@kelpie/server 0.12.0 → 0.13.0

package/migrations/0046_drop_company_website.sql

@@ -0,0 +1,66 @@
+-- Domain is the company homepage. `website` was a second URL that almost
+-- always repeated `https://` plus the same host. Fill a blank domain from
+-- that URL, then drop the column. Visit on the heading opens https://{domain}.
+UPDATE "companies" AS c
+SET "domain" = v.host
+FROM (
+  SELECT DISTINCT ON (workspace_id, host)
+    id,
+    workspace_id,
+    host
+  FROM (
+    SELECT
+      id,
+      workspace_id,
+      NULLIF(
+        regexp_replace(
+          regexp_replace(
+            regexp_replace(lower(trim(website)), '^[a-z][a-z0-9+.-]*://', ''),
+            '/.*$',
+            ''
+          ),
+          '\.$',
+          ''
+        ),
+        ''
+      ) AS host
+    FROM "companies"
+    WHERE "domain" IS NULL AND "website" IS NOT NULL
+  ) AS sourced
+  WHERE host IS NOT NULL
+  ORDER BY workspace_id, host, id
+) AS v
+WHERE c.id = v.id
+  AND NOT EXISTS (
+    SELECT 1
+    FROM "companies" AS other
+    WHERE other.workspace_id = c.workspace_id
+      AND other.domain = v.host
+      AND other.id <> c.id
+  );
+--> statement-breakpoint
+ALTER TABLE "companies" DROP COLUMN "website";
+--> statement-breakpoint
+UPDATE "form_fields"
+SET "map_to" = 'company.domain'
+WHERE "map_to" = 'company.website';
+--> statement-breakpoint
+UPDATE "import_jobs"
+SET "column_map" = ("column_map" - 'website') || jsonb_build_object('domain', "column_map"->>'website')
+WHERE jsonb_typeof("column_map") = 'object'
+  AND "column_map" ? 'website'
+  AND "column_map"->>'website' IS NOT NULL
+  AND NOT (
+    "column_map" ? 'domain'
+    AND "column_map"->>'domain' IS NOT NULL
+  );
+--> statement-breakpoint
+UPDATE "import_jobs"
+SET "column_map" = "column_map" - 'website'
+WHERE jsonb_typeof("column_map") = 'object'
+  AND "column_map" ? 'website';
+--> statement-breakpoint
+UPDATE "import_jobs"
+SET "match_key" = 'domain'
+WHERE "object" = 'companies'
+  AND "match_key" = 'website';

package/migrations/meta/_journal.json

@@ -309,6 +309,27 @@
       "when": 1788700000000,
       "tag": "0043_external_sign_in",
       "breakpoints": true
+    },
+    {
+      "idx": 44,
+      "version": "7",
+      "when": 1788800000000,
+      "tag": "0044_events",
+      "breakpoints": true
+    },
+    {
+      "idx": 45,
+      "version": "7",
+      "when": 1788900000000,
+      "tag": "0045_addresses",
+      "breakpoints": true
+    },
+    {
+      "idx": 46,
+      "version": "7",
+      "when": 1789000000000,
+      "tag": "0046_drop_company_website",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,11 +52,11 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.12.0",
+    "@kelpie/schemas": "^0.13.0",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "emittery": "^2.0.0",
-    "hono": "^4.12.32",
+    "hono": "^4.13.7",
     "mailgen": "^2.0.36",
     "nodemailer": "^9.0.5",
     "postgres": "^3.4.9",

package/src/app.ts

@@ -2,6 +2,8 @@ import { Hono } from 'hono'
 import type { Context } from 'hono'
 import { cors } from 'hono/cors'
 
+import type { PublicRegion } from '@kelpie/schemas'
+
 import type { RuntimeMode } from './lib/config.ts'
 import type { DatabaseProbe } from './lib/database.ts'
 import { AppError, internalErrorBody, toErrorBody } from './lib/errors.ts'
@@ -65,6 +67,18 @@ export interface AppDependencies {
    * name itself".
    */
   readonly siteName?: string | undefined
+  /**
+   * Reported through `GET /v1/public/config` so the sign-up page can show a
+   * "signups are closed" message instead of the form. Defaults to `true`
+   * (open), matching the config layer's own default.
+   */
+  readonly signupsEnabled?: boolean
+  /**
+   * Reported through `GET /v1/public/config` so signed-out pages can draw a
+   * region switcher. Defaults to `[]` (no switcher), matching a self-hosted
+   * install that never declared regions.
+   */
+  readonly regions?: readonly PublicRegion[]
 }
 
