notifymodel

type Notification struct {
	// Unique identifier for this row.
	ID uuid.UUID `json:"id"`
	// Tenant this row belongs to. Every query is scoped by it.
	TenantID uuid.UUID `json:"tenantId"`
	// When this row was created. Set automatically and never changes.
	CreatedAt time.Time `json:"createdAt"`
	// Account that created this row, taken from the request's claims.
	CreatedByAccountID *uuid.UUID `json:"createdByAccountId,omitempty"`
	// API key this row was created through, when it was an integration rather than
	// a person.
	CreatedByAPIKeyID *uuid.UUID `json:"createdByApiKeyId,omitempty"`
	// When this row was last updated. Set automatically on every update.
	UpdatedAt *time.Time `json:"updatedAt,omitempty"`
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind string `json:"kind"`
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State NotificationState `json:"state"`
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt time.Time `json:"deliverAt"`
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt *time.Time `json:"resolvedAt,omitempty"`
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload json.RawMessage `json:"payload"`
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey *string `json:"groupKey,omitempty"`
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds []uuid.UUID `json:"accountIds,omitempty"`
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt *time.Time `json:"claimedAt,omitempty"`
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy *uuid.UUID `json:"claimedBy,omitempty"`
	// How many times resolving this has been attempted.
	Attempts int `json:"attempts"`
}

type NotificationChannel string

type NotificationCreateInput struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind string `json:"kind"`
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State NotificationState `json:"state"`
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt time.Time `json:"deliverAt"`
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt *time.Time `json:"resolvedAt"`
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload json.RawMessage `json:"payload"`
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey *string `json:"groupKey"`
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds []uuid.UUID `json:"accountIds"`
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt *time.Time `json:"claimedAt"`
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy *uuid.UUID `json:"claimedBy"`
	// How many times resolving this has been attempted.
	Attempts int `json:"attempts"`
}

type NotificationCreateInputError struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State *rigerr.FieldError `json:"state,omitempty"`
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt *rigerr.FieldError `json:"deliverAt,omitempty"`
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt *rigerr.FieldError `json:"resolvedAt,omitempty"`
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload *rigerr.FieldError `json:"payload,omitempty"`
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey *rigerr.FieldError `json:"groupKey,omitempty"`
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds *rigerr.FieldError `json:"accountIds,omitempty"`
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt *rigerr.FieldError `json:"claimedAt,omitempty"`
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy *rigerr.FieldError `json:"claimedBy,omitempty"`
	// How many times resolving this has been attempted.
	Attempts *rigerr.FieldError `json:"attempts,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationCreateValidator struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind func(ctx context.Context, c *NotificationValidatorContext, value string) error
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State func(ctx context.Context, c *NotificationValidatorContext, value NotificationState) error
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt func(ctx context.Context, c *NotificationValidatorContext, value time.Time) error
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt func(ctx context.Context, c *NotificationValidatorContext, value *time.Time) error
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload func(ctx context.Context, c *NotificationValidatorContext, value json.RawMessage) error
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey func(ctx context.Context, c *NotificationValidatorContext, value *string) error
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds func(ctx context.Context, c *NotificationValidatorContext, value []uuid.UUID) error
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt func(ctx context.Context, c *NotificationValidatorContext, value *time.Time) error
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy func(ctx context.Context, c *NotificationValidatorContext, value *uuid.UUID) error
	// How many times resolving this has been attempted.
	Attempts func(ctx context.Context, c *NotificationValidatorContext, value int) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationValidatorContext) error
}

type NotificationDeleteInput struct {
	// ID is the row to delete.
	ID uuid.UUID `json:"id"`
}

