type UpsertAiProviderKeepingKeyParams struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	Jurisdiction      string
	ProcessingAllowed bool
	Now               pgtype.Timestamptz
}

type UpsertAiProviderKeepingKeyRow 

type UpsertAiProviderKeepingKeyRow struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	HasApiKey         bool
	Jurisdiction      string
	ProcessingAllowed bool
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	Version           int32
}

type UpsertAiProviderParams 

type UpsertAiProviderParams struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	ApiKeyEnc         []byte
	ApiKeyKeyID       *string
	Jurisdiction      string
	ProcessingAllowed bool
	Now               pgtype.Timestamptz
}

type UpsertAiProviderRow 

type UpsertAiProviderRow struct {
	Kind              string
	BaseUrl           string
	CompletionModel   string
	EmbeddingModel    string
	HasApiKey         bool
	Jurisdiction      string
	ProcessingAllowed bool
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	Version           int32
}

type UpsertAiSourceParams 

type UpsertAiSourceParams struct {
	Source            string
	OfferedProviderID pgtype.UUID
	Now               pgtype.Timestamptz
}

type UpsertAuthAttemptParams 

type UpsertAuthAttemptParams struct {
	SubjectHash   []byte
	Failures      int32
	LastFailureAt pgtype.Timestamptz
	LockedUntil   pgtype.Timestamptz
}

type UpsertAutoAssignPolicyParams 

type UpsertAutoAssignPolicyParams struct {
	ID         pgtype.UUID
	ScopeType  string
	ScopeID    pgtype.UUID
	Strategy   string
	Candidates []byte
	Enabled    bool
}

type UpsertErasureKeptParams 

type UpsertErasureKeptParams struct {
	RequestID   pgtype.UUID
	HoldID      pgtype.UUID
	HoldScope   string
	HoldScopeID pgtype.UUID
	Account     bool
	Entries     int32
	Comments    int32
	Assignments int32
	Intake      int32
	RecordedAt  pgtype.Timestamptz
}

type UpsertMailSettingParams 

type UpsertMailSettingParams struct {
	Enabled             bool
	Name                *string
	DefaultCollectionID pgtype.UUID
	SenderLevel         string
	Allowed             []string
	Blocked             []string
	SenderRoutes        []byte
	OpenedBy            pgtype.UUID
	UpdatedAt           pgtype.Timestamptz
	UpdatedBy           pgtype.UUID
}

type UpsertMfaEnrollmentParams 

type UpsertMfaEnrollmentParams struct {
	AccountID   pgtype.UUID
	SecretEnc   []byte
	SecretKeyID string
	Now         pgtype.Timestamptz
}

type UpsertOauthGrantParams 

type UpsertOauthGrantParams struct {
	ID        pgtype.UUID
	AccountID pgtype.UUID
	ClientID  pgtype.UUID
	Scopes    []string
	CreatedAt pgtype.Timestamptz
}

type UpsertRuleOccurrenceParams 

type UpsertRuleOccurrenceParams struct {
	ID     pgtype.UUID
	RuleID pgtype.UUID
	ItemID pgtype.UUID
	FireAt pgtype.Timestamptz
}

type UpsertVoiceSettingParams 

type UpsertVoiceSettingParams struct {
	Enabled             bool
	DefaultCollectionID pgtype.UUID
	SkillID             *string
	InvocationName      *string
	UpdatedAt           pgtype.Timestamptz
	UpdatedBy           pgtype.UUID
}

type UsageArchive 

type UsageArchive struct {
	TenantID pgtype.UUID
	Period   pgtype.Date
	Metric   string
	Value    int64
	Closing  *int64
}

type UsageRecord 

type UsageRecord struct {
	TenantID pgtype.UUID
	Period   pgtype.Date
	Metric   string
	Value    int64
	Closing  *int64
}

type VoiceAlias 

type VoiceAlias struct {
	ID           pgtype.UUID
	TenantID     pgtype.UUID
	Phrase       string
	Folded       string
	CollectionID pgtype.UUID
	LabelID      pgtype.UUID
	CreatedAt    pgtype.Timestamptz
}

type VoiceSetting 

type VoiceSetting struct {
	TenantID            pgtype.UUID
	Enabled             bool
	DefaultCollectionID pgtype.UUID
	SkillID             *string
	UpdatedAt           pgtype.Timestamptz
	UpdatedBy           pgtype.UUID
	InvocationName      *string
}

type WalkAuditEntriesParams 

type WalkAuditEntriesParams struct {
	FromTime  pgtype.Timestamptz
	ToTime    pgtype.Timestamptz
	CursorSeq *int64
	BatchSize int32
}