 /** Per-request values the middleware chain sets and handlers read. */
@@ -185,9 +199,19 @@ export function createApp(dependencies: AppDependencies): Hono<AppBindings> {
   // exists to be visible; nothing here is sensitive.
   const runtimeMode: RuntimeMode = dependencies.runtimeMode ?? 'production'
   const siteName = dependencies.siteName ?? null
+  const signupsEnabled = dependencies.signupsEnabled ?? true
+  const regions = dependencies.regions ?? []
 
   app.get(`${PUBLIC_ROUTE_PREFIX}/config`, (context) =>
-    context.json({ runtime_mode: runtimeMode, site_name: siteName }, 200),
+    context.json(
+      {
+        runtime_mode: runtimeMode,
+        site_name: siteName,
+        signups_enabled: signupsEnabled,
+        regions,
+      },
+      200,
+    ),
   )
 
   for (const { router } of dependencies.contributions.routers) {

package/src/boot.ts

@@ -77,6 +77,7 @@ export async function bootAssembly(
       now: () => new Date(),
       appBaseUrl: config.appBaseUrl,
       secretEncryption: config.secretEncryption,
+      signupsEnabled: config.signups === 'open',
     },
     // `provider` picks a named sender from the runtime's registry. `'log'` is
     // built in; `'smtp'` is registered by the built-in `smtp-email` core

package/src/lib/apiKeyScopes.ts

@@ -58,6 +58,10 @@ const ROUTE_SCOPE_RULES: readonly RouteScopeRule[] = [
   { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/v1\/roles(?:\/[^/]+)?$/u, scope: 'roles:write' },
   { methods: ['GET'], pattern: /^\/v1\/candidates(?:\/[^/]+)?$/u, scope: 'candidates:read' },
   { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/v1\/candidates(?:\/[^/]+)?$/u, scope: 'candidates:write' },
+  { methods: ['GET'], pattern: /^\/v1\/(?:events(?:\/[^/]+(?:\/attendances)?)?|event-associations)$/u, scope: 'events:read' },
+  { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/v1\/(?:events(?:\/[^/]+(?:\/attendances)?)?|event-associations)$/u, scope: 'events:write' },
+  { methods: ['GET'], pattern: /^\/v1\/attendances(?:\/[^/]+)?$/u, scope: 'attendances:read' },
+  { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/v1\/attendances(?:\/[^/]+)?$/u, scope: 'attendances:write' },
   { methods: ['GET'], pattern: /^\/v1\/decisions(?:\/[^/]+)?$/u, scope: 'decisions:read' },
   { methods: ['POST', 'PATCH', 'DELETE'], pattern: /^\/v1\/decisions(?:\/[^/]+)?$/u, scope: 'decisions:write' },
   { methods: ['GET'], pattern: /^\/v1\/plan_items(?:\/[^/]+)?$/u, scope: 'plan_items:read' },
@@ -100,6 +104,7 @@ const ROUTE_SCOPE_RULES: readonly RouteScopeRule[] = [
   { methods: ['GET'], pattern: /^\/v1\/workspaces\/[^/]+\/modules(?:\/[^/]+)?$/u, scope: 'modules:read' },
   { methods: ['PATCH'], pattern: /^\/v1\/workspaces\/[^/]+\/modules(?:\/[^/]+)?$/u, scope: 'modules:write' },
   { methods: ['POST'], pattern: /^\/v1\/workspaces\/[^/]+\/sample-data$/u, scope: 'sample_data:write' },
+  { methods: ['POST'], pattern: /^\/v1\/workspaces\/[^/]+\/handbook\/seed$/u, scope: 'handbook:write' },
   { methods: ['POST'], pattern: /^\/v1\/workspaces\/[^/]+\/relink-email-domains$/u, scope: 'workspace:write' },
   { methods: ['GET'], pattern: /^\/v1\/mcp\/tools$/u, scope: 'search:read' },
 ]
@@ -158,6 +163,7 @@ const MCP_RESOURCE_ALIASES: Readonly<Record<string, string>> = {
   consent_purposes: 'consent_purposes',
   form_submissions: 'forms',
   list_memberships: 'lists',
+  event_associations: 'events',
   agent_tasks: 'agent_tasks',
   agent_runs: 'agent_runs',
   import_jobs: 'import_export',