type NotificationDelivery struct {
	// Unique identifier for this row.
	ID uuid.UUID `json:"id"`
	// Tenant this row belongs to. Every query is scoped by it.
	TenantID uuid.UUID `json:"tenantId"`
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID uuid.UUID `json:"recipientId"`
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID uuid.UUID `json:"accountId"`
	// When this row was created. Set automatically and never changes.
	CreatedAt time.Time `json:"createdAt"`
	// When this row was last updated. Set automatically on every update.
	UpdatedAt *time.Time `json:"updatedAt,omitempty"`
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel NotificationChannel `json:"channel"`
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind string `json:"kind"`
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest NotificationDigest `json:"digest"`
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State NotificationDeliveryState `json:"state"`
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt time.Time `json:"deliverAt"`
	// When a channel accepted it, which is not the same as it arriving.
	SentAt *time.Time `json:"sentAt,omitempty"`
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason *string `json:"failedReason,omitempty"`
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts int `json:"attempts"`
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt *time.Time `json:"claimedAt,omitempty"`
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy *uuid.UUID `json:"claimedBy,omitempty"`
}

type NotificationDeliveryCreateInput struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID uuid.UUID `json:"recipientId"`
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID uuid.UUID `json:"accountId"`
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel NotificationChannel `json:"channel"`
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind string `json:"kind"`
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest NotificationDigest `json:"digest"`
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State NotificationDeliveryState `json:"state"`
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt time.Time `json:"deliverAt"`
	// When a channel accepted it, which is not the same as it arriving.
	SentAt *time.Time `json:"sentAt"`
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason *string `json:"failedReason"`
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts int `json:"attempts"`
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt *time.Time `json:"claimedAt"`
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy *uuid.UUID `json:"claimedBy"`
}

type NotificationDeliveryCreateInputError struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID *rigerr.FieldError `json:"recipientId,omitempty"`
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest *rigerr.FieldError `json:"digest,omitempty"`
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State *rigerr.FieldError `json:"state,omitempty"`
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt *rigerr.FieldError `json:"deliverAt,omitempty"`
	// When a channel accepted it, which is not the same as it arriving.
	SentAt *rigerr.FieldError `json:"sentAt,omitempty"`
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason *rigerr.FieldError `json:"failedReason,omitempty"`
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts *rigerr.FieldError `json:"attempts,omitempty"`
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt *rigerr.FieldError `json:"claimedAt,omitempty"`
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy *rigerr.FieldError `json:"claimedBy,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationDeliveryCreateValidator struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID func(ctx context.Context, c *NotificationDeliveryValidatorContext, value uuid.UUID) error
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID func(ctx context.Context, c *NotificationDeliveryValidatorContext, value uuid.UUID) error
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationChannel) error
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind func(ctx context.Context, c *NotificationDeliveryValidatorContext, value string) error
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationDigest) error
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationDeliveryState) error
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value time.Time) error
	// When a channel accepted it, which is not the same as it arriving.
	SentAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *time.Time) error
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *string) error
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts func(ctx context.Context, c *NotificationDeliveryValidatorContext, value int) error
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *time.Time) error
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *uuid.UUID) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationDeliveryValidatorContext) error
}

type NotificationDeliveryDeleteInput struct {
	// ID is the row to delete.
	ID uuid.UUID `json:"id"`
}

type NotificationDeliveryState string

type NotificationDeliveryUpdateInput struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID patch.Optional[uuid.UUID] `json:"recipientId"`
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID patch.Optional[uuid.UUID] `json:"accountId"`
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel patch.Optional[NotificationChannel] `json:"channel"`
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind patch.Optional[string] `json:"kind"`
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest patch.Optional[NotificationDigest] `json:"digest"`
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State patch.Optional[NotificationDeliveryState] `json:"state"`
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt patch.Optional[time.Time] `json:"deliverAt"`
	// When a channel accepted it, which is not the same as it arriving.
	SentAt patch.Nullable[time.Time] `json:"sentAt"`
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason patch.Nullable[string] `json:"failedReason"`
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts patch.Optional[int] `json:"attempts"`
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt patch.Nullable[time.Time] `json:"claimedAt"`
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy patch.Nullable[uuid.UUID] `json:"claimedBy"`
}

