command

type AggregateEraser interface {
	EraseAggregate(context.Context, ErasureRequest) (ErasureReceipt, error)
}

type Change struct {
	Entity   *registry.Entity
	Op       Op // resolved write op: OpCreate / OpUpdate / OpDelete
	Envelope event.Envelope
}

type CleanupStatus struct {
	Target string `json:"target"`
	State  string `json:"state"`
}

type Command struct {
	// Entity is the registry name, e.g. "asset".
	Entity string

	// Op selects create/update/delete.
	Op Op

	// AggID identifies the aggregate. Required for update/delete/upsert;
	// optional for create (a ULID is minted when empty).
	AggID string

	// Payload is the entity's grove model instance for create/update. The
	// structural columns (id, tenant_id, version) are stamped by the
	// executor — caller-provided values are ignored for id/version and
	// rejected for a foreign tenant_id.
	Payload any

	// ExpectedVersion enables optimistic concurrency: when set, the stored
	// version must match or the command fails with a VersionConflictError.
	ExpectedVersion *int64

	// SkipTypeCheck bypasses application-level payload type validation for this
	// one write (dynamic entities only). Zero value (false) = validate.
	SkipTypeCheck bool
}

type ErasureAuthorizer interface {
	WithErasureAuthorization(context.Context, ErasureResource, func(context.Context, ErasureGrant) error) error
}

type ErasureGrant struct {
	Actor             string
	AuthorityRevision string
}

type ErasureReceipt struct {
	TenantID            string          `json:"tenant_id"`
	Request             ErasureRequest  `json:"request"`
	Actor               string          `json:"actor"`
	AuthorityRevision   string          `json:"authority_revision"`
	LastVersion         int64           `json:"last_version"`
	ErasedAt            time.Time       `json:"erased_at"`
	LocalPayloadsErased bool            `json:"local_payloads_erased"`
	LocalTargets        []string        `json:"local_targets"`
	OutboxRowsRedacted  int64           `json:"outbox_rows_redacted"`
	Downstream          []CleanupStatus `json:"downstream"`
}

type ErasureRequest struct {
	Entity          string `json:"entity"`
	AggregateID     string `json:"aggregate_id"`
	ScopeID         string `json:"scope_id"`
	ExpectedVersion int64  `json:"expected_version"`
	ReasonCode      string `json:"reason_code"`
}

type ErasureResource struct {
	TenantID string
	Request  ErasureRequest
}

type ErasureTx interface {
	FenceAggregate(context.Context, *registry.Entity, string) error
	EraseAggregate(context.Context, *registry.Entity, ErasureRequest, ErasureGrant, time.Time) (ErasureReceipt, error)
}

type Executor struct {
	// contains filtered or unexported fields
}

type ExecutorOption func(*Executor)

type HookFunc func(ctx context.Context, tx Tx, change Change) error

type LifecycleHook interface {
	// OnChange runs INSIDE the write transaction, after the aggregate row and
	// its outbox event are staged and before commit. Returning an error aborts
	// the whole command (and any batch it belongs to): the write, the outbox
	// event, and anything the hook wrote via tx all roll back together. Use tx
	// to write additional rows atomically with the change.
	OnChange(ctx context.Context, tx Tx, change Change) error
}

type Op int

type PostCommitFunc func(ctx context.Context, changes []Change)

type PostCommitHook interface {
	AfterCommit(ctx context.Context, changes []Change)
}

type Result struct {
	AggID   string
	Version int64
	EventID string
}

type Store interface {
	InTenantTx(ctx context.Context, fn func(ctx context.Context, tx Tx) error) error
}

type Tx interface {
	// CurrentVersion returns the aggregate's stored version, 0 if absent.
	CurrentVersion(ctx context.Context, ent *registry.Entity, aggID string) (int64, error)

	// ApplyChange writes the row: insert/update with the column-keyed
	// values (already structurally stamped), or delete for OpDelete.
	ApplyChange(ctx context.Context, ent *registry.Entity, op Op, aggID string, version int64, vals map[string]any) error

	// AppendOutbox appends the event envelope to the transactional outbox.
	AppendOutbox(ctx context.Context, env event.Envelope) error

	// Exec runs a raw statement inside the command transaction (the tenant is
	// already stamped via SET LOCAL app.tenant_id). It is the escape hatch a
	// LifecycleHook uses to write its own rows atomically with the aggregate
	// change. SQL here is control-plane-trusted — the same level as a migration
	// or the relational raw Query escape hatch; the command path is Postgres-
	// bound (the source of truth), so this introduces no engine type into core.
	Exec(ctx context.Context, sql string, args ...any) error
}