package/src/lib/columns.ts

@@ -60,6 +60,12 @@ export interface SearchVectorPart {
    * a generated column built on it.
    */
   readonly array?: boolean
+  /**
+   * True for an `addresses` jsonb column. Flattened by
+   * `kelpie_addresses_search_text`, a wrapper that migration `0045` adds so the
+   * generated vector reads city and postal code without the kind keys.
+   */
+  readonly addresses?: boolean
 }
 
 /**
@@ -78,9 +84,12 @@ export interface SearchVectorPart {
 const SPLIT_ON_PUNCTUATION = sql.raw("'[^[:alnum:]]+', ' ', 'g'")
 
 function searchVectorPart(part: SearchVectorPart): SQL {
-  const raw = part.array === true
-    ? sql`coalesce(kelpie_text_array_to_string(${part.column}), '')`
-    : sql`coalesce(${part.column}::text, '')`
+  const raw =
+    part.addresses === true
+      ? sql`coalesce(kelpie_addresses_search_text(${part.column}), '')`
+      : part.array === true
+        ? sql`coalesce(kelpie_text_array_to_string(${part.column}), '')`
+        : sql`coalesce(${part.column}::text, '')`
   const source = sql`regexp_replace(${raw}, ${SPLIT_ON_PUNCTUATION})`
 
   return sql`setweight(to_tsvector(${sql.raw(`'${SEARCH_CONFIGURATION}'`)}, ${source}), ${sql.raw(`'${part.weight}'`)})`

package/src/lib/config.ts

@@ -1,3 +1,4 @@
+import type { PublicRegion } from '@kelpie/schemas'
 import { z } from 'zod'
 
 import { emailConfigSchema } from './email.ts'
@@ -24,6 +25,9 @@ export type RuntimeMode = 'development' | 'test' | 'production'
 
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error'
 
+/** Whether `POST /v1/auth/signup` and external-sign-in provisioning accept a brand-new account. */
+export type SignupsMode = 'open' | 'closed'
+
 /**
  * Everything the logger needs to boot: the minimum severity to emit, and the
  * ordered list of destinations each line is written to. Stdout is one such
@@ -96,6 +100,20 @@ export interface KelpieConfig {
    * it, so both webhooks and agent-tasks receive it through `services`.
    */
   readonly secretEncryption: SecretEncryptionConfig | undefined
+  /**
+   * Whether the instance accepts a brand-new account, through password signup
+   * or external-sign-in provisioning. Defaults to `'open'`, so a self-hoster
+   * who never sets `SIGNUPS` sees no change in behaviour. Joining an existing
+   * workspace via invite, and workspace creation by an already-verified
+   * account, are unaffected either way.
+   */
+  readonly signups: SignupsMode
+  /**
+   * Origins a multi-region assembly advertises on signed-out pages. Empty
+   * (the default) hides the switcher. Two or more draws it. Exposed through
+   * `GET /v1/public/config`.
+   */
+  readonly regions: readonly PublicRegion[]
 }
 
 /** Thrown at boot when the environment cannot produce a valid configuration. */
@@ -129,6 +147,7 @@ const environmentSchema = z.object({
   KELPIE_SITE_NAME: z.string().min(1).optional(),
   WEB_BUNDLE_DIR: z.string().min(1).optional(),
   TRUSTED_PROXY_HOP_COUNT: z.coerce.number().int().nonnegative().default(0),
+  SIGNUPS: z.enum(['open', 'closed']).default('open'),
   ...rateLimitConfigSchema.shape,
 })
 