type NotificationDeliveryUpdateInputError struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID *rigerr.FieldError `json:"recipientId,omitempty"`
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest *rigerr.FieldError `json:"digest,omitempty"`
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State *rigerr.FieldError `json:"state,omitempty"`
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt *rigerr.FieldError `json:"deliverAt,omitempty"`
	// When a channel accepted it, which is not the same as it arriving.
	SentAt *rigerr.FieldError `json:"sentAt,omitempty"`
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason *rigerr.FieldError `json:"failedReason,omitempty"`
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts *rigerr.FieldError `json:"attempts,omitempty"`
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt *rigerr.FieldError `json:"claimedAt,omitempty"`
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy *rigerr.FieldError `json:"claimedBy,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationDeliveryUpdateValidator struct {
	// The inbox line this is a copy of. The line is the truth and this is one way
	// it was repeated.
	RecipientID func(ctx context.Context, c *NotificationDeliveryValidatorContext, value uuid.UUID) error
	// Who it is for, denormalized off the line so a claim can group by it without
	// a join.
	AccountID func(ctx context.Context, c *NotificationDeliveryValidatorContext, value uuid.UUID) error
	// Where it is going. One row per line per channel, which is what the unique
	// index below enforces.
	Channel func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationChannel) error
	// Copied from the notification, so the settings resolution needs no join
	// either.
	Kind func(ctx context.Context, c *NotificationDeliveryValidatorContext, value string) error
	// What the setting said when this row was written. Immediate rows are sent on
	// their own; the rest are batched per account and channel.
	Digest func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationDigest) error
	// Skipped means a setting refused it, which is different from Failed and worth
	// telling apart in a report.
	State func(ctx context.Context, c *NotificationDeliveryValidatorContext, value NotificationDeliveryState) error
	// When this is due. A delivery held outside somebody hours moves to the next
	// opening; a digested one moves to its window close.
	DeliverAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value time.Time) error
	// When a channel accepted it, which is not the same as it arriving.
	SentAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *time.Time) error
	// What the channel said last time. Kept on a retry as well as on a failure, so
	// a pattern is visible before the cap is reached.
	FailedReason func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *string) error
	// How many times this has been claimed. Past notifications.max_attempts it is
	// Failed and stops being claimed.
	Attempts func(ctx context.Context, c *NotificationDeliveryValidatorContext, value int) error
	// When a dispatcher took it. Past notifications.claim_ttl another one may,
	// which is what makes a crashed process recoverable.
	ClaimedAt func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *time.Time) error
	// Which process holds the lease. A uuid generated once per process, with the
	// hostname beside it in the log line, so a stuck lease traces to a pod rather
	// than to a mystery.
	ClaimedBy func(ctx context.Context, c *NotificationDeliveryValidatorContext, value *uuid.UUID) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationDeliveryValidatorContext) error
}

type NotificationDeliveryValidatorContext struct {
	// Values is the intended end state.
	Values NotificationDelivery

	// Claims are who is asking. They are a value rather than something to fetch
	// from the context because a rule that has to look them up is a rule that can
	// forget to, and because there is no case where they are absent: a write
	// without a caller is refused by the repository before any rule runs.
	Claims tenancy.Claims
	// contains filtered or unexported fields
}

type NotificationDevice struct {
	// Unique identifier for this row.
	ID uuid.UUID `json:"id"`
	// Tenant this row belongs to. Every query is scoped by it.
	TenantID uuid.UUID `json:"tenantId"`
	// Whose device it is.
	AccountID uuid.UUID `json:"accountId"`
	// When this row was created. Set automatically and never changes.
	CreatedAt time.Time `json:"createdAt"`
	// When this row was last updated. Set automatically on every update.
	UpdatedAt *time.Time `json:"updatedAt,omitempty"`
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel NotificationChannel `json:"channel"`
	// What the provider was given to address this device. Opaque to rig.
	Token string `json:"token"`
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label *string `json:"label,omitempty"`
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt *time.Time `json:"lastSeenAt,omitempty"`
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt *time.Time `json:"revokedAt,omitempty"`
}