type WebauthnCredential 

type WebauthnCredential struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	AccountID      pgtype.UUID
	CredentialID   []byte
	PublicKey      []byte
	Algorithm      int32
	SignCount      int64
	UserHandle     []byte
	BackupEligible bool
	BackedUp       bool
	Transports     []string
	Name           string
	CreatedAt      pgtype.Timestamptz
	LastUsedAt     pgtype.Timestamptz
	RpID           *string
}

type WebhookDeliveriesParams 

type WebhookDeliveriesParams struct {
	SubscriptionID pgtype.UUID
	Status         *string
	Before         pgtype.UUID
	PageSize       int32
}

type WebhookDelivery 

type WebhookDelivery struct {
	ID             pgtype.UUID
	TenantID       pgtype.UUID
	SubscriptionID pgtype.UUID
	EventID        pgtype.UUID
	Attempt        int32
	Status         string
	ResponseStatus *int32
	ErrorCode      *string
	NextAttemptAt  pgtype.Timestamptz
	CreatedAt      pgtype.Timestamptz
	PushID         pgtype.UUID
	Subject        *string
	EventType      *string
}

type WebhookSubscription 

type WebhookSubscription struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	TargetUrl           string
	EventTypes          []string
	FilterExpr          *string
	SecretEnc           []byte
	State               string
	FailureCount        int32
	CreatedBy           pgtype.UUID
	CreatedAt           pgtype.Timestamptz
	Version             int32
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	PreviousSecretUntil pgtype.Timestamptz
	LastError           *string
	DisabledAt          pgtype.Timestamptz
	ScopeType           *string
	ScopeID             pgtype.UUID
}

type WebhookSubscriptionsSealedNotUnderRow 

type WebhookSubscriptionsSealedNotUnderRow struct {
	ID                  pgtype.UUID
	TenantID            pgtype.UUID
	TargetUrl           string
	EventTypes          []string
	FilterExpr          *string
	ScopeType           *string
	ScopeID             pgtype.UUID
	SecretEnc           []byte
	SecretKeyID         *string
	PreviousSecretEnc   []byte
	PreviousSecretKeyID *string
	PreviousSecretUntil pgtype.Timestamptz
	State               string
	FailureCount        int32
	LastError           *string
	DisabledAt          pgtype.Timestamptz
	CreatedBy           pgtype.UUID
	CreatedAt           pgtype.Timestamptz
	Version             int32
}

type WorkItem 

type WorkItem struct {
	ID                    pgtype.UUID
	TenantID              pgtype.UUID
	CollectionID          pgtype.UUID
	Type                  ItemType
	ParentID              pgtype.UUID
	Path                  string
	Depth                 int32
	Title                 string
	Notes                 *string
	IsCompleted           bool
	CompletedAt           pgtype.Timestamptz
	CompletedBy           pgtype.UUID
	BucketID              pgtype.UUID
	OrderKey              string
	StartAt               pgtype.Timestamptz
	DueAt                 pgtype.Timestamptz
	DueDateOnly           bool
	DueTimeZone           *string
	AssigneeID            pgtype.UUID
	CoverKind             *string
	CoverColorToken       *string
	CoverMediaID          pgtype.UUID
	CustomFields          []byte
	RecurrenceRuleID      pgtype.UUID
	OriginJumbleID        pgtype.UUID
	ContentLanguage       *string
	SearchVector          interface{}
	ArchivedAt            pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	TrashBatchID          pgtype.UUID
	CreatedBy             pgtype.UUID
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	Version               int32
	CustomFieldRefs       []byte
	SearchDocument        interface{}
	DueSoonAnnouncedAt    pgtype.Timestamptz
	OverdueAnnouncedAt    pgtype.Timestamptz
	RetentionPendingUntil pgtype.Timestamptz
	RetentionRuleID       pgtype.UUID
	RetentionAction       *string
	RetentionBlockedBy    *string
	DeletedByType         *string
	DeletedByID           pgtype.UUID
	RecurrenceSourceID    pgtype.UUID
	SearchConfiguration   *string
	CalendarUid           *string
	Amount                *string
	CompletionCount       int32
	FlowStartedAt         pgtype.Timestamptz
	FlowFinishedAt        pgtype.Timestamptz
	Number                *int64
}

type WorkItemTypesRow 

type WorkItemTypesRow struct {
	ID   pgtype.UUID
	Type ItemType
}

type WorkspaceOwnerPathsRow 

type WorkspaceOwnerPathsRow struct {
	MembershipID pgtype.UUID
	AccountID    pgtype.UUID
	GroupID      pgtype.UUID
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.