@@ -171,5 +190,7 @@ export function loadConfig(environment: Environment): KelpieConfig {
     env: environment,
     appBaseUrl: undefined,
     secretEncryption: undefined,
+    signups: environmentResult.data.SIGNUPS,
+    regions: [],
   }
 }

package/src/lib/egress.ts

@@ -74,17 +74,21 @@ function isPrivateIpv4(ip: string): boolean {
 
 /** True for an IPv6 address in a loopback, unspecified, link-local, or unique-local range. */
 function isPrivateIpv6(ip: string): boolean {
-  const lower = ip.toLowerCase()
+  // Normalize both DNS results and literals. URL parsing compresses IPv6 and
+  // rewrites a dotted IPv4 suffix as two hexadecimal groups.
+  const lower = new URL(`http://[${ip}]/`).hostname.slice(1, -1)
 
   if (lower === '::1' || lower === '::') {
     return true
   }
 
-  const mapped = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/u.exec(lower)
+  const mapped = /^::ffff:([\da-f]{1,4}):([\da-f]{1,4})$/u.exec(lower)
 
-  if (mapped?.[1] !== undefined) {
+  if (mapped?.[1] !== undefined && mapped[2] !== undefined) {
     // An IPv4 address written in IPv6 form resolves by its IPv4 rules.
-    return isPrivateIpv4(mapped[1])
+    const high = Number.parseInt(mapped[1], 16)
+    const low = Number.parseInt(mapped[2], 16)
+    return isPrivateIpv4([high >>> 8, high & 255, low >>> 8, low & 255].join('.'))
   }
 
   const firstHextet = Number.parseInt(lower.split(':')[0] || '0', 16)

package/src/lib/errors.ts

@@ -89,25 +89,32 @@ export class AppError extends Error {
  * A reason rather than a message, so a provider module can branch on it (to
  * redirect somewhere useful, say) without matching on English text.
  */
-export type ExternalSignInRefusal = 'email_unverified' | 'unknown_identity'
+export type ExternalSignInRefusal = 'email_unverified' | 'unknown_identity' | 'signups_closed'
+
+const EXTERNAL_SIGN_IN_CODE: Record<ExternalSignInRefusal, ErrorCode> = {
+  email_unverified: 'unauthorized',
+  unknown_identity: 'forbidden',
+  signups_closed: 'forbidden',
+}
+
+const EXTERNAL_SIGN_IN_MESSAGE: Record<ExternalSignInRefusal, string> = {
+  email_unverified: 'The identity provider did not verify this email address',
+  unknown_identity: 'No account exists for this identity',
+  signups_closed: 'Signups are closed on this instance',
+}
 
 /**
  * An external sign-in core would not complete.
  *
  * An `AppError`, so an uncaught one still renders as the `api.md` body. No new
- * `ErrorCode`: refusing an unverified identity is an ordinary `401`, and
- * refusing to provision is an ordinary `403`.
+ * `ErrorCode`: refusing an unverified identity is an ordinary `401`, and both
+ * refusing to provision and signups being closed are an ordinary `403`.
  */
 export class ExternalSignInError extends AppError {
   readonly reason: ExternalSignInRefusal
 
   constructor(reason: ExternalSignInRefusal) {
-    super(
-      reason === 'email_unverified' ? 'unauthorized' : 'forbidden',
-      reason === 'email_unverified'
-        ? 'The identity provider did not verify this email address'
-        : 'No account exists for this identity',
-    )
+    super(EXTERNAL_SIGN_IN_CODE[reason], EXTERNAL_SIGN_IN_MESSAGE[reason])
     this.name = 'ExternalSignInError'
     this.reason = reason
   }

package/src/lib/ids.ts

@@ -71,6 +71,17 @@ export const idPrefixes = {
    * key. Not persisted by core.
    */
   event: 'ev',
+  /**
+   * A dated CRM gathering. The public prefix is `event_`; the factory key is
+   * `crmEvent` because `event` already stamps domain-event envelopes as `ev_`.
+   */
+  crmEvent: 'event',
+  attendance: 'atnd',
+  /**
+   * Never returns over the wire: associations nest on the Event and on
+   * `GET /v1/event-associations`. Same reason as `personLink`.
+   */
+  eventAssociation: 'elink',
 } as const
 