type NotificationDeviceCreateInput struct {
	// Whose device it is.
	AccountID uuid.UUID `json:"accountId"`
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel NotificationChannel `json:"channel"`
	// What the provider was given to address this device. Opaque to rig.
	Token string `json:"token"`
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label *string `json:"label"`
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt *time.Time `json:"lastSeenAt"`
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt *time.Time `json:"revokedAt"`
}

type NotificationDeviceCreateInputError struct {
	// Whose device it is.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// What the provider was given to address this device. Opaque to rig.
	Token *rigerr.FieldError `json:"token,omitempty"`
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label *rigerr.FieldError `json:"label,omitempty"`
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt *rigerr.FieldError `json:"lastSeenAt,omitempty"`
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt *rigerr.FieldError `json:"revokedAt,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationDeviceCreateValidator struct {
	// Whose device it is.
	AccountID func(ctx context.Context, c *NotificationDeviceValidatorContext, value uuid.UUID) error
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel func(ctx context.Context, c *NotificationDeviceValidatorContext, value NotificationChannel) error
	// What the provider was given to address this device. Opaque to rig.
	Token func(ctx context.Context, c *NotificationDeviceValidatorContext, value string) error
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label func(ctx context.Context, c *NotificationDeviceValidatorContext, value *string) error
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt func(ctx context.Context, c *NotificationDeviceValidatorContext, value *time.Time) error
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt func(ctx context.Context, c *NotificationDeviceValidatorContext, value *time.Time) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationDeviceValidatorContext) error
}

type NotificationDeviceDeleteInput struct {
	// ID is the row to delete.
	ID uuid.UUID `json:"id"`
}

type NotificationDeviceUpdateInput struct {
	// Whose device it is.
	AccountID patch.Optional[uuid.UUID] `json:"accountId"`
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel patch.Optional[NotificationChannel] `json:"channel"`
	// What the provider was given to address this device. Opaque to rig.
	Token patch.Optional[string] `json:"token"`
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label patch.Nullable[string] `json:"label"`
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt patch.Nullable[time.Time] `json:"lastSeenAt"`
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt patch.Nullable[time.Time] `json:"revokedAt"`
}

type NotificationDeviceUpdateInputError struct {
	// Whose device it is.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// What the provider was given to address this device. Opaque to rig.
	Token *rigerr.FieldError `json:"token,omitempty"`
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label *rigerr.FieldError `json:"label,omitempty"`
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt *rigerr.FieldError `json:"lastSeenAt,omitempty"`
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt *rigerr.FieldError `json:"revokedAt,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationDeviceUpdateValidator struct {
	// Whose device it is.
	AccountID func(ctx context.Context, c *NotificationDeviceValidatorContext, value uuid.UUID) error
	// Desktop or Mobile. Email is refused by the CHECK above.
	Channel func(ctx context.Context, c *NotificationDeviceValidatorContext, value NotificationChannel) error
	// What the provider was given to address this device. Opaque to rig.
	Token func(ctx context.Context, c *NotificationDeviceValidatorContext, value string) error
	// What a person sees in a list of their devices, and the column that makes
	// revoking one possible for somebody who has four.
	Label func(ctx context.Context, c *NotificationDeviceValidatorContext, value *string) error
	// When this device last checked in, so a stale one can be told apart from a
	// revoked one.
	LastSeenAt func(ctx context.Context, c *NotificationDeviceValidatorContext, value *time.Time) error
	// When it stopped being a place to send to. Kept rather than deleted, so a
	// token that comes back can be recognised.
	RevokedAt func(ctx context.Context, c *NotificationDeviceValidatorContext, value *time.Time) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationDeviceValidatorContext) error
}

type NotificationDeviceValidatorContext struct {
	// Values is the intended end state.
	Values NotificationDevice

	// Claims are who is asking. They are a value rather than something to fetch
	// from the context because a rule that has to look them up is a rule that can
	// forget to, and because there is no case where they are absent: a write
	// without a caller is refused by the repository before any rule runs.
	Claims tenancy.Claims
	// contains filtered or unexported fields
}

type NotificationDigest string

type NotificationRecipient struct {
	// Unique identifier for this row.
	ID uuid.UUID `json:"id"`
	// Tenant this row belongs to. Every query is scoped by it.
	TenantID uuid.UUID `json:"tenantId"`
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID uuid.UUID `json:"notificationId"`
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID uuid.UUID `json:"accountId"`
	// When this row was created. Set automatically and never changes.
	CreatedAt time.Time `json:"createdAt"`
	// When this row was last updated. Set automatically on every update.
	UpdatedAt *time.Time `json:"updatedAt,omitempty"`
	// When this row was soft-deleted. Null while the row is live.
	DeletedAt *time.Time `json:"deletedAt,omitempty"`
	// Account that soft-deleted this row, taken from the request's claims.
	DeletedByAccountID *uuid.UUID `json:"deletedByAccountId,omitempty"`
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind string `json:"kind"`
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey *string `json:"groupKey,omitempty"`
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount int `json:"eventCount"`
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt *time.Time `json:"readAt,omitempty"`
}

type NotificationRecipientCreateInput struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID uuid.UUID `json:"notificationId"`
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID uuid.UUID `json:"accountId"`
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind string `json:"kind"`
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey *string `json:"groupKey"`
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount int `json:"eventCount"`
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt *time.Time `json:"readAt"`
}

type NotificationRecipientCreateInputError struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID *rigerr.FieldError `json:"notificationId,omitempty"`
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey *rigerr.FieldError `json:"groupKey,omitempty"`
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount *rigerr.FieldError `json:"eventCount,omitempty"`
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt *rigerr.FieldError `json:"readAt,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationRecipientCreateValidator struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID func(ctx context.Context, c *NotificationRecipientValidatorContext, value uuid.UUID) error
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID func(ctx context.Context, c *NotificationRecipientValidatorContext, value uuid.UUID) error
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind func(ctx context.Context, c *NotificationRecipientValidatorContext, value string) error
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey func(ctx context.Context, c *NotificationRecipientValidatorContext, value *string) error
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount func(ctx context.Context, c *NotificationRecipientValidatorContext, value int) error
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt func(ctx context.Context, c *NotificationRecipientValidatorContext, value *time.Time) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationRecipientValidatorContext) error
}

type NotificationRecipientDeleteInput struct {
	// ID is the row to delete.
	ID uuid.UUID `json:"id"`
	// Hard removes the row outright instead of retiring it. A hard delete cannot
	// be undone and takes the row's snapshots with it.
	Hard bool `json:"hard,omitempty"`
}

type NotificationRecipientUpdateInput struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID patch.Optional[uuid.UUID] `json:"notificationId"`
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID patch.Optional[uuid.UUID] `json:"accountId"`
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind patch.Optional[string] `json:"kind"`
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey patch.Nullable[string] `json:"groupKey"`
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount patch.Optional[int] `json:"eventCount"`
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt patch.Nullable[time.Time] `json:"readAt"`
}