 export type ObjectKind = keyof typeof idPrefixes

package/src/lib/kelpieConfigFile.ts

@@ -1,6 +1,17 @@
+import type { PublicRegion } from '@kelpie/schemas'
+import { publicRegionSchema } from '@kelpie/schemas'
+
 import type { KelpieModule } from '../runtime/module.ts'
-import { ConfigurationError, type Environment, type KelpieConfig, type LogLevel, type RuntimeMode } from './config.ts'
+import {
+  ConfigurationError,
+  type Environment,
+  type KelpieConfig,
+  type LogLevel,
+  type RuntimeMode,
+  type SignupsMode,
+} from './config.ts'
 import type { EmailConfig } from './email.ts'
+import { describeValidationIssue } from './errors.ts'
 import { type ConfigValue, resolveMarkers } from './fromEnv.ts'
 import type { LoggingDestination } from './logger.ts'
 import type { RateLimitConfig } from './rateLimit.ts'
@@ -35,6 +46,19 @@ export interface KelpieConfigInput {
   readonly siteName?: ConfigValue<string | undefined>
   /** Optional; defaults to 0 (no proxy in front). */
   readonly trustedProxyHopCount?: ConfigValue<number>
+  /**
+   * Whether the instance accepts a brand-new account. Optional; defaults to
+   * `'open'`, matching `loadConfig`'s default, so an assembly that never sets
+   * this sees no change in behaviour.
+   */
+  readonly signups?: ConfigValue<SignupsMode>
+  /**
+   * Origins a multi-region assembly advertises on signed-out pages. Optional;
+   * omitted or empty hides the switcher, matching a self-hosted install.
+   * Two or more draws it. Each `id` and `origin` must be unique, and each
+   * `origin` must be an absolute `http:` or `https:` origin.
+   */
+  readonly regions?: ConfigValue<readonly PublicRegion[]>
   /**
    * The deployment's base URL. Every emailed link (password reset, email
    * verification, invite) is built from it. Required by the workspace and auth
@@ -164,6 +188,9 @@ export function resolveKelpieConfig(input: KelpieConfigInput, environment: Envir
   const rateLimit = buildRateLimitConfig(resolved.rateLimit)
   const env = mergeEnv(environment, resolved.env)
   const secretEncryption = buildSecretEncryptionConfig(resolved.secretEncryption)
+  const regions = resolved.regions ?? []
+
+  problems.push(...describeRegionProblems(regions))
 
   if (problems.length > 0) {
     throw new ConfigurationError(problems)
@@ -186,6 +213,8 @@ export function resolveKelpieConfig(input: KelpieConfigInput, environment: Envir
     env,
     appBaseUrl: resolved.appBaseUrl,
     secretEncryption,
+    signups: resolved.signups ?? 'open',
+    regions,
   }
 }
 
@@ -217,6 +246,8 @@ interface ResolvedInput {
   readonly moduleConfigPath?: string | undefined
   readonly siteName?: string | undefined
   readonly trustedProxyHopCount?: number
+  readonly signups?: SignupsMode
+  readonly regions?: readonly PublicRegion[]
   readonly appBaseUrl?: string
   readonly secretEncryption?: ResolvedSecretEncryption
   readonly email: ResolvedEmail
@@ -242,6 +273,43 @@ interface ResolvedRateLimit {
   readonly api?: { readonly limit?: number; readonly windowSeconds?: number }
 }
 
+function describeRegionProblems(regions: readonly unknown[]): string[] {
+  const problems: string[] = []
+  const ids = new Set<string>()
+  const origins = new Set<string>()
+
+  for (const [index, region] of regions.entries()) {
+    const parsed = publicRegionSchema.safeParse(region)
+
+    if (!parsed.success) {
+      for (const issue of parsed.error.issues) {
+        problems.push(
+          describeValidationIssue({
+            path: ['regions', index, ...issue.path],
+            message: issue.message,
+          }),
+        )
+      }
+
+      continue
+    }
+
+    if (ids.has(parsed.data.id)) {
+      problems.push(`regions.${String(index)}.id: duplicate id '${parsed.data.id}'`)
+    }
+
+    ids.add(parsed.data.id)
+
+    if (origins.has(parsed.data.origin)) {
+      problems.push(`regions.${String(index)}.origin: duplicate origin '${parsed.data.origin}'`)
+    }
+
+    origins.add(parsed.data.origin)
+  }
+
+  return problems
+}
+
 function buildEmailConfig(resolved: ResolvedEmail | undefined): EmailConfig {
   // Missing `email.provider` or `email.from` is already recorded by the
   // walker; return a placeholder so `resolveKelpieConfig` reaches its throw