type NotificationRecipientUpdateInputError struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID *rigerr.FieldError `json:"notificationId,omitempty"`
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey *rigerr.FieldError `json:"groupKey,omitempty"`
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount *rigerr.FieldError `json:"eventCount,omitempty"`
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt *rigerr.FieldError `json:"readAt,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationRecipientUpdateValidator struct {
	// What happened. The line is separate from it so that one person clearing
	// their inbox changes nothing anybody else sees.
	NotificationID func(ctx context.Context, c *NotificationRecipientValidatorContext, value uuid.UUID) error
	// Who this line is for. An account rather than an identity: an identity has no
	// tenant, so a row addressed to one would fall outside every generated query.
	AccountID func(ctx context.Context, c *NotificationRecipientValidatorContext, value uuid.UUID) error
	// Copied from the notification, so the inbox and its live-sync shape never
	// touch a table holding rows for people who are not recipients.
	Kind func(ctx context.Context, c *NotificationRecipientValidatorContext, value string) error
	// What collapses several events into one line. Null opts out and every event
	// is its own row.
	GroupKey func(ctx context.Context, c *NotificationRecipientValidatorContext, value *string) error
	// How many events this line stands for. One unless a group key collapsed them.
	EventCount func(ctx context.Context, c *NotificationRecipientValidatorContext, value int) error
	// When the person read it. Null is unread, which is what the badge counts.
	ReadAt func(ctx context.Context, c *NotificationRecipientValidatorContext, value *time.Time) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationRecipientValidatorContext) error
}

type NotificationRecipientValidatorContext struct {
	// Values is the intended end state.
	Values NotificationRecipient

	// Claims are who is asking. They are a value rather than something to fetch
	// from the context because a rule that has to look them up is a rule that can
	// forget to, and because there is no case where they are absent: a write
	// without a caller is refused by the repository before any rule runs.
	Claims tenancy.Claims
	// contains filtered or unexported fields
}

type NotificationSetting struct {
	// Unique identifier for this row.
	ID uuid.UUID `json:"id"`
	// Tenant this row belongs to. Every query is scoped by it.
	TenantID uuid.UUID `json:"tenantId"`
	// Whose preference it is.
	AccountID uuid.UUID `json:"accountId"`
	// When this row was created. Set automatically and never changes.
	CreatedAt time.Time `json:"createdAt"`
	// When this row was last updated. Set automatically on every update.
	UpdatedAt *time.Time `json:"updatedAt,omitempty"`
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind *string `json:"kind,omitempty"`
	// Which channel it answers for.
	Channel NotificationChannel `json:"channel"`
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled bool `json:"isEnabled"`
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest NotificationDigest `json:"digest"`
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom *time.Time `json:"activeFrom,omitempty"`
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil *time.Time `json:"activeUntil,omitempty"`
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays []int16 `json:"activeDays,omitempty"`
}

type NotificationSettingCreateInput struct {
	// Whose preference it is.
	AccountID uuid.UUID `json:"accountId"`
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind *string `json:"kind"`
	// Which channel it answers for.
	Channel NotificationChannel `json:"channel"`
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled bool `json:"isEnabled"`
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest NotificationDigest `json:"digest"`
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom *time.Time `json:"activeFrom"`
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil *time.Time `json:"activeUntil"`
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays []int16 `json:"activeDays"`
}

type NotificationSettingCreateInputError struct {
	// Whose preference it is.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// Which channel it answers for.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled *rigerr.FieldError `json:"isEnabled,omitempty"`
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest *rigerr.FieldError `json:"digest,omitempty"`
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom *rigerr.FieldError `json:"activeFrom,omitempty"`
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil *rigerr.FieldError `json:"activeUntil,omitempty"`
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays *rigerr.FieldError `json:"activeDays,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationSettingCreateValidator struct {
	// Whose preference it is.
	AccountID func(ctx context.Context, c *NotificationSettingValidatorContext, value uuid.UUID) error
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind func(ctx context.Context, c *NotificationSettingValidatorContext, value *string) error
	// Which channel it answers for.
	Channel func(ctx context.Context, c *NotificationSettingValidatorContext, value NotificationChannel) error
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled func(ctx context.Context, c *NotificationSettingValidatorContext, value bool) error
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest func(ctx context.Context, c *NotificationSettingValidatorContext, value NotificationDigest) error
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom func(ctx context.Context, c *NotificationSettingValidatorContext, value *time.Time) error
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil func(ctx context.Context, c *NotificationSettingValidatorContext, value *time.Time) error
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays func(ctx context.Context, c *NotificationSettingValidatorContext, value []int16) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationSettingValidatorContext) error
}

type NotificationSettingDeleteInput struct {
	// ID is the row to delete.
	ID uuid.UUID `json:"id"`
}

type NotificationSettingUpdateInput struct {
	// Whose preference it is.
	AccountID patch.Optional[uuid.UUID] `json:"accountId"`
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind patch.Nullable[string] `json:"kind"`
	// Which channel it answers for.
	Channel patch.Optional[NotificationChannel] `json:"channel"`
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled patch.Optional[bool] `json:"isEnabled"`
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest patch.Optional[NotificationDigest] `json:"digest"`
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom patch.Nullable[time.Time] `json:"activeFrom"`
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil patch.Nullable[time.Time] `json:"activeUntil"`
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays patch.Optional[[]int16] `json:"activeDays"`
}

type NotificationSettingUpdateInputError struct {
	// Whose preference it is.
	AccountID *rigerr.FieldError `json:"accountId,omitempty"`
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// Which channel it answers for.
	Channel *rigerr.FieldError `json:"channel,omitempty"`
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled *rigerr.FieldError `json:"isEnabled,omitempty"`
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest *rigerr.FieldError `json:"digest,omitempty"`
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom *rigerr.FieldError `json:"activeFrom,omitempty"`
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil *rigerr.FieldError `json:"activeUntil,omitempty"`
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays *rigerr.FieldError `json:"activeDays,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationSettingUpdateValidator struct {
	// Whose preference it is.
	AccountID func(ctx context.Context, c *NotificationSettingValidatorContext, value uuid.UUID) error
	// Null is the default for the channel, which is the second step of the
	// resolution.
	Kind func(ctx context.Context, c *NotificationSettingValidatorContext, value *string) error
	// Which channel it answers for.
	Channel func(ctx context.Context, c *NotificationSettingValidatorContext, value NotificationChannel) error
	// False writes no delivery row at all. Not the same as digest Off, which is
	// about preferring to look rather than be told.
	IsEnabled func(ctx context.Context, c *NotificationSettingValidatorContext, value bool) error
	// Immediate sends each on its own; anything else waits for the window and goes
	// out as one message.
	Digest func(ctx context.Context, c *NotificationSettingValidatorContext, value NotificationDigest) error
	// When to start delivering, in the account time zone. Null means all day. A
	// window that wraps midnight is ordinary: 22:00 to 06:00 is how somebody says
	// "not overnight".
	ActiveFrom func(ctx context.Context, c *NotificationSettingValidatorContext, value *time.Time) error
	// When to stop. Outside the window a delivery is held, not dropped: the inbox
	// line exists either way, and a discarded copy makes the badge and the mailbox
	// disagree.
	ActiveUntil func(ctx context.Context, c *NotificationSettingValidatorContext, value *time.Time) error
	// ISO weekdays, 1 being Monday. Empty means every day. An array rather than a
	// bitmask because [1,2,3,4,5] is legible in a settings payload and 62 is not.
	ActiveDays func(ctx context.Context, c *NotificationSettingValidatorContext, value []int16) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationSettingValidatorContext) error
}

type NotificationSettingValidatorContext struct {
	// Values is the intended end state.
	Values NotificationSetting

	// Claims are who is asking. They are a value rather than something to fetch
	// from the context because a rule that has to look them up is a rule that can
	// forget to, and because there is no case where they are absent: a write
	// without a caller is refused by the repository before any rule runs.
	Claims tenancy.Claims
	// contains filtered or unexported fields
}