package/src/modules/agent-tasks/catalog.ts

@@ -128,7 +128,7 @@ Append a Note, update summary only when clearly supported, propose Plan items on
     targetTypes: ['company'],
     placement: 'primary',
     handbookSlugs: ['ideal-customer-profile', 'agent-faq'],
-    instructions: `Research this Company. Update description, stage, sizeBand, techStack, website/linkedin when evidenced, tags, and summary.
+    instructions: `Research this Company. Update description, stage, sizeBand, techStack, domain when evidenced, tags, and summary.
 Append a Note listing sources. Prefer notes over guesses for uncertain facts.`,
   }),
   task({
@@ -623,6 +623,28 @@ Ask before setting stage to passed.`,
     instructions: `The human will paste notes after this prompt. Append a Note; propose Plan items; extract Decisions.`,
   }),
 
+  // Event
+  task({
+    id: 'event.brief',
+    label: 'Event brief',
+    description: 'Agenda, who is registered, linked records, open Plans.',
+    targetTypes: ['event'],
+    placement: 'primary',
+    handbookSlugs: ['agent-faq'],
+    instructions: `Prepare a brief for this Event: agenda from details, who is registered, linked records, and open Plan items.
+Do not invent attendees. Prefer pinned notes and Decisions.`,
+  }),
+  task({
+    id: 'event.follow_up',
+    label: 'Follow up',
+    description: 'Draft follow-up from attended vs no-show Attendances.',
+    targetTypes: ['event'],
+    placement: 'primary',
+    handbookSlugs: ['voice-and-tone', 'agent-faq'],
+    instructions: `Draft follow-up from this Event's Attendances. Separate attended from no-show.
+Save drafts as Notes. Do not send email.`,
+  }),
+
   // Candidate
   task({
     id: 'candidate.score',
@@ -753,6 +775,16 @@ Suggest Draft outreach or Plan items. Do not spam everyone.`,
     handbookSlugs: ['how-we-sell', 'agent-faq'],
     instructions: `Propose a week of Plan items across open Deals, Opportunities, Raises, and Partnerships.
 Create Plan items only when clearly useful; otherwise list proposals for confirmation.`,
+  }),
+  task({
+    id: 'workspace.upcoming_events',
+    label: 'Upcoming events',
+    description: 'Scheduled Events in the next week and their attendee counts.',
+    targetTypes: ['workspace'],
+    placement: 'primary',
+    handbookSlugs: ['agent-faq'],
+    instructions: `List scheduled Events in the next week with attendee counts.
+Use GET /v1/dashboard upcoming_events. Suggest follow-up or brief tasks where useful.`,
   }),
   task({
     id: 'workspace.empty_field_sweep',

package/src/modules/agent-tasks/index.ts

@@ -38,6 +38,7 @@ export function createAgentTasksModule(
       'partnerships',
       'raises',
       'hiring',
+      'events',
       'plans',
       'decisions',
       'notes',

package/src/modules/agent-tasks/resolve.ts

@@ -9,6 +9,7 @@ import { companies } from '../companies/schema.ts'
 import { deals } from '../deals/schema.ts'
 import { decisions } from '../decisions/schema.ts'
 import { enquiries } from '../enquiries/schema.ts'
+import { attendances } from '../events/schema.ts'
 import { handbookPages } from '../handbook/schema.ts'
 import { candidates, roles } from '../hiring/schema.ts'
 import { notes } from '../notes/schema.ts'
@@ -443,6 +444,16 @@ async function collectRelated(
         ),
       }
 
+    case 'event':
+      return {
+        person_ids: await relatedFrom(
+          db,
+          attendances,
+          attendances.personId,
+          and(eq(attendances.workspaceId, workspaceId), eq(attendances.eventId, targetId)) as SQL,
+        ),
+      }
+
     case 'handbook':
     case 'workspace':
       return {}