type NotificationState string

type NotificationUpdateInput struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind patch.Optional[string] `json:"kind"`
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State patch.Optional[NotificationState] `json:"state"`
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt patch.Optional[time.Time] `json:"deliverAt"`
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt patch.Nullable[time.Time] `json:"resolvedAt"`
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload patch.Optional[json.RawMessage] `json:"payload"`
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey patch.Nullable[string] `json:"groupKey"`
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds patch.Nullable[[]uuid.UUID] `json:"accountIds"`
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt patch.Nullable[time.Time] `json:"claimedAt"`
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy patch.Nullable[uuid.UUID] `json:"claimedBy"`
	// How many times resolving this has been attempted.
	Attempts patch.Optional[int] `json:"attempts"`
}

type NotificationUpdateInputError struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind *rigerr.FieldError `json:"kind,omitempty"`
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State *rigerr.FieldError `json:"state,omitempty"`
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt *rigerr.FieldError `json:"deliverAt,omitempty"`
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt *rigerr.FieldError `json:"resolvedAt,omitempty"`
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload *rigerr.FieldError `json:"payload,omitempty"`
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey *rigerr.FieldError `json:"groupKey,omitempty"`
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds *rigerr.FieldError `json:"accountIds,omitempty"`
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt *rigerr.FieldError `json:"claimedAt,omitempty"`
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy *rigerr.FieldError `json:"claimedBy,omitempty"`
	// How many times resolving this has been attempted.
	Attempts *rigerr.FieldError `json:"attempts,omitempty"`

	// Entity is a problem with the row as a whole rather than with one field: what
	// the Entity rule said.
	Entity *rigerr.FieldError `json:"entity,omitempty"`
}

type NotificationUpdateValidator struct {
	// What happened, as the application names it. Narrow it to an enum of your own
	// to get a switch the compiler can see.
	Kind func(ctx context.Context, c *NotificationValidatorContext, value string) error
	// Resolved means the audience was determined and the inbox lines exist. It
	// does not mean anything was sent.
	State func(ctx context.Context, c *NotificationValidatorContext, value NotificationState) error
	// When this is due. now() is the ordinary case; a scheduled notification is
	// the same row with a later time, which is the only difference between the
	// two.
	DeliverAt func(ctx context.Context, c *NotificationValidatorContext, value time.Time) error
	// When the audience was computed. Null while the notification is still pending
	// or was cancelled.
	ResolvedAt func(ctx context.Context, c *NotificationValidatorContext, value *time.Time) error
	// What a template needs beyond the linked row. Give it a Go type with the
	// go_type key if it has a shape.
	Payload func(ctx context.Context, c *NotificationValidatorContext, value json.RawMessage) error
	// What collapses several of these into one inbox line, decided when the
	// announcement was written and copied onto the line when the audience is
	// resolved.
	GroupKey func(ctx context.Context, c *NotificationValidatorContext, value *string) error
	// A recipient list captured at write time, and the one exception to computing
	// the audience late. Null is the ordinary case; a list here skips the question
	// entirely, for an audience that genuinely cannot be re-derived.
	AccountIds func(ctx context.Context, c *NotificationValidatorContext, value []uuid.UUID) error
	// When a dispatcher took this to resolve. Past notifications.claim_ttl another
	// may, which is what makes a crashed process recoverable.
	ClaimedAt func(ctx context.Context, c *NotificationValidatorContext, value *time.Time) error
	// Which process holds the lease, so a stuck one traces to a pod rather than to
	// a mystery.
	ClaimedBy func(ctx context.Context, c *NotificationValidatorContext, value *uuid.UUID) error
	// How many times resolving this has been attempted.
	Attempts func(ctx context.Context, c *NotificationValidatorContext, value int) error

	// Entity runs after the per-field hooks, for a rule that is about the row
	// rather than about one column.
	Entity func(ctx context.Context, c *NotificationValidatorContext) error
}

type NotificationValidatorContext struct {
	// Values is the intended end state.
	Values Notification

	// Claims are who is asking. They are a value rather than something to fetch
	// from the context because a rule that has to look them up is a rule that can
	// forget to, and because there is no case where they are absent: a write
	// without a caller is refused by the repository before any rule runs.
	Claims tenancy.Claims
	// contains filtered or unexported fields
}